Privacy and Data Policy

The short version

• We collect information needed to operate Kiroku, secure accounts, and support you.
• Tattoo studios usually decide how client records are used. Kiroku processes those records for the studio providing the service.
• Client records may include sensitive health information from waivers and consent.
• We do not sell personal information or use health data for advertising.
• Personal information is stored on managed cloud infrastructure, encrypted in transit and at rest, with access checked on the server.
• We use service providers (hosting, auth, SMS, email, video, payments, analytics) which may process data outside Australia.
• You can request access, correction, or raise a privacy concern using the contact below.

Who this applies to

Studio owners, staff, artists, clients using bookings/waivers/portals, and visitors to our website. If you are a studio client, contact your studio first about your tattoo or health records; we assist studios where required.

What we collect

Depending on how you use Kiroku: account and contact details; studio and roster information; booking, waitlist and walk-in data; waiver and health answers; messages and call metadata; payment references (card data is handled by our payment provider); and technical logs for security and reliability.

How we handle personal information

Personal information is anything that identifies a person, on its own or with other records: names, contact details, account identifiers, bookings, messages, and uploaded files. Waiver and health answers are sensitive information. We collect and use this to operate Kiroku, secure accounts, send service messages, and support studios and artists.

Tattoo studios decide what client information they collect and why. Kiroku stores and processes those records for the studio running the service. We do not sell personal information. We do not use health answers, waiver content, message bodies, uploaded images, or payment details for advertising.

What someone can see depends on their role and their relationship to the studio, not on whatever the browser happens to load. Owners, managers, front desk, and artists do not automatically get the same records. Client contact details and waiver answers stay with people who need them for the work.

Ending access (leaving a studio, coming off the roster, or closing an account) stops ongoing access. It does not automatically delete studio history. Bookings, waivers, and financial records may need to stay with the studio for legal, insurance, or accounting reasons.

How we store and protect information

Kiroku runs on production-grade managed cloud infrastructure. We do not operate our own data centres. Application hosting, authentication, databases, and file storage are handled by specialist providers with their own security programs. Primary production databases and object storage are placed in region-specific locations so we can meet locale-specific regulatory and data-residency requirements.

Connections to Kiroku use HTTPS/TLS. Database records and stored files are encrypted at rest by those providers. Payment card numbers are entered with Stripe and are not stored in Kiroku's application database. Login uses one-time codes. We do not store account passwords.

Access is checked on the server for studio, artist, and client actions. Secrets and elevated database credentials stay on the server and are not exposed to the browser. Uploaded files such as waiver PDFs, reference images, and portfolio photos are served through application-controlled routes, not as an open public folder.

Our cloud providers supply redundancy and backup capabilities for the infrastructure they run. No online service can promise absolute security. Studios should give each person their own login, use the least access needed, and remove people who no longer work there.

Contact

Privacy: hello@kiroku.studio
Support: support@kiroku.studio