Last updated: October 21, 2026
​

The purpose of this Policy is to set out the rules governing how INKJIN IKE, a company with the corporate name "INKJIN PRIVATE COMPANY," headquartered at 332 Kifisias Avenue, Chalandri, 15233, Attica, with Tax ID 803292939, Tax Office KEFODE Attikis, and General Commercial Registry No. 193959701000 (hereinafter the "Company"), collects, processes, and protects personal data through its website Inkjin.com (hereinafter "our Website"), its mobile application Inkjin ("Application" or "Inkjin"), Bookpay (bookpay.inkjin.com), the Guest Spot Board (inkjin.com/en/bookpay/guest-spot-board), and Omi (omi.inkjin.com), its AI tattoo assistant ("Omi"). This Policy sets out why the Company holds this data, the type of data it processes, how long it stores the data, and the appropriate technical and organizational protective measures it adopts.

The Company complies with Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as applicable Greek legislation.

The Company reserves the right to update, amend, or revise the services offered and this Policy whenever it deems necessary, without prior notice, in accordance with applicable data protection legislation. For this reason, the Company encourages anyone interested to check this Policy periodically for any changes.

The Company, as identified above, is the Data Controller for the collection and processing of your data through the Application, the Guest Spot Board and Omi. This means the Company determines the purposes and means of processing your personal data, as described below. This includes the artist profiles the Company adds to Omi from public Instagram accounts (see “Artist profiles on Omi from Instagram” below).

In the context of your direct communication with Artists — including when this takes place through messages exchanged via the Application — the Data Controller of your personal data is the relevant Artist (see the "Communication/Booking Appointments with Artists" section below).

The same applies when an Artist uses Omi to answer their Instagram direct messages: the Artist is the Data Controller of the messages you send them, and the Company processes them on the Artist's behalf.

Personal data processed by the Company is collected directly from data subjects, through their entry of data into the Application or Omi, their sending of data to the Company by other means, or through information provided by the data subjects' own equipment. The Company collects personal data from third-party sources only in two cases:

The Company, as data controller, is committed to complying with all its obligations under the GDPR, specifically:

The personal data collected depends on the category of data subject:

A) Visitors to our Website (internet users who simply visit our Website without registering as Users or Artists): no personal data is required.

B) Users of the Application: upon registration, an email address must be provided. Optionally, users may also provide their full name, communication language, area of residence, whether they have other tattoos, and gender. The Application also processes the registration date and the frequency and dates of the User's visits to the Application, as well as the User's preferences regarding designs and Artists.

If a User makes use of Augmented Reality (AR) technology, the Application additionally processes AR data via access to the device's camera (solely for displaying the tattoo on the User's body), and, if the User chooses, captures and stores the photo in the User's profile. Image capture occurs only through an explicit action by the User — the Application does not store images or videos without the user's action.

If a User makes use of the AI Tattoo Price Estimator, the Application additionally processes information regarding the design selected, the placement location, and the estimated cost.

C) Users who communicate with Artists and book appointments with them: the Company additionally processes, in its capacity as processor on behalf of the Artist — Data Controller: the full name of the Artist selected by the User, the content of their communication, the service the User is requesting from the Artist, appointment details, any modification or cancellation, and payment details.

Where an Artist uses the Application's Consent Form feature, the Company also processes, as processor on behalf of the Artist, the User's responses to the Artist's health screening questions, the User's typed signature name, and the date, time, and IP address at which the form was signed.

D) Artists on our Website: registration requires full name, email address, country of residence, mobile phone number, username, and optionally their website and social media profiles (Instagram, TikTok, YouTube).

The Company also processes, for each Artist: professional profile details, professional experience, the tattoo studio they work with, their existing portfolio of designs, their specialization style, the dimensions offered for each design, estimated time and price per design, registration date, frequency and dates of visits to the Application, the content of their communications, the Users who book appointments with them, appointment/modification/cancellation details, and payment details.

Where an Artist uses Omi, the Company also processes the information they set in Train Omi (such as prices, rules, styles, studios and availability), their consent to Omi answering their Instagram direct messages, and any reports they make about requests they consider not genuine.

