Privacy Policy

Devvle is a booking and website platform for tattoo studios (“studios” or “shops”). It is operated by Devvle Ltd, a company registered in England and Wales (company number 17114436), whose registered office is at 167-169 Great Portland Street, London, England, W1W 5PF. We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZC195012.

Contact for anything privacy-related: support@devvle.dev.

UK data protection law (the UK GDPR and the Data Protection Act 2018) distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles it on the controller’s behalf. Which one we are depends on whose data it is:

• We are the controller for studio and staff accounts (studio owners, admins, artists and front-of-house staff), for our own subscription billing of studios, for visitors to devvle.ink, and for anyone who contacts us directly.
• The studio is the controller, and we are its processor, for the personal data of a studio’s customers: bookings, contact details, consultation notes, reference images, messages and deposit records. We process that data only on the studio’s instructions to provide the service to them.

If you are a customer of a tattoo studio and have a question about how that studio uses your data (for example, how long it keeps your booking history or consent forms), please contact the studio directly. If you contact us instead, we will pass your request to the studio and help them respond.

Studio and staff accounts

• Name, email address, and profile details such as a photo, bio and role.
• Sign-in details: an account identifier and, depending on how you sign in, a password (stored only in hashed form by our authentication provider) or your Google account identifier, name, email and profile picture if you use Google sign-in.
• Studio information: studio name, address, opening hours, artist availability, services, prices, portfolio images and website content.
• Billing information: billing contact, subscription plan, invoices and payment status. Card details are collected and held by Stripe, not by us.
• If a studio receives payouts through us, the information Stripe requires to verify the business and pay it out. This is collected by Stripe directly.
• Support correspondence and any feedback you send us.

Customers of studios (processed on the studio’s behalf)

• Name, email address and phone number.
• Booking details: the artist, date and time, tattoo description, placement, size, reference images you upload, and any notes or messages exchanged with the studio.
• If you create a customer account: your sign-in details (as above) and booking history.
• Deposit and payment records, where the studio takes deposits online. Card details are entered into and held by Stripe; we only receive confirmation of the payment, the amount and limited card details such as the last four digits.
• Records of the reminders and notifications sent to you.

Visitors to devvle.ink

• If you use our contact form: your name, email address and the message you send.
• Only if you allow analytics cookies, usage information (see section 9): pages and sections viewed, buttons clicked, the referring campaign (UTM parameters), device type, browser language, time zone, and an approximate location (city, region and country) derived from your IP address.

Technical data

Like any web service, our servers and providers log technical information such as IP address, browser or device type, and timestamps, which we use to keep the service secure and working.

The Devvle Android app is currently for studio staff only (artists, front-of-house and studio admins) to view and manage their studio’s bookings. It collects and uses:

• Account identifiers: your sign-in account (email address or Google account) and user ID, so you can log in and we can show you the right studio.
• Booking data: the bookings, customer contact details, notes and images for your studio that you are permitted to see. This is the same data you can see in the web dashboard; the app displays it, it does not collect anything extra about customers.
• A push notification token: a device identifier issued by Firebase Cloud Messaging so we can send you notifications about new and changed bookings. It is removed when you sign out or delete your account.

The app contains no advertising and no tracking. It does not include third-party analytics or advertising SDKs, does not access your contacts, location, camera roll or microphone beyond anything you explicitly choose to upload, and does not sell or share your data for advertising. If you have opted in to sharing usage and diagnostics with Google on your device, Google Play may give us aggregated, non-identifying crash and performance statistics.

Data is encrypted in transit between the app and our servers.

• Providing the service (creating and running accounts, studio websites, bookings, the dashboard and the app; sending booking confirmations, reminders and notifications): performance of a contract with the studio or staff member, and for studio customers, on the studio’s instructions.
• Billing studios and paying out deposits: performance of a contract, and legal obligation for tax and accounting records.
• Customer support and service messages (for example, changes to these terms or security notices): performance of a contract and our legitimate interests in running the service.
• Security, fraud prevention and keeping the service working: legitimate interests, and legal obligation where applicable.
• Understanding how devvle.ink is used and improving it: your consent, which you give or refuse in our cookie banner.
• Replying to contact form enquiries: legitimate interests in responding to people who get in touch.
• Complying with the law and responding to lawful requests: legal obligation.

We do not sell personal data, and we do not use studio customers’ data for our own marketing.

