This policy explains how [company name - to be completed] ("we", the "Provider") processes personal data in connection with piercer.io: the app for running a piercing studio (bookings, consent forms, client records, messages), the website and the studios' public pages. It is the information required by Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679).
1. Two roles: controller and processor
- Studios and their teams (accounts, subscriptions, contacting us) and visitors of the piercer.io website: we are the controller of this data.
- Studios' clients (people who book an appointment, sign a consent form, message a studio or pay a deposit through a studio's page): the studio is the controller. We process this data only on behalf of and as instructed by the studio, as a processor (Article 28 GDPR), under a data processing agreement concluded with the studio.
If you are a studio's client, contact the studio first about your data (access, correction, erasure): the studio decides what it collects and how long it keeps it. If you write to us, we will forward your request to the studio concerned.
2. Contact
- Controller: [company name - to be completed], [registered address - to be completed].
- Data protection e-mail: [data protection e-mail - to be completed].
- Data protection officer (DPO): [DPO details, or a statement that none is appointed - to be completed].
3. Data we process as controller
Account and studio. E-mail address, password (we only store a hash of it), studio name, team members invited by the account owner, studio settings. Purpose: creating the account and providing the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Subscription and payments. Plan, invoice and payment history. You enter card details directly with the payment provider Stripe; they never reach us. Purpose: billing and accounting obligations. Legal bases: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) GDPR).
Service e-mails. E-mail address confirmation, password reset, account notifications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Security and abuse prevention. Activity log (who did which important action in the studio, and when), technical session data, Cloudflare Turnstile checks on signup and public forms. Legal basis: our legitimate interest in protecting the service and the data (Art. 6(1)(f) GDPR).
Contact and support. Content of your messages to us. Legal basis: legitimate interest in answering you (Art. 6(1)(f) GDPR).
Requests to test. While piercer.io is open by invitation only, the form on our website asks for your e-mail address and, if you choose to give them, your studio name, city, country and a message, and we record the language of the page. Purpose: contacting you about test access and sending you an invitation. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep these details for 12 months after our last contact with you, then delete them. You can ask us to delete them at any time at [data protection e-mail - to be completed].
Legal claims. Data needed to establish how our cooperation went. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Website. We use no analytics tools and no advertising cookies. Your browser only stores what the site needs to work: your sign-in session, chosen language and theme.
Providing account data is voluntary, but without it we cannot create an account or provide the service. We make no decisions based solely on automated processing that produce legal effects for you (Art. 22 GDPR).
4. Studios' client data (processed on behalf of the studio)
Depending on the modules a studio turns on, piercer.io may hold:
- contact details and visit history (name, e-mail, phone, date, service);
- consent forms: the exact version signed, answers, signatures with date and time, and for minors the details and signature of the legal guardian;
- team notes, photos added by the studio and messages (including Instagram, if the studio connects its account);
- deposit and payment information (handled by Stripe on the studio's behalf).
Health data (Article 9 GDPR). Consent forms may include health information such as allergies, medication or pregnancy. These are special categories of data. The studio, as controller, is responsible for the legal basis for processing them (for example the explicit consent of the person concerned) and for informing its clients. We encrypt consent answers, signatures and health notes in the app with AES-256-GCM, using a key specific to each studio.
Instagram data. If a studio connects its Instagram professional account, piercer.io receives the messages people send to that account and their public profile details (username, name, profile picture), to show them in the studio's inbox. When piercer.io is removed from the studio's Instagram account (in Instagram, "Settings > Apps and websites"), Instagram sends us a deletion request: we then automatically delete the Instagram data received for that account and give a confirmation code with a status page. If you wrote to a studio on Instagram, you can ask the studio to delete the conversation, or write to us at [data protection e-mail - to be completed] and we will pass your request on to the studio.