E) Users of Omi: email address and name, the conversations they have with Omi, pictures they upload, the notes Omi keeps to remember their preferences (if they keep Memory on), saved ideas and boards, and requests they send to Artists. Pictures uploaded to Omi are stored privately: they are not publicly accessible and are shown only to the User and to authorized Company personnel. The Company also keeps the number of messages each User sends per day (to apply the daily message limit) and, where a User tells Omi they are under 18, a record of this (see "Minors" below). Where a User uses voice input, their voice recording is processed to turn it into text (see "Voice input" below). Where a User asks Omi to tell them when an artist joins their city, the Company keeps that city and country (see "Artist in your city" below).

F) People who message an Artist on Instagram, where the Artist uses Omi to answer: their Instagram username and name, their messages, pictures they send, and the request Omi collects (idea, placement, size, color, timing, budget). The Company processes this data as processor on behalf of the Artist.

G) Tattoo artists added to Omi from Instagram (who may not have signed up to Inkjin or Omi): their public Instagram professional profile and latest public posts, and the details read from their bio (see "Artist profiles on Omi from Instagram" below).

H) People who post on the Guest Spot Board: email address (never shown on the board), name or studio name, Instagram username, city and country, dates, styles, deal details, photos, profile picture and note. Optionally, whether an artist wants to be matched only with LGBTQ+ friendly studios, and whether they want to receive emails about the Guest Spot Board and Bookpay (see “Guest Spot Board” below).

Where an Artist connects their Google Calendar to Inkjin, the Company processes calendar data as follows:
​

Where an Artist chooses to connect their Instagram Business or Creator account to Bookpay, the Company processes Instagram data as follows:
​

Artists and studios can post on the Guest Spot Board without a Bookpay account. Their post is shown publicly, except their email address, which is used only to confirm the post, to sign in to “My posts”, and to send match emails, which they can stop at any time. The Company’s team reviews each post before it goes live.

Studios can mark themselves as LGBTQ+ friendly; this is shown on their post.
​

Artists can choose to be matched only with LGBTQ+ friendly studios. This choice is optional, is stored privately with their post, and is used only to choose which studios they are emailed about. It is never shown publicly or shared with studios. They can turn it off at any time in “My posts”, and it is deleted when they delete their post.

Where someone connects Instagram to their post, the Company uses it once to verify the account and let them pick photos; the access token is not kept.
​

When a post goes live, the Company keeps the poster's name, Instagram username, whether they are an artist or a studio, their city, and (for studios) whether they marked themselves LGBTQ+ friendly, so it can contact them again about the Guest Spot Board and Bookpay through Instagram. This is kept after the post is deleted. It never includes their email address or an artist's choice to be matched only with LGBTQ+ friendly studios. Anyone can ask to be removed at [email protected]; they are then removed and not added again.
​

Posters can tick “Keep me in touch” to receive emails about the Guest Spot Board and Bookpay. Their email address is then kept, also after their post is deleted, until they stop these emails with the link in each email, untick the box in “My posts”, or write to [email protected].
​

Where an Artist connects their Instagram professional account to Omi and switches on "Let Omi reply to your DMs", the Company processes Instagram data as follows:
​

To help Users find tattoo artists, the Company adds tattoo artists to Omi from their public Instagram professional (Business or Creator) accounts, including artists who have not signed up to Inkjin or Omi. The Company processes this data as follows:

Where a User taps the microphone in Omi, their recording is sent to OpenAI to be turned into text, which appears in the message box for the User to check before sending. The recording is not stored by the Company; only the text the User sends is kept, like any other message. OpenAI does not use the recording to train its models.

