Who this notice covers
Visitors to this site, pilot applicants, studio staff, clients who receive a care plan, people who send a studio a request through an Inkstay request page, and people who sign a studio's consent form.
Data controller
For the site, pilot applications and studio accounts, the controller is İsmail Semih Pehlivan, a natural person, address Merdivenköy Mah., 34732 Istanbul, Türkiye. Contact: info@montilabs.co.
For care plan records, the controller is the studio the client visited. Inkstay processes those records on the studio's behalf. See the data processing agreement.
For requests sent through a request page, and the reference photos, quotes and appointments that follow, the controller is also the studio you wrote to. Inkstay processes these records on the studio's behalf and on its instructions. Send requests about them to the studio first; if you write to us, we pass them on to the studio.
For consent forms, health answers and care instruction acknowledgements, the controller is also the studio.
What we process
Pilot application: studio name, your name, your email, country, number of artists; if you add them, your Instagram address and how you work today.
Account: your email address, session records and role; for studio accounts, a hash of your password (never the password itself). Sign-in email is stored in plain text; client, invite, application and waitlist emails and support messages are stored encrypted.
Care: client name, email, tattoo title, plan, task marks and messages with the studio. If the iOS app is used, a device address for notifications is kept too. We don't ask for skin photos. Artist stencils are stored only as single-colour drawings.
Technical: a hash of your IP address for rate limiting, and email sending records. Email opens and clicks are not tracked.
Request form
When you fill in the form on a studio's request page, you send that studio: your name, your email address, your WhatsApp number and Instagram handle if you add them, your tattoo idea, placement, approximate size, black or colour preference, your budget range if you add one, and your artist and timing preferences. You don't need an account.
To send the form, you state that you are 18 or over and confirm that you have read this notice. The time of your statement and confirmation is recorded. We don't check your age against a document; checking it before an appointment is the studio's job.
Your email address, phone number and idea are stored encrypted. A one-way hash of your email is kept so the studio can see that you have written before. To prevent abuse, the number of submissions is limited using a hash of your IP address.
The studio may be told about a new request by email. That email says only that a new request arrived, not what is in it.
Reference photos
Adding photos is optional and needs a separate explicit consent. Without that consent nothing is uploaded, and you can send your request without photos.
You can add up to 5 photos. The server re-encodes each one and removes embedded information, including location (GPS). Photos are kept in storage that is closed to the public; the studio team sees them only through a signed link that works for a few minutes.
Add only images that explain your tattoo idea. Don't add images showing someone else's face, identity or health information.
To withdraw your consent, write to the studio you sent the request to or to info@montilabs.co. There is no button for this in the product yet; your request is handled by hand. Withdrawal does not make earlier processing unlawful.
Quotes and the quote link
If the studio sends you a quote, you get a link by email. The email contains only the studio's name and the link, not the quote itself. If you gave a WhatsApp number, the studio may also send the same link from its own WhatsApp account; the studio sends that message, and Inkstay is not connected to WhatsApp.
The link contains a key too long to guess and needs no account. Anyone with the link can see the quote, so don't share it. We don't keep the key itself, only a hash of it. A quote stays open for the period the studio sets (72 hours by default); an expired or withdrawn quote can't be accepted.
Opening the quote, choosing a time, accepting, asking for another time or saying no is recorded and shown to the studio. When you accept, the studio records you as a client and your appointment is created.
Deposits
If the quote asks for a deposit, after you accept you see the payment details the studio wrote. Inkstay takes no payment, does not act as an intermediary and never sees your card or bank details. You pay the studio directly, and the studio marks it as received. Refunds and cancellation terms are between you and the studio.
Record that you saw the care instructions
Your studio writes and publishes its care instructions; Inkstay does not review the content. The first time you open a plan you see this note once: "These are care instructions from {studio}. They are not medical advice. If you have a health problem, contact a health professional without waiting for the studio." and you tap "Got it".
What is recorded: your account, the time, the revision of the plan on screen, the version of the note's wording (care-ack-2026-11-02) and the note's language. It is recorded once per plan; you are not asked again for the same plan. The same details also go into the audit record.
This record shows that the note was shown to you. The studio is the controller. When you download your data, these records are included.
The "A health problem?" section at the end of every plan is added by Inkstay (version safety-2026-11-02); the studio cannot change it. That section is not medical advice.
