Privacy Policy

This Policy applies to personal data processed in connection with the Services, including data relating to account holders, workspace members, studio administrators, artists, operators, support contacts, website visitors, and end customers whose data is entered into or made available through the Services.

This Policy does not apply to third-party websites, services, payment environments, connected tools, or platforms that are not operated by InkLinka, even if they are linked to, embedded in, or integrated with the Services.

For platform registration, account administration, subscription management, security, authentication, platform operations, support, service communications, and internal business administration, InkLinka generally acts as an independent controller or equivalent business operator for the data necessary to provide and protect the Services.

For customer records, appointments, bookings, consent forms, uploaded files, notes, communications, payment-related metadata, artist workflows, and other content submitted to the Services by a studio, business, tenant, or workspace user, InkLinka generally acts only as a processor, service provider, or infrastructure provider acting on behalf of the relevant customer organization.

The relevant customer organization, not InkLinka, is generally responsible for:

• determining whether personal data should be collected or uploaded;
• providing notices to customers, staff, artists, and end users;
• obtaining and maintaining any required consents, permissions, releases, or authorizations;
• determining the lawful basis for processing;
• responding to most data subject or consumer rights requests concerning workspace-controlled data;
• ensuring that uploaded data is lawful, accurate, appropriate, and permitted.

InkLinka does not independently verify that customer organizations have obtained valid notices, permissions, parental permissions, releases, or other legal authorizations for the data they choose to process through the Services.

We may collect the following categories of data:

Account and identity data, such as name, email address, phone number, login credentials, profile details, workspace membership information, authentication records, and account preferences.

Business and workspace data, such as studio name, business details, services, schedules, appointments, customer profiles, artist assignments, notes, forms, uploaded files, invoices, payout settings, payment-related records, and operational settings.

Technical and usage data, such as IP address, browser type, device information, operating system, session identifiers, cookies, log data, security events, audit trails, access history, diagnostic records, and product usage information.

Communications data, such as support requests, feedback, email communications, in-product messages, assistant interactions, and notification responses.

Integration and transaction data, such as connected account identifiers, webhook events, billing references, subscription status, payment processor references, and related operational metadata.

We may use personal data to:

• provide, host, maintain, and administer the Services;
• authenticate users and manage accounts;
• process subscriptions, billing events, invoices, and service-related transactions;
• support workspace operations and customer-requested functionality;
• secure the Services, detect misuse, prevent fraud, and investigate incidents;
• maintain logs, records, audit trails, and backup systems;
• communicate with users regarding service, security, support, billing, legal, and administrative matters;
• improve product performance, reliability, safety, and internal operations;
• enforce our agreements, policies, and legal rights;
• comply with legal obligations and lawful requests.

Where permitted by law, InkLinka may also use de-identified, aggregated, or non-personal information for analytics, benchmarking, operational improvement, product development, security analysis, and business reporting.

Where applicable law requires a legal basis, InkLinka may process personal data on one or more of the following grounds:

• performance of a contract or steps taken at the request of the data subject;
• legitimate interests, including platform administration, support, fraud prevention, abuse detection, product security, service reliability, and business operations;
• compliance with legal obligations;
• consent, where consent is required or relied upon;
• another lawful basis available under applicable law.

Where InkLinka processes workspace-controlled data solely on behalf of a customer organization, the customer organization is generally responsible for identifying and documenting the appropriate lawful basis for that processing.

We may share personal data with:

• affiliates and service providers that support hosting, infrastructure, authentication, storage, analytics, customer support, email delivery, messaging, billing, security, and operations;
• payment processors, communications providers, and integration partners where necessary to provide the Services;
• professional advisers, auditors, insurers, and legal counsel where reasonably necessary;
• competent authorities, regulators, courts, law enforcement, or other third parties where required by law or where reasonably necessary to protect rights, investigate misconduct, or enforce our agreements;
• acquirers, investors, counterparties, or related participants in connection with a merger, financing, acquisition, reorganization, insolvency event, sale of assets, or similar transaction, subject where appropriate to confidentiality protections.

