Privacy Policy

Etchpath ("Etchpath," "we," "us," or "our") operates the website etchpath.com and related applications (collectively, the "Service"). The Service is a business software platform for tattoo studios and their staff.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service as a shop owner or artist (a "User") or when someone submits information through a studio's public intake form embedded on a studio website (a "Submitting Party").

By creating an account, using the Service, or submitting an intake form, you acknowledge this Privacy Policy. If you do not agree, do not use the Service or submit an intake form.

Tattoo studios using Etchpath are independent businesses. For client and intake data that a studio collects through the Service, the studio is the data controller (the party that decides why and how that information is used for its business). Etchpath is a service provider / data processor that hosts and processes that information on the studio's behalf to operate the Service.

Questions about how a specific studio uses your personal information (booking, deposits, email replies, retention) should be directed to that studio. Etchpath processes data according to this Policy and our agreement with the studio.

Account and shop information (Users): name, email address, password (stored in hashed form), shop name, role (owner or artist), invite codes, theme preferences, and activity within the Service.

Client and business records (on behalf of studios): client names, contact details, tattoo project notes, deposit and checkout records, payment method labels (e.g. Venmo, cash — not payment card processing by Etchpath), pipeline status, session history, and internal activity logs.

Public intake submissions: name, email, phone (optional), message, placement/size, budget, timestamp, and technical metadata needed to operate the form (e.g. IP address for rate limiting and abuse prevention).

Email integration (optional, per User): if a User connects Gmail, we store OAuth tokens (encrypted), connected email address, granted scopes, and email content necessary to send/receive client communications and sync threads within the Service. We do not sell email content.

AI-assisted features (optional): if enabled, message drafts or extraction requests may be sent to third-party AI providers using content you provide in the Service. Do not submit sensitive information you do not want processed for this purpose.

Technical and usage data: session cookies, authentication tokens, server logs, device/browser type, and diagnostic information used for security, performance, and fraud prevention.

We use information to:

• Provide, maintain, and improve the Service;
• Authenticate Users and enforce account security;
• Store and display shop records (deposits, clients, intake, checkout, pipeline);
• Send transactional emails (e.g. intake notifications, password reset) via our email provider;
• Operate optional Gmail and AI features at a User's direction;
• Respond to support requests and legal obligations;
• Detect abuse, spam, and unauthorized access.

We do not sell personal information. We do not use client intake data for unrelated advertising profiles.

We may share information with:

• Service providers that help us operate the Service (e.g. cloud hosting, database, email delivery, authentication infrastructure), subject to confidentiality and security obligations;
• Google when a User connects Gmail, under Google's API Services User Data Policy;
• AI providers when AI features are used, limited to content submitted for that feature;
• The tattoo studio that owns the account — intake submissions and client records are visible to authorized shop staff;
• Legal and safety — when required by law, court order, or to protect rights, safety, and integrity of the Service.

If Etchpath is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction with notice where required by law.

Etchpath is not a payment processor. Studios record deposits and checkout amounts for their own books; money moves outside Etchpath (Venmo, Cash App, cash, card terminals, etc.). We do not store full payment card numbers for client transactions.

Subscription billing for the Service (if applicable) may be handled by a third-party payment processor; that processor's privacy policy governs payment data they collect.

We retain information for as long as a shop account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Shops may export certain data from the Service. When an account is terminated, we may delete or anonymize data after a reasonable period, except where retention is required by law or legitimate backup cycles.

Intake submissions remain in the studio's account until deleted or archived by authorized staff or account closure.

We use reasonable administrative, technical, and organizational measures designed to protect information (including encryption in transit, hashed passwords, and encrypted storage of sensitive tokens). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

You are responsible for safeguarding your login credentials and invite codes.

Users: you may update profile information in Settings, disconnect Gmail, and request account deletion by contacting us. Export tools may be available for shop data.

Submitting Parties: to access, correct, or delete intake information, contact the tattoo studio that received your submission. You may also contact us and we will forward or assist as appropriate.

Depending on your location, you may have additional rights (e.g. access, deletion, correction). We will respond to verifiable requests as required by applicable law.

We use essential cookies and similar technologies for authentication and session management. The Service is not designed for third-party advertising cookies. You can control cookies through browser settings; disabling essential cookies may prevent login.

The Service is not directed to children under 13 (or 16 where applicable). We do not knowingly collect personal information from children. Intake forms are intended for adults inquiring about tattoo services.

Etchpath is operated from the United States. If you access the Service from other regions, your information may be processed in the U.S. and other countries where our providers operate, which may have different data protection laws.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. Material changes may require renewed acceptance where legally required or at signup/intake. Continued use after changes constitutes acceptance where permitted by law.

Questions or requests: [email protected]