Privacy Policy
Last updated: 13 July 2026
1. Who is responsible
The controller of your personal data is [Company name] SIA, reg. no. [registration number], Latvia (“Inked”, “we”). Contact for all privacy matters: info@inked.lv.
2. What we process, why, and for how long
We only process data needed to run the platform. For each purpose, the table lists the legal basis under the GDPR and how long we keep the data.
| Purpose & data | Legal basis | Retention |
|---|---|---|
| Account & sign-in (name, email, photo, password hash, session) | Contract — Art. 6(1)(b) GDPR | Until you delete your account |
| Artist profile & portfolio (name, location, styles, bio, photos/videos) — public by design | Contract — Art. 6(1)(b) | Until removed by you or account deletion |
| Bookings (session details, times, notes) | Contract — Art. 6(1)(b) | While your account exists |
| Messages between clients and artists | Contract — Art. 6(1)(b) | While your account exists |
| Ratings (karma) — votes and comments after finished bookings, displayed anonymously | Legitimate interest — Art. 6(1)(f): trust & safety of the marketplace | Anonymized ratings are retained after account deletion (no longer linked to you) |
| Artist subscription billing (via Stripe — we never see card numbers) | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) for accounting records | Accounting records ~5 years (Latvian accounting law) |
| Transactional emails (booking updates, unread-message reminders) | Contract — Art. 6(1)(b) | Delivery logs up to 12 months |
| Usage analytics (Google Analytics) | Consent — Art. 6(1)(a); only if you accept, revocable any time | Up to 14 months |
| Security & abuse prevention (rate limiting, access logs) | Legitimate interest — Art. 6(1)(f): keeping the service secure | Up to 12 months |
Providing account data is necessary to use Inked — without it we cannot offer you the service. Analytics is entirely optional.
3. Who sees your data
Other users:artist profiles and portfolios are public. Client accounts are not public; artists you interact with see your name, messages, booking details and rating summary. Ratings you give are shown to the rated person's future counterparts without your name.
Processors working under our instructions (Art. 28 GDPR):
- Google Ireland Ltd. / Google LLC — Firebase — Hosting, database, authentication, file storage. Data at rest in the EU (europe-west4 / eur3 multi-region).
- Stripe Payments Europe Ltd. / Stripe Inc. — Artist subscription payments. Card data is handled entirely by Stripe.
- Zoho Corporation B.V. (EU datacentre) — Sending platform emails from info@inked.lv.
- Google — Analytics — Anonymous usage statistics — only with your cookie consent.
We do not sell personal data and do not share it with advertisers.
Messages are encrypted in transit (TLS) and at rest (AES-256 on Google Cloud infrastructure). They are not end-to-end encrypted: strictly limited platform access exists so we can act on abuse reports and comply with legal obligations.
4. International transfers
Your data is primarily stored in the EU. Where our processors transfer data to the United States (Google, Stripe), those transfers are safeguarded by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
5. Cookies
We use one essential cookie to keep you signed in, one to remember your cookie choice, and — only if you accept — Google Analytics cookies. No advertising cookies, ever. Change your choice any time via “Cookie settings” in the footer.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| __session | Keeps you signed in | Essential | 14 days |
| inked-consent | Remembers your cookie choice | Essential | 12 months |
| _ga, _ga_* | Anonymous usage statistics (Google Analytics) | Analytics — only with your consent | up to 13 months |
6. Your rights
Under the GDPR you can, at any time and free of charge:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17) — deleting your account removes your profile, messages and personal data; anonymized ratings and legally required accounting records may be retained;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent (e.g. analytics) without affecting past processing (Art. 7(3)).
To exercise any right, email info@inked.lv from your account address. We respond within one month.
You also have the right to lodge a complaint with the Latvian supervisory authority: Datu valsts inspekcija (Data State Inspectorate), dvi.gov.lv, or with the authority of your EU country of residence.
7. No profiling, no kids
We do not use automated decision-making or profiling that produces legal or similarly significant effects. Inked is intended for persons aged 18 or older.
8. Changes
If we materially change this policy, we will notify you by email or a notice on the site before the change takes effect. The date above always shows the current version.