InkLinka does not sell personal data in exchange for money. However, disclosures to vendors, processors, integrations, or service providers may occur as part of providing the Services.

Depending on the Services and notification settings used, providers that may process personal data on InkLinka’s behalf include Hetzner Online GmbH for production server and network hosting; Supabase Pte. Ltd for managed database, authentication, and storage infrastructure; and 650 Industries, Inc. (Expo) for mobile push-notification delivery. Apple Inc. and Google LLC may process notification data as downstream push-delivery providers for compatible devices. These providers may use their own subprocessors under applicable contractual and data-protection terms.

InkLinka limits disclosures to service providers to data reasonably necessary to provide, secure, maintain, monitor, or support the relevant Service. A current description of providers relevant to a particular integration may be requested using the contact details below.

Personal data may be processed in countries other than the country in which it was collected. Where required by applicable law, InkLinka uses transfer mechanisms and safeguards intended to support lawful international transfers, which may include contractual protections, organizational measures, and technical safeguards.

Customer organizations remain responsible for assessing whether their own use of the Services, integrations, and uploaded data is appropriate for their legal and regulatory environment.

InkLinka retains personal data for as long as reasonably necessary for the purposes described in this Policy, including to:

• provide and maintain the Services;
• preserve security, logs, and system integrity;
• comply with legal, accounting, tax, and regulatory obligations;
• resolve disputes and investigate incidents;
• enforce agreements and protect legal interests;
• maintain backups, continuity measures, and business records.

Retention periods vary depending on the type of data, the customer configuration, legal requirements, security needs, and operational context.

InkLinka may delete, anonymize, aggregate, or restrict access to data at different times and in different ways based on system design, storage architecture, service settings, contractual terms, and legal requirements. InkLinka is not obliged to retain data for the benefit of any user or customer except to the extent required by applicable law or an express written agreement.

InkLinka uses administrative, technical, and organizational measures intended to protect personal data and reduce the risk of unauthorized access, disclosure, misuse, alteration, and destruction.

However, no platform, infrastructure, transmission method, storage environment, integration, or security program can guarantee absolute security, uninterrupted availability, complete resilience, or prevention of all incidents. Use of the Services involves inherent technical and operational risk.

Except to the extent required by non-waivable law, InkLinka does not warrant that the Services will be error-free, immune from attack, continuously available, or suitable for storing any category of sensitive, regulated, mission-critical, or irreplaceable data.

Unless InkLinka expressly agrees otherwise in a separate written contract, the Services are not represented as a regulated medical records platform, emergency platform, insurance records platform, official government filing repository, or HIPAA-compliant environment.

Users and customer organizations are solely responsible for deciding whether to upload, collect, store, transmit, or process health-related, consent-related, biometric, identification, tax, employment, payment, regulatory, or other sensitive or regulated data through the Services.

InkLinka may, but is not required to, restrict, suspend, remove, quarantine, or refuse categories of data, content, files, or workflows that we believe create excessive legal, security, operational, or compliance risk.

InkLinka may use cookies, local storage, pixels, SDKs, tokens, and similar technologies to operate the Services, maintain sessions, secure accounts, remember preferences, measure product usage, detect fraud, support communications, and improve performance.

Some technologies are necessary for the Services to function. Others may depend on your configuration, browser settings, deployment environment, or enabled integrations.

Disabling certain cookies or storage technologies may impair functionality, reduce security, or prevent parts of the Services from operating properly.

Depending on the jurisdiction, individuals may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or other protections relating to personal data.

Where InkLinka processes data on behalf of a customer organization, requests relating to workspace-controlled customer data should generally be directed to the relevant studio, business, or workspace that controls that data.

InkLinka may forward requests to the relevant customer organization, require verification, decline requests not legally required, limit requests that are excessive or abusive, and retain information where permitted or required by law, contract, security needs, fraud prevention, or dispute resolution.

The Services are not directed to children and are not intended for use by persons who are not legally permitted to create accounts or provide data under applicable law.