We use a small number of trusted service providers (sub-processors) to run Devvle. They may only use personal data to provide their service to us:

• Google (Firebase): authentication (including Google sign-in and email/password), our database (Firestore), file storage for images and portfolios, push notifications (Firebase Cloud Messaging) for web and Android, and website analytics on devvle.ink.
• Stripe: subscription billing of studios, and customer card deposits, which Stripe Connect pays into the studio’s (or the artist’s) own Stripe account. Stripe handles card data directly and acts as an independent controller for some purposes, such as fraud prevention and its own legal obligations. See Stripe’s privacy policy.
• Twilio: sending SMS reminders and notifications to studio customers, where a studio uses SMS.
• Resend: sending transactional emails to staff and studio customers, and delivering contact form messages to us.
• ipapi.co: an IP geolocation service used by our website analytics to estimate a visitor’s city, region and country.
• Our hosting providers, who provide the servers our application runs on.

We also share data with the relevant studio (for its customers’ data), with professional advisers such as accountants and lawyers where needed, with a buyer or successor if our business is sold or restructured, and with authorities where the law requires it.

Some of our providers (including Google, Stripe, Twilio and Resend) may process personal data outside the UK, for example in the United States or the European Economic Area. Where they do, we rely on appropriate safeguards recognised under UK law, such as UK adequacy regulations (including the UK–US data bridge for certified companies) or the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information about these safeguards.

• Studio and staff accounts: for as long as the account is active, then deleted or anonymised within 90 days of the account being closed, unless we need to keep something longer for the reasons below.
• Studio customers’ data: for as long as the studio keeps it in its account, or as the studio instructs. When a studio closes its account we delete its customer data within 90 days, unless the law requires us to keep it.
• Billing and payment records: for up to 6 years after the end of the financial year they relate to, to meet UK tax and accounting obligations.
• Push notification tokens: until you sign out, uninstall the app, the token expires, or you delete your account.
• Contact form enquiries and support emails: for up to 2 years after our last contact, unless they lead to a customer relationship.
• Website analytics data: for up to 26 months.
• Backups and logs: deleted data can persist in backups and security logs for a short period (normally no more than 35 days) before being overwritten.

Our dashboard, studio booking pages and app use essential cookies and browser or device storage to keep you signed in, keep your session secure and remember what you are in the middle of. These are necessary for the service to work and don’t require consent.

On devvle.ink (our marketing website) we also use the following, but only if you click “Accept” in our cookie banner. If you reject them or don’t answer, none of them run:

• Google Analytics for Firebase, which sets cookies to measure visits and how the site is used.
• Our own analytics, which stores random identifiers in your browser’s local and session storage so we can tell visits and sessions apart, and records the events listed in section 3.
• The IP geolocation lookup described in section 6.

Some visitors arriving from our campaigns also get an experiment cookie (kept for up to 90 days) that remembers which version of our homepage they were shown, so it stays consistent. It holds only the version name, not anything that identifies you.

We remember your cookie choice in your browser’s storage so we don’t ask again on every visit. You can change your mind at any time using the “Cookie settings” link at the bottom of every page; if you withdraw consent we stop collecting and delete the analytics identifiers from your browser. You can also block or delete cookies in your browser settings, and the site will still work. We don’t use advertising cookies.

Under UK data protection law you have the right to:

• Access the personal data we hold about you and get a copy.
• Rectification: have inaccurate data corrected.
• Erasure: have your data deleted in certain circumstances.
• Restriction: ask us to limit how we use your data.
• Object to processing based on our legitimate interests.
• Portability: receive data you gave us in a commonly used, machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, where we rely on consent (for analytics cookies, use “Cookie settings” at the bottom of any page).

To exercise any of these, email support@devvle.dev. We may need to verify your identity, and we will respond within one month. To delete your account specifically, see our account deletion page. If your request concerns data a studio holds about you as its customer, we will refer it to that studio, as the controller, and support them in answering it.

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

We protect personal data with measures appropriate to the risk, including encryption in transit, access controls that limit staff to their own studio’s data, and the security features of our providers. No system is perfectly secure; if a breach affects your data, we will notify you and the ICO where the law requires it.

Devvle, including the Android app, is not directed at anyone under 18. In the UK it is illegal to tattoo anyone under 18, and studio and staff accounts are for adults only. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as Devvle changes. We will update the “Last updated” date at the top and, for significant changes, tell studios and staff by email or in the dashboard.