Privacy policy

Stencilbook helps tattoo artists run their studios. This policy explains what we collect, why, and the choices you have. It's written for two audiences: artists (our customers) and their clients (whose information artists store with us).

What we collect

• Artist accounts: name, email, studio name, and login credentials (or your Google account identity if you sign in with OAuth). Payment card details go directly to Stripe — we never see or store card numbers.
• Client records: contact details, appointment history, intake form answers (which may include health information such as allergies or medications), signed waivers, reference photos, and messaging consent — entered by the artist or submitted by the client through a private form link.
• Usage data: standard server logs (IP address, browser, pages requested) kept for security and debugging.

How we use it

• To provide the service: records, scheduling, payments, reminders.
• To bill artists for their subscription.
• To send messages a client has consented to receive (appointment reminders, form links). Consent is timestamped and every message is logged; SMS recipients can opt out at any time by replying STOP (Canada's Anti-Spam Legislation applies).
• We do not sell personal information, and we do not use client data for advertising.

Health information and waivers

Intake answers may include health details a client chooses to share. They are visible only to the artist's workspace, stored encrypted at rest, and never used for anything except the artist's records. Signed waivers are kept as tamper-evident PDFs that cannot be edited after signing, including by us or the artist.

Who processes data for us

We use a small set of service providers, each bound by their own data protection terms: Supabase (database, authentication, file storage), Stripe (subscriptions and client payments), Resend (email), Twilio (SMS), and Google Fonts (font files for the stencil maker; no personal data is sent). Data may be processed outside Canada by these providers.

Retention and deletion

• Artists can export all workspace data at any time (Settings → Your data), including while a subscription is lapsed.
• When an artist deletes their account, workspace data is deleted within 30 days, except records we must keep (e.g. invoices, and signed waivers where the artist is legally required to retain them).
• Clients can ask their artist to correct or delete their record; the artist controls their client data, and we act on their instructions.

Your rights

Under PIPEDA and applicable provincial law, you may request access to, correction of, or deletion of your personal information. Artists should contact us directly; clients should contact their artist first, since the artist controls their records. Reach us at support@stencilbook.com.

Cookies

We use only the cookies needed to keep you signed in. No advertising or cross-site tracking cookies.

Changes

If we make material changes to this policy we'll email account holders before the changes take effect.