Privacy Policy

1. Who We Are

TheBooks ("TheBooks," "we," "us," or "our") is a software-as-a-service platform designed for tattoo and body art studios. Our registered contact is support@thebooks-app.com. Our platform is accessible at thebooks-app.com.

2. Information We Collect

Account & Studio Information

• Name, email address, and password (hashed) when you create an account
• Studio name, address, and business details
• Billing information processed by our payment provider (Stripe) — we do not store raw card numbers
• Profile photos or avatars you upload

Client Records (entered by studio staff)

• Client names, contact information, and date of birth
• Signed consent forms and health intake questionnaires
• Appointment history and session notes
• Aftercare and medical notes where applicable
• Guardian information for minor clients

Supply & Compliance Data

• Pigment, needle, and equipment lot numbers and expiry dates entered by artists
• Session lot-use records for regulatory compliance auditing

Usage & Technical Data

• Log data: IP address, browser type, pages visited, timestamps
• Device identifiers and session tokens
• Error reports and performance diagnostics

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve TheBooks platform
• Authenticate users and protect account security
• Process billing and send receipts through Stripe
• Store and retrieve client consent forms on behalf of studios
• Enable compliance record-keeping as required by applicable regulations
• Send transactional emails (appointment confirmations, password resets)
• Respond to support requests
• Detect, investigate, and prevent fraudulent or unauthorized activity

We do not sell your data or your clients' data to third parties. We do not use client health or consent data for advertising purposes.

4. Data Storage and Security

Client consent forms and sensitive records are stored in encrypted form using industry-standard encryption at rest and in transit (TLS 1.2+). Files are stored in secure cloud infrastructure with access logging.

We apply server-side encryption to all stored documents. Access to client data is restricted to authenticated studio staff with appropriate role permissions within your organization.

While we implement strong security measures, no system is 100% impenetrable. You are responsible for keeping your account credentials secure.

5. Data Retention

Studios can configure their own consent record retention period (between 1 and 99 years) in compliance with their local regulations. When a studio's account is terminated, we will retain consent records for the studio-configured retention period unless an earlier deletion is requested and legally permissible.

Account data (not client records) is deleted within 90 days of account termination upon request.

6. Sharing and Disclosure

We share information only in the following circumstances:

• Service providers: We use Stripe for payment processing, AWS for cloud storage, and MongoDB Atlas for database hosting. Each provider processes data only as needed to provide their service and under appropriate data processing agreements.
• Legal requirements: We may disclose information if required by law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or sale, user data may transfer to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.
• With your consent: We may share information in other ways if you give us explicit permission.

7. Cookies and Tracking

We use essential cookies and session tokens required for authentication and security. We do not use advertising cookies or cross-site tracking technologies. Our marketing website may use basic analytics to understand traffic volume (e.g., page views), but we do not build behavioral profiles.

8. Your Rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data (subject to legal retention obligations)
• Export your data in a portable format
• Object to or restrict certain types of processing

To exercise any of these rights, contact us at support@thebooks-app.com. We will respond within 30 days.

Note: Studios are the data controller for their clients' personal information. Client data access or deletion requests should be directed to the studio that collected that information.

9. Children's Privacy

TheBooks is a business tool intended for use by adult studio owners and staff. We do not knowingly collect personal information from individuals under 13. Studios using TheBooks to collect consent forms for minor clients (under 18) are responsible for ensuring they have appropriate guardian consent in place as required by local law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify active subscribers by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page will reflect the most recent revision.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

TheBooks
Email: support@thebooks-app.com
Website: thebooks-app.com