Draft: This text is a draft and is not in force. It takes effect only when Inkstay's founder puts it in force in writing. Sections marked as new or changed were added or rewritten in this draft. Inkstay can't go live with real clients while bracketed fields are empty. This text is not legal advice and does not claim to comply with any particular law.
Parties and roles
New or changed · Not yet in force
The studio is the controller. Monti Labs Ltd. Şti., operator of Inkstay (inkstay.app) is the processor ("Inkstay", "we"). This agreement forms part of the terms of use, and the studio accepts it with them.
These roles apply to care plans and messages, requests sent through the request page, reference photos, quotes, appointments, deposit records, consent forms and health answers, and care instruction acknowledgements.
Where California law applies to the studio, Inkstay acts as its service provider for this data.
Subject, duration, nature and purpose
New or changed · Not yet in force
Care plan handover, task reminders, messages between studio and client, and the records these need. Processing runs for as long as the studio uses Inkstay and ends as set out under "End of the agreement".
Also: the request page and request form, storing reference photos and showing them to the studio, preparing quotes and presenting them to the requester through the quote link, and recording appointments and deposit status.
Also: storing the studio's consent form, presenting it to the client by link or on a studio device, recording the signature and health answers, showing them to authorised roles, PDF and export; recording the client's acknowledgement that they saw the care instructions.
People and data
New or changed · Not yet in force
People: the studio's clients, people who send the studio a request, people who sign its consent form, and the studio's team.
Clients: name, email, phone if the studio enters it, tattoo title, session date, plan and task records, messages, and a device address for notifications if they use the iOS app. Messages may contain health information and are treated as special category data.
Requesters: name, email, optional WhatsApp number and Instagram handle, tattoo idea, placement, size, colour preference, budget range, artist and timing preferences, the 18+ statement and consent times, reference photos added with separate explicit consent, quote, acceptance and deposit status. The idea text and photos may unexpectedly contain health information or data about other people.
People who sign a consent form: the name they type, the time of signing, the form version, the method (link or studio device), IP address, browser details, the boxes ticked, an optional drawn signature; if they gave separate explicit consent, their answers to the health questions the studio picked from a fixed list, optional notes and the time of consent. Health answers are special category personal data.
Care instruction acknowledgement: the client's account, the time, the plan revision, the wording version and the language.
Health data and explicit consent
New or changed · Not yet in force
The studio chooses which health questions to ask and is responsible for not asking more than it needs.
Before showing health questions, the signing page asks the client for a separate, optional explicit consent: "I give explicit consent for this studio to process my health information to decide whether the session can be done safely." Without it no answers are recorded and the form can still be signed. The time of consent and the wording version are recorded.
The studio assesses whether this text meets its own notice and explicit consent obligations.
Instructions
New or changed · Not yet in force
We process the data only on the studio's documented instructions. These are this agreement, the terms of use and what the studio sets in the product. Any other instruction needs our written agreement.
We tell the studio straight away if we think an instruction breaks data protection law. If a law requires us to process the data in another way, we tell the studio first, unless that law forbids it.
We don't sell the data, don't share it for advertising, don't use it for our own purposes and don't combine it with data from other sources, except where the law allows a service provider to do so.
Confidentiality
New or changed · Not yet in force
Only people who need access to run the service get it. Each of them is bound by a duty of confidentiality that continues after their work ends.
Security measures
New or changed · Not yet in force
Row-level tenant isolation, field-level encryption for sensitive fields, multi-factor authentication for owners and platform roles, audit records, and access limits between roles.
Reference photos are re-encoded with embedded information removed, kept in storage closed to the public, and shown through short-lived signed links. The quote link key is not stored, only its hash.
Health answers and the drawn signature on a consent form are encrypted at field level (AES-256-GCM) with additional data bound to the record. Only the owner, managers and the artist assigned to that appointment can read them; database row-level security rules repeat that limit. Reception sees only who signed and when. Each time the health answers are opened or a PDF is downloaded, this is written to the audit record without the content. Health answers never go into emails, analytics or logs.
The consent link key is not stored, only its hash. A link works for 7 days, and a signing session on a studio device for 2 hours. A signed record is not changed afterwards; only an erasure clears its personal fields.
Inkstay holds no third-party security certification today. We review these measures when the product changes.
Subprocessors
New or changed · Not yet in force
The studio gives general authorisation for the subprocessors below. Today they are: Hosting Dünyam (server for the app, database and photos, Istanbul, Türkiye); Resend, Inc. (email delivery; a US company, sending from the EU); 650 Industries, Inc. (Expo, push notifications, USA); Apple Inc. (Apple Push Notification service, USA). A notification carries only the device address and a generic text, never tattoo or health details.