Where Omi has no artist in a User's city, it offers to tell them when one joins. If the User says yes, the Company keeps the city and country they asked about, and sends them one email once an artist there is on Omi. The Company's team sees only how many people wait in each city, not who they are, and uses this to decide where to add artists next. The legal basis is the User's request (Article 6(1)(b) GDPR).
​

To improve Omi, the Company reviews a selection of conversations with Omi once a week, using automated analysis (Anthropic) and its own team. Before a conversation is reviewed, personal details such as names, email addresses and phone numbers are removed. The review looks at how Omi helped (for example, whether a search found nothing, or whether a reply was rated with a thumbs down) and may lead to changes in Omi's instructions, which the Company's team approves. The following are never reviewed: incognito chats (which are never stored), conversations in which a User shared a sensitive moment (for example, self-harm, or being at risk), and conversations with Users who told Omi they are under 18. Conversations are not used to train artificial intelligence models.
​

To protect Users and Artists from spam, jokes and abuse, the Company:

Decisions are always taken by the Company's team, not by automated means alone. The person concerned is not notified of reports or of being placed on the review list. The legal basis for this processing is the Company's legitimate interest in keeping the service safe (Article 6(1)(f) GDPR).

Omi does not ask for health data or other special categories of personal data. However, a User may choose to share such information in a conversation with Omi (for example, about scars, a health condition, or a difficult experience). Omi uses it only to answer that User. Such conversations are kept private, are never included in the reviews described in “Improving Omi”, and are not shared with anyone, except with an Artist where the User chooses to include that information in a request. If a User appears to be at risk, Omi gives them contact details for crisis support lines; no one is alerted.
​

Requests to Artists through Omi are available only to Users aged 18 or over. Omi does not ask Users their age. Where a User tells Omi they are under 18, the Company records this solely to stop Omi from showing them Artists or passing their requests to Artists; the User can still use Omi to explore tattoo ideas. The Company's team can remove this record if it was made in error. Conversations with such Users are never included in the reviews described in "Improving Omi".
​

Where a public authority, law enforcement agency, or other government body requests personal data processed by the Company, the Company follows the process below before disclosing any data:
​

1. Legal review. Every request is reviewed to confirm it is legally valid — issued by a competent authority, properly formatted (e.g. a valid court order, warrant, or statutory request), and grounded in an applicable legal basis. Requests that do not meet these requirements are not honored.
​

2. Right to challenge. Where the Company considers a request unlawful, disproportionate, or beyond the requesting authority's jurisdiction, it reserves the right to challenge or seek clarification of the request, including by consulting external legal counsel, before any data is disclosed.
​

3. Data minimization. The Company discloses only the specific data necessary to satisfy a valid request, and does not provide broader access to its systems or additional user data beyond what is explicitly requested and legally required.
​

4. Documentation. The Company keeps a record of requests received from public authorities, including the nature of the request, the legal basis cited, the data (if any) disclosed in response, and the personnel involved in the review.
​

The Company processes personal data only for purposes that are explicit, clear, lawful, and specified at the time of collection, including for:
​

The general legal bases relied upon by the Company are: a) performance of a contract (Article 6(1)(b) GDPR), b) compliance with a legal obligation (Article 6(1)(c) GDPR), c) consent of the data subject (Article 6(1)(a) GDPR), d) the legitimate interest of the Company or a third party, unless overridden by the interests or fundamental rights of the data subject (Article 6(1)(f) GDPR), and e) the explicit consent of the data subject, for the optional choice described in “Guest Spot Board” (Article 9(2)(a) GDPR).
​

For clarity, the Company itself does not, through its services, ask for health data or other special categories of personal data (see “Sensitive information shared in conversations” above for information Users choose to share with Omi), other than the optional choice described in “Guest Spot Board” above. Where an Artist requests that Users communicating with them share health data or other special category data, the Artist alone is the data controller for such data.
​

Where an Artist uses the Application’s Consent Form feature, the Company also processes, as processor on behalf of the Artist, the User’s responses to the Artist’s health screening questions, the User’s typed signature name, and the date, time, and IP address at which the form was signed.