Customer organizations and users are solely responsible for ensuring that any information relating to minors is collected, uploaded, stored, and processed lawfully, including where parental notice, authorization, or additional protections are required.

The Services may interoperate with or rely on third-party services, plugins, payment processors, communication tools, AI features, hosting providers, analytics providers, storage environments, or connected applications.

InkLinka is not responsible for the privacy, security, legality, availability, or acts and omissions of third-party services that are not under InkLinka’s direct control. Use of third-party services may be subject to separate terms, privacy notices, and data handling practices.

If a customer organization chooses to connect its WhatsApp Business Account to InkLinka, InkLinka processes WhatsApp Business Platform data only to provide, secure, maintain, and support the integration requested by that organization. Depending on use, this data may include Meta business and WhatsApp Business Account identifiers, phone-number identifiers, display names and numbers, business profile metadata, encrypted access credentials and registration PINs, webhook events, customer names and phone numbers, message content, media and attachments, timestamps, delivery or read status, failure information, and related diagnostic or security records.

InkLinka uses this data to complete account onboarding, verify and register selected phone numbers, subscribe connected accounts to webhooks, synchronize inbound conversations, display messages and media in the workspace inbox, send replies initiated by authorized workspace users, report delivery status, prevent duplicate processing, troubleshoot failures, protect the Services, and comply with applicable obligations. Data is disclosed to Meta and WhatsApp, and to hosting, database, storage, security, and infrastructure providers acting for InkLinka, only where reasonably necessary to provide or protect these functions. Meta and WhatsApp operate their own services under their own terms and privacy notices.

The customer organization generally controls the purpose and content of its customer communications and is responsible for providing required notices, obtaining any required consent or other lawful basis, honoring opt-out and deletion rights, using approved message templates where required, and complying with applicable law and WhatsApp policies. InkLinka does not independently verify the customer organization’s authority to contact each recipient.

WhatsApp access tokens and registration or two-step-verification PINs stored by InkLinka are encrypted at rest. InkLinka applies technical and organizational safeguards intended to limit unauthorized access and tenant data mixing, but no integration or transmission method can be guaranteed to be completely secure or continuously available. InkLinka does not sell WhatsApp message content.

Disconnecting WhatsApp from InkLinka removes active credentials from the connection record and, where applicable, attempts to unsubscribe the app from the connected WhatsApp Business Account. Disconnecting does not automatically erase messages, media, audit records, or customer records previously synchronized into the workspace. Those records remain subject to the customer organization’s settings, InkLinka’s retention rules, legal and security requirements, and valid deletion requests. Account and personal-data deletion requests may be submitted through the methods described on the Account Deletion page.

If a user or customer organization chooses to connect a Google account to InkLinka, InkLinka may access Google user data strictly to provide the email features requested by that user inside the InkLinka interface.

For connected Gmail accounts, InkLinka may access the Gmail address associated with the mailbox, message metadata, message headers, thread identifiers, message bodies, and attachments, and may send outbound emails or replies from the connected mailbox when initiated by the authorized user through InkLinka.

InkLinka uses this data to authenticate the mailbox connection, sync inbound emails into the workspace inbox, display messages and attachments in the application, match messages to conversation threads, send replies and connection test messages, maintain sync state, and secure or troubleshoot the integration.

OAuth access tokens, refresh tokens, and related credentials for connected Google accounts are stored in encrypted form. Synced email content and related metadata may be stored in InkLinka systems so the customer organization can access the email workflow inside the product. Attachments may also be stored in secure cloud storage used by InkLinka when required to support the feature.

InkLinka does not sell Google user data, does not use Google user data for advertising, and does not use data obtained from Google Workspace APIs to train generalized artificial intelligence or machine learning models. Google user data is shared only as necessary to operate the requested feature, for security purposes, to comply with law, or with service providers acting on InkLinka’s behalf under appropriate obligations.

Users can disconnect or delete a connected Google account from InkLinka. When a Gmail connection is disconnected or deleted, InkLinka attempts to revoke the stored Google refresh token and removes stored OAuth credentials from the active connection record. Previously synced workspace records may remain until deleted by the customer organization, by InkLinka under applicable retention rules, or upon a valid deletion request where required by law or contract.

