Privacy Policy

Who we are & our two roles

CloseFlow Ink is operated by Line and Point LLC (United States). CloseFlow Ink has two distinct privacy roles:

• Processor: When tattoo artists and studios ("Operators") use CloseFlow Ink to manage their own clients, the Operator is the data controller of that client data and CloseFlow Ink acts as a processor on the Operator's behalf, under our Data Processing Addendum.
• Controller: CloseFlow Ink is an independent controller for the account, billing, security, and product-usage data of the Operators themselves.

This policy describes both roles.

Information we collect

Depending on how the Service is used, we process:

• Identity & contact data: name, email, phone, Instagram handle.
• Scheduling data: appointments and calendar events.
• Message content exchanged through connected channels (email, SMS, Instagram, Facebook).
• Tattoo reference images you or your clients upload.
• Digital waivers, including the electronic signature, the signer's IP address, and device/browser (user-agent) captured to evidence signing.
• Payment & transaction records — card details are collected and stored by Stripe, not by us.
• Google Calendar event data and OAuth tokens where you connect Google Calendar.
• Technical, usage, cookie, and analytics data from our websites and apps, including, on our public booking pages, the Meta Pixel (where you have consented) and analytics such as Google Analytics.

How we use it

To provide and secure the CRM and booking services; process appointments, messages, waivers, and payments; sync calendars; provide support; improve and develop features (including AI-assisted features where enabled); comply with legal obligations; and prevent fraud and abuse.

Google Calendar data & Google API Services Limited Use

When you connect Google Calendar, CloseFlow Ink uses the access you grant only to (i) create, update, and delete the appointment events that CloseFlow Ink books on your own calendar, and (ii) read your calendars' busy times so clients cannot double-book you. We request the narrowest scopes needed for this and nothing more.

CloseFlow Ink's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Calendar data is used only to provide and improve the calendar-sync feature you enabled. We do not sell this data, do not use it for advertising, and do not use it to train generalized or artificial-intelligence models. We disclose it to humans only where you ask us to, for security, or where required by law.

How we use an AI assistant

Operators can enable an AI assistant that helps read messages and prepare replies about bookings, availability, and deposits. The assistant is powered by Anthropic (Claude), a provider in the United States; the content of the messages and any images sent in the conversation are transmitted to Anthropic only to generate the reply. Anthropic acts as our service provider, does not use this content to train its models, and retains it only briefly. Transfers to the United States are protected by Standard Contractual Clauses.

Automated messages. Where an Operator enables autonomous mode, some replies — for example arranging a booking or requesting a deposit — may be sent automatically by the assistant. You have the right to ask for a human to handle your enquiry, to give your point of view, to contest any automated decision, and to have it explained. Contact the Operator, reply HUMAN, or email [email protected].

Sensitive details. Please avoid sending health, religious, or other sensitive information unless necessary; if you choose to share it so the Operator can arrange your tattoo, you consent to that processing and can withdraw it at any time.

Mobile app permissions

Our mobile apps ask your operating system for certain device permissions, and use each one only at the moment you take the related action — never in the background:

• Camera — to take a photo or video and attach it as a tattoo reference image to a project.
• Photo library / gallery — to let you choose existing photos or videos to upload as references, and to save an image to your device (for example, a client's reference photo) when you choose "Save to Photos." We do not scan, index, browse, or upload your photo library; we access only the specific items you select, or the single image you ask us to save.
• Microphone — to record the voice notes you send in chat.
• Notifications — to deliver appointment reminders and message alerts, if you allow them.

You can grant or revoke any of these permissions at any time in your device settings. Some related features will not work without the relevant permission.

Lawful bases (EEA/UK)

Where GDPR/UK GDPR applies and CloseFlow Ink is a controller, we rely on: contract (to deliver the service you signed up for); legitimate interests (security, product improvement, limited analytics), balanced against your rights; consent (non-essential cookies, tracking technologies, certain marketing); and legal obligation. For client data, the Operator (as controller) determines and documents the lawful basis.

Sensitive data

We do not intend to collect special-category data. Reference images or messages may incidentally reveal sensitive information; Operators are responsible for obtaining any consent required, and clients should avoid submitting health, religious, or other sensitive details unless necessary.

How we share it

• With sub-processors / service providers that power the Service (see Appendix B).
• With the Operator whose account a client booked with.
• With Stripe for payments.
• With analytics/measurement providers (e.g., Google Analytics) and, on our public booking pages, the Meta Pixel, where you have consented.
• To comply with law or protect rights.

We do not sell personal information for money. Use of advertising/analytics cookies may constitute a "sale" or "share" under certain US state laws — see Your US State Privacy Rights below. To opt out, email [email protected].

Cookies & tracking

Our public pages use cookies and similar technologies, including analytics and the Meta Pixel. In the EEA/UK we load non-essential cookies and trackers only after you consent via our cookie banner; you can withdraw consent at any time. In the US you can opt out by emailing [email protected], and we honor recognized opt-out preference signals (e.g., Global Privacy Control).

Your rights

Depending on your location:

• GDPR/UK GDPR: access, correction, deletion, portability, restriction, objection, and withdrawal of consent.
• US state laws: to know/access, delete, correct, opt out of sale/share and of certain automated decision-making, and non-discrimination for exercising rights.

To exercise rights over data held by an Operator, we will refer or forward your request to that Operator as controller. Submit requests by emailing [email protected].

Your US state privacy rights

Residents of California and other states with privacy laws have the rights above. We honor "Do Not Sell or Share" requests and Global Privacy Control. We do not discriminate against you for exercising your rights.

Retention

We keep personal data while the Operator's account is active and as needed to provide the Service, then delete or anonymize it within a defined period, except where longer retention is required for legal, tax, waiver-evidence, or dispute-resolution purposes.

International transfers

We are US-based. Transfers from the EEA/UK rely on the EU-US Data Privacy Framework (where certified) and/or Standard Contractual Clauses with a transfer risk assessment, and the UK IDTA/Addendum for UK data.

Minors

CloseFlow Ink is a business tool not directed to children under 13, and we do not knowingly collect their data. Tattoo clients who are minors (e.g., 16–17 where lawful) should only be entered by an Operator with appropriate parental/guardian consent; Operators are responsible for obtaining that consent.

Security

We apply industry-standard technical and organizational measures and host data with reputable cloud providers. No method of transmission or storage is 100% secure.

Contact & representatives

Controller: Line and Point LLC, 2108 N Street, Sacramento, California, United States, [email protected].
EU representative (GDPR Art. 27): Not applicable — CloseFlow Ink does not currently maintain an establishment in the EU or UK.
UK representative: Not applicable — CloseFlow Ink does not currently maintain an establishment in the EU or UK.

Appendix B — Sub-processor list

The third-party sub-processors below help power the Service. We sign a data processing agreement with each and review entries against actual data flows.