Transparency
Privacy policy
Last updated: October 19, 2026
inkrise takes your privacy seriously. This policy describes what data we collect, how we use it and what your rights are as a data subject, in compliance with the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018).
1. Who is responsible for your data
The controller of your personal data is Inkrise. If you have questions or requests, contact us at suporte@inkrise.app.
2. What data we collect
We collect only the data necessary to provide the service:
- Registration data: name, email and password (stored with bcrypt hashing).
- Studio data: name, address, phone, Instagram and configuration information.
- Booking data: name, email and phone of clients provided by the studio.
- Payment data: the subscription is billed by Google Play; we do not receive or store card data.
- Usage data: access logs and browsing events to improve the service.
- Portfolio images: stored on Cloudinary when uploaded by the user.
- Profile photo (optional): customers in the Inkrise app and studio users in Inkrise Studio can take the photo with the camera or pick it from the gallery. The photo is stored on Cloudinary and can be changed or removed at any time.
- Reference images: customers can attach reference photos to a booking or project. They are shared with the studio you choose and stored on Cloudinary.
- Camera and gallery: the apps request camera permission only when you choose to take a photo (profile or reference). Otherwise they do not access the camera, and they do not record audio or video. From the gallery, only the photos you select are read.
3. What we use your data for
We use your data to:
- Create and manage your account and your studio's account.
- Process bookings and send confirmations by email.
- Issue and send digital quotes.
- Manage subscriptions made through the Inkrise Studio app on Google Play.
- Send transactional emails (confirmations, reminders, password reset) via Resend.
- Improve the platform based on aggregated, anonymous data.
- Comply with legal and regulatory obligations.
4. Legal basis for processing
We process your data based on the following grounds provided for in the LGPD:
- Performance of a contract: to provide the contracted service.
- Consent: for marketing communications, when applicable, and for Meta ad measurement in the apps.
- Legitimate interest: for security, fraud prevention and service improvement.
- Legal obligation: to comply with tax and regulatory requirements.
6. Ad measurement in the apps
The Inkrise apps may use the Meta (Facebook) SDK to measure ads, but only after you allow it through the "Meta ad measurement" option in the app. Without your permission, this SDK does not send data to Meta.
- What is shared with Meta Platforms, when you allow it: the device advertising ID (Google Advertising ID), app install and app open events, and events such as account created and appointment booked, without your name, email, phone or message content.
- Purpose: to measure and improve Inkrise's ads on Facebook and Instagram (attribution and optimization). We do not sell personal data.
- Legal basis: consent (LGPD, art. 7, I; and GDPR, art. 6(1)(a), for users in the European Union and the European Economic Area).
- How to withdraw consent: turn off "Meta ad measurement" in the app's Settings at any time. You can also reset or delete your advertising ID, or opt out of ads personalization, in your Android settings.
- Meta processes this data under its own policy (https://www.facebook.com/privacy/policy/), and international data transfer may occur.
7. App performance diagnostics
The apps use EAS Observe, from Expo (650 Industries), to collect performance metrics such as startup time, screen load times, device model, operating system version and network type. These metrics do not personally identify you and are used to improve app stability. Expo acts as a processor of this data.
8. How long we keep your data
We keep your data while your account is active. You can delete your account at any time, in the app or through the account deletion page, and the process follows these rules:
- 30-day period: when you request deletion, the account is deactivated, you are signed out of all devices and the studio is hidden from the public. During this time, you can restore the account by signing in to the app and confirming the restoration.
- Appointments: future appointments are cancelled immediately, and the customers or studios involved are notified by email and push notification. Restoring the account does not bring back cancelled appointments.
- Permanent deletion: after 30 days, your personal data is erased or anonymized, including name, email, phone, birth date, photos and images (deleted from storage), messages, consent forms, quotes, push tokens and personal data in logs.
- What is kept in anonymized form: reviews (rating and comment, with no author identity), past appointment records for the studio's bookkeeping (anonymized when the customer is the one deleting the account) and abuse reports, for moderation and safety.
- Subscription: deleting the account does not cancel a Google Play subscription. The studio owner must cancel it in Google Play.
- Records the law requires us to keep, such as tax obligations, are kept only for the period the law requires, up to 5 years.
- Technical access logs are kept for up to 6 months, in line with Brazil's Marco Civil da Internet (Law No. 12,965/2014).
9. Your rights as a data subject
Under the LGPD, you have the right to:
- Confirm whether we process your data and access it.
- Correct incomplete, inaccurate or outdated data.
- Request anonymization, blocking or deletion of unnecessary data.
- Data portability to another service provider.
- Withdraw consent at any time.
- Object to processing in case of non-compliance with the LGPD.
11. Security
We adopt technical and administrative measures to protect your data against unauthorized access and accidental or unlawful destruction, loss, alteration or improper disclosure, as required by Article 46 of the LGPD. The measures adopted include: encryption of data in transit and at rest, role-based access controls, secure credential storage, authentication with short-lived sessions and monitoring of suspicious activity. In the event of a security incident that poses a relevant risk or harm to data subjects, we will notify the ANPD (Brazil's national data protection authority) and those affected within the period set by applicable law.
12. Children and teenagers
inkrise is intended for people over 18. We do not knowingly collect data from minors. If we become aware of such collection, the data will be deleted immediately.
13. Changes to this policy
We may update this policy from time to time. When there are relevant changes, we will notify you by email or through a prominent notice on the platform. Continued use of the service after notification implies acceptance of the changes.
14. Contact and data protection officer (DPO)
To exercise your rights or ask questions about this policy, get in touch: