Privacy Policy

1. Who we are

Frewstar Ltd ("we", "us") is a company registered in Scotland under company number SC884481, with its registered office at 8 Galt Avenue, Irvine, Scotland, KA12 0NW. We operate Frewstar Studio, a booking and studio management platform for tattoo and piercing studios.

Frewstar Ltd is registered with the Information Commissioner's Office, registration number ZC240783.

For anything in this policy, contact us at founder@frewstar.co.uk.

2. Two different relationships

This matters more than anything else here, because it decides who you ask about your data.

Where we are the controller — When you create an account with Frewstar Studio, we decide how your account information is used. That includes your email address, your name, and the record of your sign-ins. We are the data controller for that, and you can contact us directly about it.

Where the studio is the controller — When you book with a studio, fill in their consent form, or exchange messages with them, the studio decides what happens to that information. They are the data controller; we hold and process it on their behalf, on their instructions. Requests about that information — to see it, correct it or delete it — should go to the studio, though we will help them respond.

Why the distinction is real: a studio must keep certain records to meet its own legal and licensing obligations. We cannot delete those on your say-so any more than a hospital's IT supplier could delete your notes.

3. What we collect

If you have an account — Your email address, display name, and, if you provide them, your phone number and date of birth. You can sign in with your email address and a password, with a one-time code we email you (if you have booked or enquired with a studio), or with Google. We also email you a link to confirm a new account or to reset your password.

If you sign in with Google — Google shares your name, email address and profile picture with us. We use only your email address, to set up and find your account; we do not use your Google name or picture. We never receive your Google password.

If you make a booking — Your name, email address and phone number; the date, time and type of session; the artist and studio; deposit and payment status, and the amount recorded by the studio. You do not need an account to book.

If you complete a consent form — Your name, date of birth, home address, mobile number and email address; the area of the body being worked on; your answers to the studio's health questions; and your signature, captured as an image. The health answers are special category data. They exist because a studio cannot lawfully or safely proceed without them. They are held under the explicit consent you give on the form, and they are deleted quickly — see section 7.

If you use the design tools — The descriptions and reference images you provide, and the designs generated for you. Your descriptions and reference images are sent to our AI providers to generate the design.

If you use the try-on feature — Photographs of the part of your body you upload. They are stored privately. When you ask for a realistic preview, your photograph and the design are sent to our AI image provider to produce it. Otherwise your photographs are visible only to you and to the studio you are working with. A photograph or preview you do not save is deleted automatically after 7 days. One you save is kept until you delete your account.

If you upload a tattoo to try on — If it is a photograph of a tattoo, it is sent automatically to our AI image provider, which cuts the tattoo out of the photograph so you can try it on. A drawing or a design on plain paper is prepared on your own device and is not sent anywhere. Our temporary copy is deleted as soon as the cut-out comes back, and the cut-out itself is not kept unless you save your try-on. If you save it, or ask for a realistic preview, the image you uploaded is stored privately with your try-on photographs; an upload you do not save is deleted automatically after 7 days.

If you are a studio adding to your portfolio — Photographs of finished tattoos are processed the same way: each one is sent automatically to our AI image provider to cut the tattoo out so clients can try it on, and the cut-out is kept with your portfolio. Drawings are prepared on our own systems and are not sent. By uploading a photograph of a client's tattoo, you confirm that the client has given you permission to use photographs of their body.

Photographs of other people — Only upload a photograph of someone else's tattoo or body if they have given you permission.

If you are an artist and connect Google Calendar — We add your Frewstar Studio bookings to a calendar we create in your Google account, called “Frewstar bookings”. Each entry shows the client’s first name, the session, the placement, whether a deposit and a design have been agreed, and a link back to the booking — never a client’s surname, email address, phone number, notes or health information. We also read when you are busy on your main Google calendar: only the start and end of each busy period, never what the event is, who it is with or where it is. We use that for one thing only — to stop clients being offered times you are already busy. We cannot see or change any other calendar or event in your Google account.

Frewstar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use information from your Google account for advertising, we do not sell it, we do not use it to train AI models, and nobody at Frewstar reads it unless you ask us to, it is needed for security, or the law requires it.

Automatically — Basic technical information needed to run the service: your browser type, and your IP address where we need it to prevent abuse of the free design tools. We record which of our messages were sent to you and whether they were delivered.

What we do not collect: we never see or store your full card details. Card deposits, where a studio turns them on, are processed by our payment provider; otherwise deposits are arranged directly between you and the studio. We do not sell your information to anyone, and we do not use it to advertise to you.

4. Why we use it, and our lawful basis

To provide the service you asked for — taking your booking, sending confirmations and reminders, delivering aftercare, letting you see your history. Lawful basis: performance of a contract, or the studio's legitimate interest in running its business.

To let a studio work safely and lawfully — the consent form and its health questions. Lawful basis for the health answers: your explicit consent, given on the form itself.

To keep the platform working and secure — preventing abuse, diagnosing faults, keeping records of messages we sent. Lawful basis: our legitimate interests in operating a secure service.

To ask for a review after your session. Lawful basis: the studio's legitimate interest. You can decline, and declining changes nothing else.

