← CloseFlow Ink

Privacy Policy

Effective May 27, 2026

CloseFlow Ink (“CloseFlow,” “we,” “our”) provides a CRM and operations platform for tattoo studios. This Privacy Policy explains what information we collect from studio operators (our “Customers”) and from the clients they communicate with through the platform (“End Users”), how we use it, and the choices available to each group.

1. Who is the data controller

For account data of studio operators, CloseFlow is the data controller. For messages, contact details, and content that flows through a studio’s inbox and pipeline (the “Studio Data”), the studio is the data controller and CloseFlow acts as a data processor on its behalf under our Customer Agreement.

2. Information we collect

From studio operators

  • Account info: name, email, phone, timezone, language, MFA configuration.
  • Studio info: business name, address, branding, working hours, staff roster.
  • Payment info: handled by Stripe; we receive only metadata (last 4 of card, status).
  • Authentication metadata: IP, browser, device fingerprint for session security and audit logs.

From connected channels (Instagram, Facebook, Email, WhatsApp)

  • Channel identity: page ID, account username, OAuth tokens (encrypted at rest).
  • Conversations and messages exchanged through the connected channel, including text and attachments shared by End Users.
  • Profile metadata exposed by the channel (display name, profile picture URL).

From End Users (clients of the studio)

  • Contact details collected by the studio (name, email, phone, social handles).
  • Booking details: requested date, service, deposit, consent form responses.
  • Health-disclosure items required by the studio for the tattoo session.

Automatically

  • Usage logs (pages visited inside the app, API calls, errors).
  • A first-party session cookie required to keep you signed in. We do not use third-party advertising cookies.

3. How we use information

  • Operate the platform: route messages to the right inbox, schedule appointments, process deposits, send confirmations.
  • Authenticate users and prevent abuse.
  • Provide customer support and respond to inquiries.
  • Improve product quality (aggregated, de-identified analytics only).
  • Comply with legal obligations (tax, anti-fraud, lawful requests).

We do not sell personal information. We do not use End User data to train third-party models or for cross-customer profiling.

4. Sub-processors we rely on

  • Neon — PostgreSQL hosting (US-East).
  • Fly.io — application and worker hosting.
  • Cloudflare — CDN, DNS, R2 object storage for uploaded images, Email Routing.
  • Stripe — payment processing and Connect onboarding.
  • Resend — outbound and inbound transactional email.
  • Meta Platforms — Instagram Graph API and Messenger Platform when a channel is connected.

5. Data retention

Studio Data is retained for as long as the studio’s account is active. On account closure we delete or anonymize Studio Data within 60 days, except records we must keep for legal or tax reasons. Studio operators can also request earlier deletion of any individual contact or conversation.

6. International transfers

Our primary infrastructure is in the United States. If you access the platform from outside the United States your information will be transferred to and processed in the United States under appropriate safeguards.

7. Your choices and rights

  • Access & correction — studio operators can update most account data from the app.
  • Deletion — write to privacy@closeflowink.com to request deletion of your account or specific records.
  • Disconnect channels — disconnecting Instagram, Facebook, Email, or WhatsApp from Settings revokes our access to that channel.
  • End User rights — End Users should contact the studio directly. If the studio is unresponsive we will assist within 30 days.
  • Marketing emails — every operational email contains an unsubscribe link except security-critical notices.

8. Children

The platform is not directed to children under 18. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

9. Changes to this policy

We will post any material change to this page and update the “Effective” date above. If the change is significant we will also notify account owners by email at least 14 days before it takes effect.

10. Contact us

CloseFlow Ink
privacy@closeflowink.com