Privacy Policy

This Privacy Policy explains how Studio Angel Ltd ("we", "us", or "our") collects, uses, and protects your information when you use Studio Angel (the "Service").

Last updated: June 2026

1. Information We Collect

Account holders (studio staff)

Account information: Name, email address, and credentials you provide when registering.
Usage data: How you use the Service, including access times and device information.

Customer data entered by studios

Studios use Studio Angel to manage their own customers. Depending on how a studio configures its account, this may include:

Contact details: Name, email, phone, address, date of birth.
Visit and appointment history.
Consent form responses, including health screening answers, signatures, and photo or ID document uploads where a studio has enabled those questions.
Notes and visit images attached to customer records.

We process this data on behalf of the studio (the data controller). Studio Angel acts as a data processor for customer data.

2. How We Use Information

To provide, maintain, and improve the Service.
To communicate with account holders about their account or product updates.
To ensure security, prevent fraud, and investigate abuse.
To comply with legal obligations.
To fulfil data subject requests (access, erasure, export) initiated by studios or their customers.

We do not sell personal information.

Google Calendar (optional integration)

If a studio staff member chooses to connect Google Calendar, we access Google account data via OAuth with their explicit consent. This may include:

Basic profile information (name, email address) from your Google account.
Calendar metadata (calendar names and identifiers) so you can choose which calendars to sync.
Calendar events in calendars you select — to display appointments in Studio Angel, create or update events when bookings are made or changed, and send appointment reminders.

We use this data only to provide calendar synchronisation and scheduling features within Studio Angel. We do not use Google user data for advertising, and we do not sell it.

How to disconnect: Open Settings → Google Calendars in Studio Angel and disconnect your account, or revoke access at Google Account permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Sensitive Data — Consent Form Uploads

Some studios may ask customers to upload a photo or identity document (for example, to verify age or identity before a tattoo or piercing). This is optional and controlled entirely by each studio's form configuration.

When photo uploads are used:

Files are stored in private cloud storage (Amazon S3) — not on publicly accessible web paths.
Files are only accessible to authenticated studio staff (or authorised kiosk devices during form completion) via the application.
Uploads are automatically deleted after a configurable retention period (default 90 days from form completion), unless earlier deletion is triggered by draft cleanup or customer anonymisation.
Abandoned in-progress drafts have associated uploads removed when drafts are pruned (default 24 hours without activity).

Visit images (e.g. reference photos of work in progress) are stored the same way — private S3, team-authenticated access only, deleted on customer anonymisation.

Studios are responsible for telling their customers why an ID is requested, how long it will be kept, and their rights under applicable data protection law.

4. Data Sharing

We do not sell your personal information. We may share data with trusted subprocessors only as necessary to operate the Service, including:

Stripe — payment processing.
Google — optional calendar synchronisation when a staff member connects their Google account (see above).
Amazon Web Services (AWS) — private file storage and hosting infrastructure.
Email and SMS providers — transactional notifications configured by studios.

A current list of subprocessors is available on request at admin@studioangel.net.

5. Data Security

We implement technical and organisational measures including:

Private, access-controlled storage for uploaded documents.
Authentication and team-scoped authorisation for all customer data.
Encryption in transit (HTTPS/TLS).
Audit logging for key administrative actions.

No system is completely secure. We cannot guarantee absolute security but we work to protect data proportionate to its sensitivity.

6. Data Retention

Data type	Default retention
Account data	While the account is active, plus a reasonable period after closure
Consent form photo / ID uploads	90 days after form completion (configurable by platform operator)
Abandoned consent drafts	7 days
GDPR export archives	Until downloaded or removed by an administrator

Studios may have additional legal obligations to retain certain records. They are responsible for configuring their use of the Service accordingly.

7. Your Rights

Under UK GDPR and applicable law, individuals may have the right to:

Access their personal data.
Rectify inaccurate data.
Erase data ("right to be forgotten") in certain circumstances.
Restrict or object to processing.
Data portability — receive data in a structured format.
Lodge a complaint with the Information Commissioner's Office (ICO) in the UK.

Account holders can manage much of their data within the application. Customer data subject requests should be directed to the studio that collected the data; studios can use Studio Angel's export and anonymisation tools to respond.

8. International Transfers

Where data is stored or processed outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or UK International Data Transfer Agreements with our subprocessors.

9. Children's Privacy

The Service is not intended for children under 18 to register as account holders. Studios may record consent from minors where permitted by law and with appropriate guardian involvement. Studios must comply with age-verification requirements in their jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify account holders of significant changes by email or in-app notice.

11. Contact

For questions about this Privacy Policy or data protection at Studio Angel:

Email: admin@studioangel.net