Privacy Policy

Inkaro Privacy Policy
Effective date: 5 September 2026

1. Introduction

This Privacy Policy explains how Avryn Holdings, trading as Inkaro, collects, uses, stores and shares personal data when you use our website, AI Design Studio, virtual try-on tool, ordering flow, feedback pages and inquiry forms.

2. Who we are

Avryn Holdings
Trading name: Inkaro
Email: contact@inkaro.app
KvK: 42013048
VAT: NL005433173B89
Country of establishment: Netherlands
Address: Strevelsweg 700 303, 3083 AS Rotterdam, The Netherlands
Business address - no public shop or walk-in service.

3. What data we collect

  • Name, email address and shipping address
  • Order details, including the design file, size and quantity
  • Uploaded images and tattoo design prompts
  • Payment metadata received from our payment provider (never full card numbers)
  • Feedback you submit through a feedback link we send you
  • Inquiry details you send us by form or email
  • Technical data such as IP address, device and browser data, and pages visited
  • Your cookie choices

4. How we use your data

  • Provide and operate the website and services
  • Generate tattoo concepts when you use the AI Design Studio
  • Process orders, payments and delivery
  • Provide customer support and handle complaints
  • Send order, payment, shipping and feedback emails
  • Comply with legal, tax and accounting obligations
  • Prevent fraud, abuse and misuse of free generation limits
  • Measure traffic and advertising performance, only if you consent

5. Legal bases

  • Performance of a contract: orders, payment, production, delivery and support
  • Legal obligation: tax, accounting and consumer-law record keeping
  • Legitimate interests: site security, fraud and abuse prevention, and service reliability
  • Consent: analytics and advertising cookies, and marketing emails where applicable

6. Service providers we actually use

The table below lists every external service currently active in our website, backend and automated functions. Services we are not using are not listed. Where we could not verify a fact from the implementation or the provider's terms, we say so rather than guess.

Lovable (hosting, content delivery and backend platform)

  • Purpose: hosting the website, serving pages and assets, and running our database, file storage, authentication and server functions.
  • Data shared: all website and order data described above, plus technical connection data such as IP address.
  • Processing location: not verified for every component. Flagged as an open point.
  • Retention: order and design records are kept by us for as long as described in section 9.
  • Legal basis: performance of a contract and legitimate interests.
  • Transfers: where processing happens outside the EEA, transfers rely on the provider's standard contractual clauses. The specific mechanism per component is not verified.

Cloudflare (network and bot protection)

  • Purpose: delivering the site and protecting it against automated abuse. Observed through the __cf_bm cookie.
  • Data shared: IP address and request metadata.
  • Retention: short-lived, set by the provider. Exact period not verified by us.
  • Legal basis: legitimate interests in site security.

Stripe (payments)

  • Purpose: taking payment, calculating tax, applying promotion codes and confirming payment status.
  • Data shared: name, email, billing and shipping address, order amount and line items. Card details go directly to Stripe and never reach our servers.
  • Retention: set by Stripe as an independent controller for its own compliance duties. We keep the payment reference with the order.
  • Legal basis: performance of a contract and legal obligation.
  • Transfers: Stripe is used across the EU and the United States and relies on standard contractual clauses.

Zoho Mail (transactional email)

  • Purpose: sending order confirmations, payment confirmations, shipping updates, feedback requests and support replies.
  • Data shared: your name, email address and the content of the message, including order references.
  • Retention: mailbox and delivery-log retention is set by the provider and is not verified by us.
  • Legal basis: performance of a contract, and consent where an email is not order related.

Lovable AI Gateway (AI design generation)

  • Purpose: turning your prompt, and any reference image you upload, into tattoo design concepts.
  • Data shared: the prompt text and any reference image. No name, address or payment data.
  • Retention and model-training use by the underlying model providers: not verified. Flagged as an open point below.
  • Legal basis: performance of a contract, or your request to use the feature.

Replicate (AI design generation)

  • Purpose: running specific image-generation and image-editing models used by the AI Design Studio.
  • Data shared: the prompt text and any reference image. No name, address or payment data.
  • Processing location: United States.
  • Retention and model-training use: not verified by us. Flagged as an open point below.
  • Legal basis: performance of a contract, or your request to use the feature.
  • Transfers: transfer outside the EEA relies on the provider's standard contractual clauses.