Statements by studio staff when publishing and saving
When a studio owner or manager publishes a version of care instructions, they confirm two statements: "I have reviewed the instructions against my own practice." and "I am publishing these care instructions on behalf of my studio. My studio is responsible for the accuracy of the content; Inkstay does not review it." Who confirmed, when, and which statement version (studio-2026-11-02) are written onto the version and into the audit record.
Each time a new version of the consent form is saved, the owner or manager confirms "I use this form on behalf of my studio; my studio is responsible for its content." Who confirmed and when are written onto the version and into the audit record.
These records are kept to document the studio's statement. Who is the controller for these records is under counsel review.
Why we process it
To assess applications, provide the service, send reminders, keep it secure and meet legal obligations. Legal basis: entering into and performing a contract (KVKK art. 5/2-c), legal obligation (art. 5/2-ç) and legitimate interest (art. 5/2-f); explicit consent for reference photos (art. 5/1).
Support messages and health information are not used for advertising, segmentation or model training.
How long we keep it
Rejected and waitlisted applications for 12 months, technical sending records for 90 days, audit records for 12 months, support conversations for 90 days after closing. Care history stays until you delete it or until a notified clean-up after 24 months of inactivity.
Requests: photos from a request that did not become an appointment are deleted automatically after 90 days, and the details of a request that became neither an appointment nor a client record after 12 months. Photos that were added but never sent are deleted within 2 days. When a request becomes an appointment, its details and photos become part of the studio's client record.
Care instruction acknowledgements and publishing statements stay in their own records with no end date; their copies in the audit record are deleted after 12 months. If you delete your account, the acknowledgement is no longer linked to your identity.
A signed consent form is kept for the period the studio sets (between 1 and 30 years, 10 years by default) and is deleted automatically when that period ends.
These periods are proposals and will be confirmed by legal review.
Who we share it with
Service providers for hosting and email delivery: Hosting Dünyam (server, Türkiye), Resend, Inc. (email delivery; a US company, sending from the EU); for notifications in the iOS app, 650 Industries, Inc. (Expo, USA) and Apple Inc. (Apple Push Notification service). A notification carries only the device address and a generic text, never tattoo or health details. Basis for international transfers: standard contracts announced by the Turkish Personal Data Protection Board under KVKK art. 9, notified to the Board. We don't sell data.
Reference photos and other records are stored on Inkstay's server in Türkiye; the company providing the server is a subprocessor for this. Storage region: Türkiye (Istanbul).
Your request details are shown only to the studio you wrote to and are not shared with other studios.
Your rights
You can access your data, ask for it to be corrected or deleted, and object to processing. Clients can do this from their preferences screen; anyone else at info@montilabs.co.
For records the studio controls (requests, consent forms, health answers, care acknowledgements), send your request to the studio first. As a client, the file you download includes the consent forms you signed and your care acknowledgements.
Age limit
The request form and care plans are only for people aged 18 or over.
Digital consent form
A studio can have its client sign a consent form the studio wrote itself, by link or on a device in the studio, before the session. The studio is responsible for the form's content, for which health questions are asked, and is the controller for these records; Inkstay processes them on the studio's behalf.
What is recorded: the name the signer types, the time of signing, the form version signed, the method (link or studio device), IP address and browser details, the boxes ticked, an optional drawn signature and, if the studio asked health questions, the answers and the time of the explicit consent. A signed record is not changed afterwards.
Health answers are special category personal data. They are recorded only with the client's separate explicit consent; without it the health questions are not shown and the form can still be signed. Health answers and the drawn signature are stored encrypted. In the product, health answers, the drawn signature, IP address and browser details are shown only to the studio's owner, managers and the artist assigned to that appointment; reception sees only who signed and when. Health answers never go into emails, analytics or logs. Each time the health answers are opened or a PDF is downloaded, this is written to the audit record without the content.
A signed form is kept for the legal period the studio sets, 10 years by default. If a client deletes their account, the health answers are always deleted. If the studio has recorded a legal reason to keep that client's records, the rest of the signed form stays as evidence until the period ends; without a recorded reason the name, drawn signature, IP address and browser details are deleted too, and only which form version was signed and when remains, without a name.
The form is signed with a simple electronic signature. It is not claimed to replace a handwritten or qualified electronic signature. The form and the notes on the signing page give no medical assessment or advice.
Changes
Effective date: 6 November 2026. If this text changes, we ask for consent again against the new version.