Privacy policy

Who we are

needlz is a management app for tattoo and piercing studios, published by EURL Laconi. This page explains what data needlz handles, why, for how long and with whom.

For a studio’s own account (its details, settings and subscription), EURL Laconi is the controller. For the data of a studio’s clients (records, appointments, payments, questionnaires), the studio is the controller and EURL Laconi acts as its processor, only on its instructions.

The data we handle

For the studio: email address, the artist’s first and last name, the studio’s name and address, phone, legal identifier (SIRET), settings, subscription and, if it connects one, its Stripe account identifier. If the studio signs in with Apple or Google, we receive its email address from that service and, if it agrees, its name.

For a studio’s clients, entered by the studio: first and last name, phone, email, date of birth, Instagram handle, projects, appointments, payment amounts and statuses, notes.

Health questionnaire and consent: the client’s answers to the questionnaire, their signature and the proof of consent, filled in by the client on their own phone.

Technical data: connection and security logs needed to run the service. needlz carries no advertising and no ad trackers, and this site sets no cookies.

Why, and on what basis

Providing the service to the studio (account, calendar, clients, payments, messages): performance of the contract.

Health questionnaire: this is health data. It is collected only with the client’s explicit consent, so that the studio can carry out the work safely.

Signed proof of consent: legal obligation and the studio’s legitimate interest in being able to show the client gave informed consent.

Security and abuse prevention: legitimate interest.

How long

Health questionnaire answers are kept while the client’s project is open, then twelve months, then deleted automatically.

The signed proof of consent (PDF) is archived for ten years, with restricted access.

Other data is kept for as long as the studio’s account exists. When a studio deletes its account, its data and its clients’ data are erased within thirty days, except what the law requires us to keep longer.

Who can see it

Only a studio’s members can access that studio’s data. We sell no data and do not use it for advertising.

We rely on providers, each limited to its task: Supabase (database hosting and authentication, in Ireland, within the European Union); Resend (sign-in emails); Stripe (deposit payments, if the studio enables them); Vercel (hosting of this site); Expo (delivery of app updates); Apple and Google (sign-in, if the studio chooses it).

Text messages to clients are sent from the artist’s own phone, through its own messaging app: needlz does not send them itself.

Where some of these providers process data outside the European Union, the transfer is covered by the European Commission’s standard contractual clauses.

Your rights

You can access your data, correct it, erase it, restrict or object to its processing, receive it in a readable format, and withdraw your consent at any time.

If you are a studio’s client, contact that studio first: it decides about your data. We will help it answer you.

For any question, write to contact@needlz-app.com. You can also lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.

Changes

If this policy changes in a meaningful way, we will tell studios in the app before the change applies.