When you communicate with Artists, or book, modify, or cancel appointments with them — whether outside the Application or through it, including through Omi in the Artist's Instagram direct messages — the Data Controller is the relevant Artist, who determines both the purposes and the means of processing your personal data. In this context, when the Company processes your personal data through the Application or Omi, it acts as processor on behalf of the Artist communicating with you.
​

The Company does not sell the personal data of Visitors, Users, or Artists. However, this data may be processed by third-party sub-processors (or processors) on the Company’s behalf, solely for the purposes set out in this Policy. Such third parties provide sufficient assurances of implementing appropriate technical and organizational measures. Third parties who may process data from the Website, Application, Guest Spot Board or Omi include:

Some of these third parties are located outside the European Economic Area (EEA), for example in the United States. Where personal data is transferred outside the EEA, it is protected by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

The Company makes every effort to protect the personal data it processes, both in terms of confidentiality and integrity. Taking into account available technology, implementation cost, the nature, scope, context, and purposes of processing, as well as the severity and likelihood of risks to the rights and freedoms of natural persons, the Company implements appropriate technical and organizational measures to ensure an appropriate level of data security.

Personal data is retained for as long as necessary to fulfill the purpose for which it was collected:
​

A) Users' personal data is retained until deletion of the User's profile from the Application, and is deleted within five (5) years from the date of deletion, except as set out in F) below.
​

B) Artists' personal data is retained for five (5) years from the date their cooperation with the Company ends.
​

C) Visitors' personal data is retained for two (2) months from the date of collection.
​

D) Signed Consent Forms are retained as a record tied to the specific booking for which they were signed, for the minimum period required by the Artist's applicable local health, safety, and record-keeping legislation, after which they are securely destroyed.
​

E) Data from Instagram direct messages processed by Omi is retained as described under "Omi in Instagram Direct Messages" above.
​

F) Conversations with Omi and the pictures in them are kept until the User deletes them. When a User deletes a conversation, clears all their conversations, or their account is deleted, the conversations and their pictures are deleted immediately. Voice recordings are not kept.

G) Records kept to keep Omi safe (as described in “Keeping Omi safe”): daily message counts are kept for 30 days; reports and review-list entries for up to 12 months after they are resolved; the email address of a suspended account for as long as the suspension lasts, and removed if the suspension is lifted.

H) Artist profiles added to Omi from Instagram are retained as described under "Artist profiles on Omi from Instagram" above.

I) The city a User asked to hear about is kept until their account is deleted, and is deleted with it.

J) Guest Spot Board posts are deleted when the poster deletes them, and otherwise 3 months after their end date. An artist’s choice to be matched only with LGBTQ+ friendly studios is deleted as soon as they turn it off or delete their post. A poster’s public details (described in “Guest Spot Board”) are kept until they ask to be removed, and the email address of a poster who ticked “Keep me in touch” until they stop these emails.

After the applicable retention period, the Company ensures personal data is securely destroyed or rendered anonymous in a manner that does not permit re-identification of data subjects.

In compliance with the GDPR, every data subject has the following rights regarding their personal data:

Where processing is based on consent, the data subject has the right to withdraw that consent at any time.
​

Requests to exercise these rights should be submitted in writing to [email protected], accompanied by identifying information. The Company may request additional means of identity verification. For data the Company processes on behalf of an Artist, the Company forwards the request to the Artist and helps them answer it.
​

The Company will respond without undue delay and in any event within one month of receiving the request, with the possibility of extending this by a further two (2) months where necessary due to the complexity of the request.

Responses are provided free of charge, unless a request is manifestly unfounded or excessive, in which case the Company may charge a reasonable fee or refuse to act on the request.

For further information, advice, or to lodge a complaint, you may contact the Hellenic Data Protection Authority:

1-3 Kifisias Avenue, 115 23, Athens

Switchboard: +30-210 6475600

Fax: +30-210 6475628

Email: [email protected]

Website: https://www.dpa.gr (detailed instructions for submitting a complaint)

For any matter relating to the processing of your personal data or this Policy, you may contact Ilias Hatzis:

By post: Inkjin IKE, 332 Kifisias Avenue, 15233 Chalandri

By email: [email protected]

Our goal is to continuously review and update this Policy in order to comply with data protection legislation and new developments. Any update to this Policy will be communicated to you promptly.