Skip to content
← NoirHQ

Privacy Policy

Last updated: October 2026

This policy was written by NoirHQ's founder to be accurate and complete, and has not yet been reviewed by a lawyer. It will be replaced with a counsel-reviewed version as the business grows. If anything here is unclear, email us — see section 11.

1. Who this policy covers

NoirHQ is booking and studio-management software for tattoo studios. This policy covers two kinds of people: Studios (the businesses and staff who sign up for and use NoirHQ), and Clients (the people who book appointments with a Studio through NoirHQ's booking pages). It applies wherever you're located, including the EU, UK, and elsewhere.

2. What data we collect

Studio account data: business name, owner/staff name, email, phone, and business details you provide when signing up.

Client data, entered by a Studio or by the client at booking: name, phone number, email, date of birth, and — specific to tattoo bookings — health disclosures relevant to getting tattooed safely (latex allergy, blood thinner use, skin conditions, pregnancy, other medical notes), plus a typed signature and timestamp confirming consent to the Studio's booking terms.

Booking & business data: appointment details, pricing, deposits, payment status, designs/reference images, and message history (SMS/email reminders and confirmations).

Usage data: standard technical data (IP address, browser type) collected automatically for security and fraud prevention — for example, rate-limiting booking submissions to prevent abuse.

3. Controller vs. processor — who's responsible for what

For Studio account data (the business and staff using NoirHQ), NoirHQ is the data controller — we decide how and why that data is processed, and we're directly responsible for it under GDPR.

For a Studio's Clients' data (the people who book tattoo appointments), the Studio is the data controller and NoirHQ is the data processor — we process that data only on the Studio's behalf, to provide the booking software. If you're a Client with a question about how a specific Studio is using your data, the Studio is who to ask first; if you can't reach them, contact us and we'll help (section 11).

4. Why we process this data (legal basis)

Contract performance — Studio account data and booking data are processed because processing them is necessary to provide the service you or the Studio signed up for (running the booking, sending confirmations, taking payment).

Explicit consent — health disclosures (allergy, medical, and pregnancy information) are only collected with the Client's explicit, separate consent, given at the point of booking, specifically for the purpose of the Studio and artist preparing for the appointment safely. This consent is distinct from agreeing to general booking terms.

Legitimate interest — technical/usage data is processed under legitimate interest, to keep the platform secure and prevent abuse (e.g. booking spam).

5. Where data is stored, and who processes it for us

We use a small number of specialist providers ("subprocessors") to run NoirHQ. As of this writing, our server infrastructure is US-based; we plan to add region-separated infrastructure for EU customers in the future. Until then, personal data from EU users is transferred to and processed in the US by the providers below, each under a GDPR-recognized transfer mechanism (Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as noted):

  • Supabase (database & authentication) — US. DPA with Standard Contractual Clauses.
  • Netlify (application hosting) — US. DPA with Standard Contractual Clauses.
  • Resend (transactional email, primary) — US. DPA with Standard Contractual Clauses.
  • Brevo (transactional email, fallback) — EU (France). EU-hosted; no SCC transfer needed for this provider.
  • Telnyx (SMS delivery) — DPA with Standard Contractual Clauses, available on request.
  • Dodo Payments (billing, acting as merchant of record) — maintains its own GDPR-compliant transfer mechanisms across its subprocessors.

We don't sell personal data, and we don't share it with anyone outside this list except where required by law.

6. How long we keep data

We keep Studio account data for as long as the Studio's account exists. If a Studio's subscription lapses, the dashboard locks but the data is kept so the Studio can come back; a Studio can delete everything at any time from Settings, or by emailing us.

We keep Client booking data (including health disclosures) for as long as the Studio keeps the Client's record — this supports the Studio's own legal, tax, and liability-waiver record-keeping obligations, which in most jurisdictions require keeping signed consent/waiver records for several years.

A Client (or the Studio on their behalf) can request deletion at any time — see section 7. Where a Client has booking history, we anonymize their personal details (name, phone, email, DOB, health data) rather than deleting the booking record outright, since Studios have their own legal obligation to retain financial and consent records independent of who the client was. Clients with no booking history are deleted outright.

Two kinds of short-lived data are deleted automatically: "can't decide?" artist requests, 90 days after they're created, and waitlist sign-ups, 12 months after their last activity. Studios decide how long to keep their own client and booking records, so we don't delete those automatically. When a Studio erases a Client or deletes its account, the uploaded files tied to that data, such as reference photos, are removed from storage as well as from the database.

7. Your rights, and how to use them

If you're in the EU, UK, or a similar jurisdiction, you have the right to:

  • Access a copy of the data we (or a Studio) hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format
  • Object to certain processing

If you're a Client of a Studio: ask the Studio directly — they can export or delete your record from their dashboard. If you can't reach the Studio, or you're a Studio owner with a question about your own account data, email us at the address in section 11 and we'll respond within one month, as required by GDPR.

8. Cookies & tracking

NoirHQ does not use analytics or advertising cookies. We use only what's strictly necessary to keep you logged in and the app functioning (session cookies via Supabase Auth), plus a first-party cookie that remembers your cookie choice. Our fonts are served from our own domain. Our marketing site includes one optional third-party item, an embedded Instagram video; it can set cookies and share your IP address with Instagram (Meta), so it loads only if you click Accept on the cookie banner. If you decline, it shows as a plain link instead. If we add analytics or marketing tools in the future, they'll load only after consent as well.

9. Marketing communications

Booking confirmations, deposit reminders, and appointment reminders sent by SMS or email are transactional — they're necessary to fulfill your booking and don't require separate opt-in. We don't currently send marketing messages to Clients. If a Studio wants to send marketing messages in the future, that will require its own explicit, separate opt-in from the Client — it can't be bundled with booking consent.

10. Children

NoirHQ's booking flow requires anyone booking a tattoo appointment to confirm they are 18 or older before submitting a booking. We don't knowingly collect data from anyone under 18.

11. Contact us

For any question about this policy, or to exercise your data rights, email noirhqstudios@gmail.com.

We're a small team — right now this inbox is read directly by the founder. We aim to respond within a few business days, and always within the one-month window GDPR requires for formal data requests.