5. Recipients and sub-processors
We use the following providers, who process data on our behalf (or, for Stripe and Meta, partly as independent controllers):
- Convex, Inc. (USA): database, server logic and file storage. Data is stored in the EU region (AWS eu-west-1, Ireland).
- Cloudflare, Inc. (USA): hosting of the website and app on its CDN, and bot protection for forms (Turnstile).
- Resend (USA): sending e-mails.
- Functional Software, Inc. (Sentry, USA, data stored in the EU region, Frankfurt): only when error tracking is turned on, to diagnose errors of the app (error messages, stack traces, browser type). E-mail addresses, phone numbers, links with tokens and form contents are removed before sending, and IP addresses are not stored.
- Axiom, Inc. (USA, data stored in the EU region): only when server log forwarding is turned on, to keep technical server logs for at most 30 days and detect incidents. The logs contain technical identifiers, not names, e-mail addresses or form contents.
- Stripe Payments Europe, Limited (Ireland): subscription payments and, if the studio turns them on, client deposits (Stripe Connect).
- Meta Platforms Ireland Limited (Ireland): only if the studio connects an Instagram account, to receive and send messages.
- Mistral AI SAS (France, processing in the EU): only if the studio turns on AI sorting of its inbox, to suggest a category and a priority for incoming messages. E-mail addresses, phone numbers, links and handles are removed before sending, and the provider does not keep the messages or use them to train its models.
- OpenAI Ireland Limited (Ireland, processing in the EU through a project with European data residency): only if the platform is configured to use it instead of Mistral AI, for the same AI sorting of the inbox, with the same removal of e-mail addresses, phone numbers, links and handles before sending. The provider does not use the messages to train its models.
- LINK Mobility Poland sp. z o.o. (SMSAPI, Poland): only if the studio turns on SMS, to send appointment reminders and consent signing links to the client's phone number.
We use these two providers only under a signed data processing agreement (Article 28 GDPR). We may also disclose data to public authorities where the law requires it.
6. Transfers outside the EEA
Some providers are based in the USA or use global infrastructure. Such transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses (Article 46 GDPR). You can request a copy of these safeguards at [data protection e-mail - to be completed].
7. How long we keep data
- Account and studio data: while you use the service, and for [period - to be completed] after the account is closed, unless keeping it longer is needed for legal claims. When the owner deletes the studio in Settings, the studio data is deleted 30 days after the request, except signed consent forms (see below); the owner can cancel until then and can download an export at any time.
- Signed consent forms of a deleted studio: the completed forms, their signatures and PDFs are kept locked for [5 years - to be confirmed] after the deletion, then deleted. During that period only the Provider can access them, to answer a legal request, and each access is logged.
- Invoices and billing records: for the period required by tax and accounting law.
- Raw Instagram events: 30 days after receipt.
- Requests to test (e-mail, studio name, city, country, message, language): 12 months after our last contact with you, then deleted; earlier if you ask.
- Backups: deleted data leaves the backups after [period - to be completed].
- Studios' client data: as long as the studio decides, and at most until the studio is deleted (30 days after the owner's request, with a self-service export available meanwhile), except signed consent forms, which are kept locked as described above. When the contract ends, we delete it or return it to the studio as set out in the data processing agreement.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of earlier processing. You can also lodge a complaint with a supervisory authority; in Poland, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
9. Security
Connections are encrypted (TLS). The most sensitive fields (consent answers, signatures, health notes, booking form details) are also encrypted in the app with a key specific to the studio. Every completed consent case gets a SHA-256 fingerprint that reveals any later change. Access inside a studio depends on each team member's role, important actions go to an activity log, and accounts can be protected with two-step verification.
10. Data processing agreement
Studios using piercer.io conclude a data processing agreement with us (Article 28 GDPR; in Polish "umowa powierzenia przetwarzania danych"). We provide it on request: [contact e-mail - to be completed].
11. Changes to this policy
We will tell studios about material changes by e-mail in advance. The current version is always available on this page, with its last update date.