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If a customer organization chooses to connect an Instagram professional account to InkLinka, InkLinka requests the instagram_business_basic and instagram_business_manage_messages permissions and processes Meta Platform Data only to provide, secure, maintain, and support the Instagram messaging integration requested by that organization.

Depending on use, Instagram and Meta Platform Data processed by InkLinka may include the connected professional account ID and username; Instagram-scoped sender or recipient identifiers; sender name and username; access tokens and granted permission information; webhook events; message text; attachment types, identifiers, metadata, and URLs; timestamps; delivery or processing status; conversation and message identifiers; and related diagnostic, security, and audit records.

InkLinka uses instagram_business_basic to connect the professional account, confirm the connected account ID and username, display the connected account inside InkLinka, associate messages with the correct account, and support the instagram_business_manage_messages permission. InkLinka uses instagram_business_manage_messages to receive message webhook events, synchronize inbound conversations into the workspace inbox, identify or match a customer by Instagram username, display the sender username and channel, notify authorized workspace users of new messages, and send replies initiated by those users through the InkLinka inbox.

InkLinka does not use Instagram or Meta Platform Data for behavioral advertising, does not sell Instagram message content or account data, and does not use such data to train generalized artificial intelligence or machine-learning models. InkLinka does not request or use Instagram permissions for unrelated purposes.

Instagram and Meta Platform Data is disclosed to Meta and Instagram as required to operate the integration and may be processed by the hosting, database, infrastructure, and push-notification providers identified in Section 6. Push notifications may include the Instagram sender name or username and a limited message preview when an authorized InkLinka user has enabled notifications.

Instagram access tokens stored by InkLinka are encrypted at rest. InkLinka applies role-based access controls, tenant separation, request verification, duplicate-event protection, and other technical and organizational safeguards intended to limit unauthorized access, disclosure, or mixing of customer data.

The customer organization generally determines the purpose and content of its Instagram communications and is responsible for providing required notices, establishing an appropriate lawful basis, responding to applicable data-subject requests, and complying with applicable law and Meta and Instagram terms. Authorized workspace users can access synchronized Instagram conversations only within the relevant customer workspace.

Disconnecting Instagram removes the active credentials from the connection record and, where applicable, attempts to unsubscribe the connected account from webhook delivery. Disconnecting does not automatically erase messages, conversation records, customer records, notification records, audit records, or attachment metadata previously synchronized into the workspace. Those records remain subject to the customer organization’s settings, InkLinka’s retention rules, legal and security requirements, and valid deletion requests. Account and personal-data deletion requests may be submitted through the methods described on the Account Deletion page.

InkLinka reviews government, law-enforcement, regulatory, and other legally binding requests for personal data before making a disclosure. The review may include verification of the requesting authority, jurisdiction, legal basis, scope, validity, and whether the request is binding on InkLinka.

Where legally permitted and reasonably appropriate, InkLinka may reject, seek clarification of, narrow, or challenge a request that appears unlawful, invalid, disproportionate, or broader than necessary. When disclosure is legally required, InkLinka seeks to disclose only the minimum amount of information reasonably necessary to comply with the valid request.

InkLinka maintains records of requests and responses as reasonably appropriate, including the requesting authority, legal basis, scope, decision, categories of data disclosed, and affected accounts or persons where identifiable. InkLinka may notify the affected customer organization or individual before or after disclosure unless notification is prohibited by law, a binding order, or a legitimate need to protect an investigation, rights, or safety.

InkLinka may update this Privacy Policy at any time. Updated versions become effective when posted, unless a later effective date is stated.

To the maximum extent permitted by law, continued access to or use of the Services after the effective date of an updated version constitutes acknowledgment of the revised Policy.

Service operator and controller for platform-level processing: Inklinka Technologies OÜ.

Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Tuukri tn 19-202, 10120, Estonia

Support email: main@inklinka.com