Privacy Policy

Account information includes your name, email address, and account credentials. Supabase Auth processes sign-in credentials; FlashDash does not store your raw password in its application profile records.

Artist information can include a public name and page, tattoo designs and images, prices, availability, payment instructions, and contact preferences. Booking information can include the selected design and appointment time, client name, email, phone number or Instagram handle, booking status, and any message or variation details submitted with a request.

When an artist requests a Pix deposit, a client may upload a PDF, JPEG, or PNG payment receipt. Receipts are stored privately and can be accessed by that booking's client and artist. The latest receipt remains associated with the booking for as long as the booking record exists.

An artist may connect a Google account separately from their FlashDash sign-in. With the artist's authorization, FlashDash receives the Google account email and identifier and stores the refresh token encrypted on the server. The connection is used only to provide the Calendar features the artist enables.

For booking-event sync, FlashDash creates a private event on the artist's primary calendar when a booking is confirmed after the connection. The event includes the client's name, tattoo design title, appointment time, and a link to the artist's booking page. FlashDash stores the Google event identifier and sync status so it can report or retry delivery.

The event permission is used for those FlashDash booking events and to verify a matching FlashDash-created event after a retry. FlashDash does not use it to read or change unrelated events in the artist's calendar.

If the artist separately enables busy-time checks, FlashDash asks Google for free/busy information for the relevant period and uses it to hide conflicting appointment slots. FlashDash does not read event titles or descriptions for this check and does not store the returned busy periods as calendar records.

Artists can disconnect Calendar in FlashDash. Disconnecting removes the locally stored connection and FlashDash makes a best-effort request to revoke Google access. Events already created in Google Calendar are left there. The artist can also review or revoke FlashDash access in their Google Account settings.

If an event is still waiting to sync when the artist disconnects, it is paused for the Google account originally connected; FlashDash does not send it to a different account.

Google user data is used only to provide the Calendar features described here. We do not sell it, use it for advertising, or use it to build profiles unrelated to those features. It is shared only with providers needed to deliver artist-authorized Calendar features, for security or legal compliance, or as otherwise allowed by Google's User Data Policy. We do not include it in a business transfer without the user's explicit prior consent. Our use follows the Google API Services User Data Policy, including its Limited Use requirements.

We use information to create and secure accounts, publish artist catalogs, receive and manage booking requests, deliver receipts to the relevant artist, send booking-related messages, provide Calendar sync and availability features, and operate paid artist subscriptions.

A booking client's submitted information and receipt are made available to the artist selected for that booking. We use service providers needed to run FlashDash: Supabase for authentication, database, and file storage; Vercel for hosting; Resend for transactional email; Stripe for artist subscriptions; and Google for the Calendar integration. These providers process information to provide their services to FlashDash.

FlashDash does not sell personal information. We may disclose information that is not Google user data when required by law, to protect users or the service, or as part of a business transfer, subject to applicable law. Google user data is shared only with providers needed to deliver artist-authorized Calendar features, for security or legal compliance, or as otherwise allowed by Google's User Data Policy. We do not include it in a business transfer without the user's explicit prior consent.

We keep account, catalog, and booking information while needed to provide the service and maintain the associated records. Pix receipts remain while their booking records exist. Google connection credentials are removed when the artist disconnects or the connection is otherwise deleted. Some information may need to be retained where required by law or to resolve disputes.

We use access controls and reasonable technical safeguards. Google refresh tokens are encrypted at rest and are available only to server-side systems. No online service can guarantee absolute security.

You can manage your account and, as an artist, disconnect Google Calendar through FlashDash. You may request access, correction, or deletion of personal information by emailing arthurcisottom@gmail.com. We may need to verify your identity and may retain information where the law permits or requires it.

You can also revoke Google access from your Google Account's third-party connections page. Revocation may stop Calendar features from working until you connect again.

We may update this policy as FlashDash changes. We will post the current version on this page and update the date above. For privacy questions or requests, contact arthurcisottom@gmail.com.