Automated tools: we use AI to generate design images, to cut tattoos out of uploaded photographs so they can be tried on, and to help studios answer enquiries. These tools do not make decisions about you — a person at the studio decides whether to accept a booking, and what to tattoo.

5. Who can see it

The studio you booked with, and its artists. A studio cannot see another studio's clients.

Our service providers, and the other services the platform connects to, described by type in the next section — each receives only what is described there.

Nobody else, unless we are legally required to disclose it.

Anything you deliberately make public — a review you publish, a photograph you allow a studio to show in its portfolio — is public. We will tell you at the point you choose it.

6. Who we use to provide the service

These are the kinds of outside service that handle information so the platform can work. For each one: what we use it for, and what it gets. Some are used only when a studio or artist switches a feature on, and the line says so.

Hosting and website delivery — Runs the website and delivers its pages to you. Gets every request to the site, including your IP address and browser details.

Database, sign-in and file storage — Stores the platform's information and files, and signs you in. Gets everything the platform stores: accounts, bookings, consent forms, messages, designs and uploaded photographs, and the details you sign in with.

Email sending — Sends our emails, such as sign-in codes and links, booking confirmations and reminders. Gets your email address and what each email says.

Text messages — Sends a studio's booking texts, and receives your replies, when the studio uses texts. Gets your phone number, the messages and any reply you send.

Messaging apps — Sends a studio's booking messages through a messaging app, and receives your replies, when the studio uses one. Gets your phone number, the messages and any reply you send.

Social media posting — Posts images to a studio's own social media account, when the studio connects it. Gets only the images and captions the studio chooses to post.

AI features — Generating designs and previews, cutting tattoos out of uploaded photographs so they can be tried on, and helping studios answer enquiries. Gets the descriptions, messages and reference images you give the design tools; a photograph of a tattoo uploaded to try on or added to a studio's portfolio, sent on its own so the tattoo can be cut out; and, for a realistic preview, your try-on photograph together with the design.

Card payments and studio invoices — Card deposits, where a studio turns them on, and invoicing studios for the platform. Gets a studio's or artist's business details, to set up their account, and a studio's name and email address, to invoice it. If you pay a deposit by card, you enter your card details with the payment service directly; we never see them.

Calendar connections — Shows an artist's bookings in their own calendar and stops clients being offered times the artist is busy, when the artist connects a calendar. Gets what section 3 describes; for other calendars, the artist's calendar login, used only to read when they are busy.

Website reading — Drafts a studio's profile from its existing website during setup. Gets the address of the studio's website. No client information.

Maps — Shows the map on the Explore page. Gets your IP address and browser details when your browser loads the map.

Error tracking — Tells us when something goes wrong, so we can fix it. Gets a technical report: the page, your browser type and the error. It is set up not to receive cookies, request headers or IP addresses.

Notifications on your device — Delivers notifications to a device when someone at a studio turns them on there. It is run by the maker of the browser. Gets an encrypted notification it cannot read, addressed to that device.

Analytics — Counts visits so we can see how the site is used. Gets the pages you visit, the site that sent you, your approximate location, and your device, operating system and browser type. It does not use cookies; visits are counted using a short-lived identifier that is discarded after 24 hours.

If you choose to sign in with another account, as section 3 describes, the details set out there pass between us and that account's provider.

Where information is held: our database and files are stored in Ireland (EU). Some of our providers may process information outside the UK. Where they do, it is protected by their standard data protection terms (the UK International Data Transfer Addendum or equivalent).

You can ask us for the names of the providers we use by emailing founder@frewstar.co.uk.

7. How long we keep it

These are the periods the platform actually enforces, not intentions.

The studio receives a copy of your completed consent form by email so it can keep the record it is legally required to keep. That copy is the studio's responsibility, not ours, and our deletion above does not reach it.

8. Your rights

You can ask to see the information we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive a copy in a portable form. Where we rely on consent, you can withdraw it at any time.

For your account, use the delete option in your profile, or contact us. For information a studio holds, contact the studio — and if that is difficult, contact us and we will help.

We respond within one month.

If you are unhappy: tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

9. Keeping it safe

Information is encrypted in transit and at rest. Access is restricted so that a studio can reach only its own clients' records, enforced by the database itself rather than by the app alone. Consent form signatures and uploaded photographs are held in private storage that is not publicly reachable. We keep a log of the messages we send so that failures are visible rather than silent.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the ICO as the law requires.

10. Children

Tattooing anyone under 18 is a criminal offence in the UK. Piercing may lawfully be carried out on a minor in some circumstances with the consent of a parent or guardian, which means a studio may record a child's name, date of birth and health answers through this platform. We are reviewing this section with a solicitor to make sure it fully reflects who must consent, how long that data is held, and what a parent or guardian can ask for — this section will be updated as that work completes.

11. Cookies and similar technologies

We use cookies that are necessary for the service to work — keeping you signed in, and a short-lived cookie that helps us notice when a sign-in link is failing. We do not use advertising or tracking cookies.

12. Changes

If we change this policy we will update the date below, and tell you directly if the change materially affects you.

This version: last updated 4 November 2026.