Welcome to REAP ("we," "our," or "us"). This Privacy Policy explains how we collect, use, share, and protect your information when you use our tattoo artist marketplace platform at reap.ink (the "Service"), including when you connect third-party services like Instagram and Google Calendar.
1. Information We Collect
Account Information
- Email address
- Name and display name
- Profile information (bio, location, contact details)
- Portfolio images and tattoo artwork
Instagram Integration
When you connect your Instagram account:
- Instagram user ID and username
- Profile picture from Instagram
- Public media posts (images you choose to import)
- Basic account information
Instagram Direct Messages
When you connect Instagram messaging to manage client inquiries:
- Message content: Text of Direct Messages sent to your Instagram Business account
- Sender information: Username and profile picture of people who message you
- Timestamps: When messages were sent and received
- Media indicators: Type of media attachments (we do not store the actual media files)
Data retention: Active conversations are retained while your Instagram is connected. Conversations with no activity for 90 days are automatically deleted. When you disconnect Instagram, all message data is immediately and permanently deleted.
Access controls:Only you can see your conversations. We use row-level security to ensure no artist can access another artist's message data.
Google Calendar Data (Optional)
Google API Disclosure:REAP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
If you choose to connect your Google Calendar, we access the following data using the calendar.readonly scope:
- Google Account Email: To identify which account is connected
- Calendar Event Times: Start and end times of events to calculate daily availability
- Event Status: Whether time slots are marked as busy or free
- All-day Events: To mark entire days as unavailable when appropriate
What we DON'T access: Event titles, descriptions, locations, attendee lists, attachments, or any event content. We cannot and do not write, modify, or delete any data in your Google Calendar.
SMS Communications
When you submit a booking request that includes your phone number:
- Phone Number: To send appointment-related SMS messages
- Message Delivery Status: To track whether messages were successfully delivered
2. How We Use Your Information
General Uses
- Create and maintain your artist profile
- Display your portfolio to potential clients
- Connect you with clients seeking tattoo services
- Process bookings and inquiries
- Send service-related notifications
- Improve and optimize our Service
Google Calendar Data Usage
We use Google Calendar data exclusively for:
- Availability Calculation:Automatically determining which days you're available for tattoo bookings based on your calendar events
- Display to Clients: Showing your availability status (available/unavailable) on your public profile - never showing actual calendar details
- Daily Sync: Updating your availability daily at 2 AM to reflect calendar changes
We NEVER use Google Calendar data for: Marketing, advertising, selling to third parties, user profiling beyond availability, or any purpose other than calculating and displaying your booking availability.
SMS Communications Usage
When you provide your phone number through a booking form, we use it to:
- Appointment Reminders: Send automated SMS reminders before your scheduled appointments
- Booking Confirmations: Confirm appointment details via SMS
- Schedule Updates: Notify you of any changes to your appointments
You can opt out of SMS communications at any time by contacting the artist directly. Message frequency varies based on appointment activity. Standard message and data rates may apply.
3. Data Sharing and Disclosure
We Share Data Only:
- With Your Consent: When you explicitly authorize sharing
- For Service Provision: With service providers who help operate REAP (e.g., hosting, analytics) under strict confidentiality agreements
- For Legal Compliance: When required by law, court order, or to protect rights and safety
- Public Profile Data: Your artist profile information is publicly visible as part of the Service
Google Calendar Data Sharing
Google Calendar data is NEVER:
- Sold to third parties
- Used for advertising or marketing
- Shared with other users beyond availability status
- Transferred to third parties except as required for Service operation (e.g., our secure cloud infrastructure provider)
4. Data Security and Retention
Security Measures
We implement industry-standard security measures including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of sensitive data at rest
- Secure OAuth token storage for third-party integrations
- Regular security audits and updates
- Access controls and authentication requirements
- Secure cloud infrastructure (Supabase/AWS)
Data Retention
- Account Data: Retained while your account is active and for 30 days after deletion for recovery purposes
- Google Calendar Tokens: Stored securely while connection is active, immediately deleted upon disconnection
- Availability Data: Updated daily, historical availability kept for 90 days for analytics
- Instagram Data: Cached media retained while connection is active
5. Your Rights and Controls
You Can Always:
- Access your personal data through your account settings
- Update or correct your information
- Delete your account and associated data
- Request data deletion
- Export your data in a portable format
- Opt-out of non-essential communications
Google Calendar Controls
You can revoke Google Calendar access at any time:
- From REAP: Go to Settings → Instagram → Disconnect Google Calendar
- From Google: Visit myaccount.google.com/permissions and revoke access for REAP
Upon disconnection: We immediately delete your Google OAuth tokens, stop syncing your calendar, and revert to manual availability management. Your previously synced availability data remains until you update it manually.
Instagram Message Controls
You have full control over your Instagram message data:
- Delete individual conversations: Remove any conversation from your inbox at any time
- Disconnect Instagram: Immediately and permanently deletes all stored message data
- Request deletion: Contact us to request deletion of specific data
Note: Deleting messages from REAP does not delete them from Instagram. We can only remove data stored in our system.
Regional Rights
If you're in the EU/EEA, California, or other jurisdictions with privacy laws, you may have additional rights including:
- Right to be forgotten (deletion)
- Right to data portability
- Right to restrict processing
- Right to object to processing
- Right to withdraw consent
6. Cookies and Tracking
We use essential cookies for:
- Authentication and security
- Remembering your preferences
- Analytics to improve our Service
You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.
7. Updates to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We'll notify you of material changes via email or Service notification. Your continued use after changes indicates acceptance of the updated policy.
8. Contact Us
For privacy concerns, data requests, or questions about this policy:
© 2024 REAP. All rights reserved.