We tell the studio by email at least 30 days before we add or replace a subprocessor. The studio can object in writing in that time on reasonable data protection grounds. If we can't resolve the objection, the studio can end the subscription before the change and we refund the fees paid for the unused period.
Each subprocessor is bound by a written contract with data protection obligations no weaker than these. We remain responsible to the studio for its work.
Where the data is kept and international transfers
New or changed · Not yet in force
Data and reference photos are kept on Inkstay's server in Istanbul, Türkiye. Email and push providers receive only what they need to deliver a message.
For a studio in the European Economic Area, its transfer of data to Inkstay in Türkiye is made under the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two, which form part of this agreement. The supervisory authority is the one for the studio's member state, and the clauses are governed by the law, and disputes heard by the courts, of the studio's member state. For a studio in the United Kingdom, the UK Addendum to those clauses applies; for Switzerland, the clauses apply as adapted for Swiss law.
Onward transfers to subprocessors in the USA rely on each provider's own transfer terms: Resend's data processing agreement uses the Standard Contractual Clauses and states that Resend is certified under the EU-US Data Privacy Framework; Expo states that it is certified under the EU-US Data Privacy Framework.
For a studio in Türkiye, transfers abroad are made under the standard contracts announced by the Personal Data Protection Board under KVKK art. 9, notified to the Board.
If the clauses and this agreement conflict, the clauses apply. On request we give the studio the information it needs for its transfer assessment.
Help for the studio
New or changed · Not yet in force
Clients can download and delete their own data in the product, and the owner can export the studio's data. For any other request from a person, we pass it to the studio without answering it ourselves, and help the studio respond.
We help the studio meet its duties on security, breach notification, data protection impact assessments and consultation with an authority, using the information we have.
Breach notification
New or changed · Not yet in force
We notify the studio without undue delay, and within 48 hours of becoming aware of a personal data breach. As far as we know at the time, the notice says what happened, which categories of data and roughly how many people are affected, the likely consequences, what we have done and whom to contact. We send further details as we learn them. Notifying the authority and the people affected is the studio's job; we provide the information it needs for that.
Retention and deletion
New or changed · Not yet in force
Photos from a request that did not become an appointment are deleted automatically after 90 days, and the details of a request that became neither an appointment nor a client record after 12 months; photos added but never sent are deleted within 2 days.
A signed consent form is kept for the period the studio chooses (between 1 and 30 years, 10 years by default) and is deleted automatically, with its health answers and signature, when that period ends. The studio sets the period to fit its own legal obligations.
If a client deletes their account, the health answers are always deleted. If the studio has recorded a legal reason to keep that client's records, the rest of the signed form stays as evidence until the period ends; without a recorded reason the name, drawn signature, IP address and browser details are deleted. Today a legal reason cannot be entered in the product; the studio tells Inkstay in writing.
Other studio records, such as clients, appointments and care history, are kept while the studio's account is open, unless the studio or the client deletes them sooner. The studio assesses whether these periods fit its own obligations.
End of the agreement
New or changed · Not yet in force
The owner can export the studio's data from the product before the agreement ends. The file contains signed consent forms, health answers and drawn signatures in readable form; the studio is responsible for keeping and sharing that file safely.
Within 30 days after the agreement ends, we delete the studio's data, or return it first if the studio asks, except records a law requires us to keep. This deletion is carried out by our team, not by an automatic job. We confirm it in writing on request.
Audits and information
New or changed · Not yet in force
On request we give the studio the information it needs to check that we meet this agreement, including this text, the subprocessor list and written answers to reasonable security questions.
If that is not enough, the studio, or an independent auditor bound by confidentiality, may audit us once a year, and also after a breach or at an authority's request. The studio gives 30 days' notice and bears its own costs. An audit may not give access to other studios' data.
Liability
New or changed · Not yet in force
Liability under this agreement is subject to the limits in the terms of use, except where data protection law does not allow a limit.
Apart from the Standard Contractual Clauses, which follow their own choice of law and courts, this agreement is governed by the law of the Republic of Türkiye, and the Istanbul courts and enforcement offices have jurisdiction.
Contact
New or changed · Not yet in force
info@montilabs.co. We have not yet appointed a representative in the EU or the UK under Article 27 GDPR / UK GDPR. Until we do, we do not offer the service to studios in the EU, the EEA, Switzerland or the UK.
Effective date: [effective date]. Version: 2026-11.