PrintKK (production of temporary tattoos)

  • Purpose: printing and dispatching Small, Medium, Large and XL orders. Orders are submitted manually by us, never automatically.
  • Data shared: recipient name, shipping address, order contents and the print file.
  • Retention: set by the supplier and not verified by us.
  • Legal basis: performance of a contract.
  • Transfers: production takes place outside the EEA. The specific transfer mechanism is not verified. Flagged as an open point below.

Prodigi (production of XXL orders)

  • Purpose: printing and dispatching XXL orders. Orders are submitted manually by us after review.
  • Data shared: recipient name, shipping address, order contents and the print file.
  • Retention: set by the supplier and not verified by us.
  • Legal basis: performance of a contract.

Google Analytics (only with your consent)

  • Purpose: measuring traffic and page performance. Not loaded at all until you allow analytics cookies.
  • Data shared: pseudonymous usage data, device and approximate location data.
  • Legal basis: consent. You can withdraw it at any time through Cookie settings in the footer.
  • Transfers: relies on Google's standard contractual clauses.

Meta Pixel (only with your consent)

  • Purpose: measuring advertising performance. Not loaded at all until you allow marketing cookies.
  • Data shared: pseudonymous event and device data.
  • Legal basis: consent. You can withdraw it at any time through Cookie settings in the footer.
  • Transfers: relies on Meta's standard contractual clauses.

Fonts are served from our own servers. The website does not request fonts, scripts or other resources from Google Fonts.

7. Virtual try-on

The virtual try-on tool runs entirely in your browser.

  • The body photo you choose is read by your own device and drawn onto the preview locally. It is not uploaded to Inkaro, not stored on our servers and not sent to any other company.
  • No face detection, body-landmark detection or biometric analysis is performed.
  • Skin tone and body-outline choices exist only in temporary memory while the page is open. They are not written to our database, browser storage, cookies, analytics or URLs, and they are not included in any log.
  • The photo is discarded when you remove it, reload the page or leave the page.
  • We record only that a try-on preview was generated and the body placement chosen, and only if you have allowed analytics cookies. No image is included.
  • Try-on previews are approximate and may differ from the printed result.

Because no photo, face data or biometric identifier leaves your device and no biometric identification is carried out, we do not treat try-on as special-category processing.

8. AI features and uploaded content

Prompts and reference images you submit to the AI Design Studio are sent to the AI providers listed above so that a design can be generated. They are used to produce your design and are not sold or licensed. We cannot currently confirm what those providers retain, or whether they use submissions to train models, so please do not upload anything you would not want to share.

9. Retention

Order records, including the design file needed to reproduce or support your order, are kept for as long as required by Dutch tax and accounting law. Support correspondence is kept for as long as needed to handle the matter and any follow-up. Where a provider sets its own retention, we say so above rather than state a period we have not verified.

10. Payments

Payments are processed by Stripe. We never receive or store full card details. We receive payment status, the transaction reference and limited billing metadata.

11. Cookies

Analytics and marketing technologies stay off unless you allow them. See our Cookie Policy for the full inventory, and use Cookie settings in the footer to change or withdraw your choices at any time.

12. International transfers

Some providers above process data outside the EEA. Where that happens, transfers rely on standard contractual clauses or another lawful mechanism offered by the provider. Where we have not verified the exact mechanism, this is stated in the entry above.

13. Your rights

  • Access your personal data
  • Correct inaccurate data
  • Delete your data, subject to legal retention duties
  • Restrict or object to certain processing
  • Withdraw consent where processing is based on consent
  • Request data portability
  • Lodge a complaint with a supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens

To exercise these rights, contact contact@inkaro.app.

14. Security

We use reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure.

15. Children

You must be 18 or older to place an order. Do not upload images of other people, including children, without the necessary authority and consent.

16. Changes

We may update this Policy. Updated versions are posted here with a revised effective date.

17. Contact and company information

  • Company: Avryn Holdings (trading as Inkaro)
  • KvK: 42013048
  • VAT: NL005433173B89
  • Country of establishment: Netherlands
  • Address: Strevelsweg 700 303, 3083 AS Rotterdam, The Netherlands
  • Business address - no public shop or walk-in service.
  • Contact: contact@inkaro.app