Privacy Policy

Your account: your name, email, and a securely hashed password. Studio owners also add a studio profile, like the shop name, Instagram handle, hourly rate, and default deposit.

Your clients' information: when a client reaches out or you add a booking, we store what's needed to manage it. That's their name and Instagram or WhatsApp handle, the messages they send, any reference photos they share, and the appointment and pricing details.

Consent and health details: if you use Patron's built-in waiver, we store your clients' answers and signature so you keep the signed record. Those answers can include sensitive health information a client chooses to disclose, like allergies, medical conditions, or medications. We hold this on your behalf and use it only to run the service for you. Patron is not a healthcare provider or a HIPAA-covered entity, and we don't treat this as HIPAA-regulated data. The studio decides what its waiver asks and is responsible for collecting and handling those answers lawfully.

Payments: deposits and fees are processed by Stripe and land in your own account. Stripe handles the card details. We never see or store full card numbers; we keep records of amounts, status, and timing so your ledger and payouts stay accurate.

Messages we set up for you: Patron prepares reminders and aftercare notes in the app. When SMS or email sending is enabled, they go out through our messaging providers.

Early-access waitlist: if you join our waitlist, we collect the email address you submit so we can tell you when Patron opens. Nothing else.

Technical data: basic logs and a sign-in cookie that keeps you logged in. We don't use cookies for advertising. A studio can also switch on Google Analytics for its own public booking page; when it's on, visitors are asked to accept or decline first, and nothing loads unless they accept. It's off by default, controlled in the studio's Settings, and a visitor can change their choice anytime from the page footer.

We use this information to run Patron: to show your pipeline, read incoming messages, schedule and price work, route deposits to your Stripe, send the messages you set up, answer support requests, keep the service secure, and meet our legal obligations.

To turn a raw message into a structured request, we send the message text to our AI provider, Anthropic, which runs the model that pulls out the fields and hands the result back to us. They process it to return that result and don't use it to train their models.

If AI isn't available, Patron falls back to a simple built-in parser that runs on our own systems and sends nothing to an outside service.

We don't sell your data, and we never resell your clients. We share information only with the services that make Patron work, and only as much as each one needs:

• Netlify, our marketing-site host and form provider, for hosting the site and receiving early-access waitlist sign-ups.
• Anthropic, for AI parsing of the messages you bring in.
• Stripe, for deposits, fees, and payouts into your own account.
• Our messaging providers (such as Twilio and Resend), for sending the SMS and email you set up, when message sending is enabled.
• Our hosting and database provider (Supabase), for storing your data securely.
• Google, for Analytics if a studio turns it on for its public booking page.

We may also share data when the law requires it, to protect people's safety, or as part of a sale or merger of the business. If ownership ever changes, we'll tell you.

For the client information you bring into Patron, you decide what to collect and why. We process it on your behalf so we can provide the service. Handling it lawfully is your responsibility, including any consent your clients need to give before you upload their messages or photos, and especially for the sensitive health details a waiver can collect, which many privacy laws protect more strictly.

We hold your data while your account is active and for as long as we need it for the purposes above or to meet legal duties. After that, we delete or anonymize it.

We protect it with encryption in transit, hashed passwords, and access controls. No system is perfectly secure, but we work to keep yours safe and we'll act quickly if something goes wrong.

Depending on where you live, you can ask us to show you the data we hold about you, correct it, delete it, or send you a copy. You can also object to certain uses. Email support@patron.ink and we'll take care of it. Asking is free, and we won't penalize you for it.

If a studio collected information about you as its client (through a booking or a waiver), the studio decides how that data is handled. Contact the studio directly, or email support@patron.ink and we'll route you to them.

If you're in California, the CCPA/CPRA gives you those same rights: to know, access, correct, delete, and to not be treated differently for using them. We do not sell or “share” (as those laws define it) your personal information or your clients', and we haven't in the past 12 months. See “Who we share it with” for the service providers we rely on.

Patron and the services it relies on may process your data in other countries. Where that happens, we use appropriate safeguards for the transfer.

Patron is for tattoo professionals and their adult clients. It isn't meant for children, and we don't knowingly collect their information.

We'll update this policy as the product changes. If a change matters to you, we'll tell you by email or in the app before it takes effect.

Questions about your privacy, or want to exercise one of the rights above? Email us at support@patron.ink and we'll help.