Privacy Policy

1. Who is responsible

Inked World is operated by Ohana Heritage (Mauritius) Ltd, a company registered in Mauritius (File No. C222233), which is responsible for the processing described in this policy. Contact: hello@inked-world.com.

2. Data we process

Depending on how you use Inked World, we process the following categories of data:

• Account data: your email address, your sign-in credentials (managed by our authentication provider, Supabase Auth; passwords are stored only in hashed form) and your sessions.
• Public professional data: information about tattoo artists and studios shown in the directory — names, biographies, professional location, professional contact details, websites and social media links. Part of this data is imported from publicly available sources.
• Data you submit: images and portfolio content you upload, profile claims with the messages and evidence you provide, and data protection requests sent through our form.
• Technical data: the page URL or path, your browser’s user-agent, error information, a pseudonymised fingerprint derived from your IP address used to count profile views without duplicates, and rate-limiting data used to protect the service against abuse.
• Administration and audit data: a record of actions taken by our administrators and a log of changes made to profiles, kept for accountability and security.

3. Where public professional data comes from

Some artist and studio profiles are created from publicly available information, such as open geographic data (OpenStreetMap) and information professionals publish about their business, for example on their website or public social media pages. We publish it to help the public find tattoo professionals.

If you are the professional concerned, you can claim your profile, ask us to correct it, or object to its publication at any time (see section 8).

4. Why we use your data

• To create and secure your account and let you sign in — necessary to provide the service you request.
• To publish and maintain the directory of tattoo professionals — our legitimate interest in offering a useful public directory, balanced with the professionals’ right to object.
• To verify and process profile claims and host the content you publish — necessary to provide the service you request.
• To keep the service secure and reliable: preventing abuse, limiting request rates, diagnosing errors and counting views — our legitimate interest.
• To answer your requests, including data protection requests, and to meet our legal obligations.

We do not sell personal data and do not use it for advertising.

5. IP addresses

Inked World’s own application tables do not store your raw IP address for view counting, rate limiting or error logging: view counting uses a pseudonymised, truncated fingerprint, and rate limiting uses a hashed key.

However, our authentication provider (Supabase Auth) may record the IP address used to sign in, for account security. And, like any website, the infrastructure providers listed below technically receive your IP address when your browser connects to them.

6. Service providers

We use the following providers to run Inked World. Each receives only the data needed for its function:

• Vercel — hosting and delivery of the website.
• Supabase — database, authentication and file storage (including uploaded images).
• LWS — sending transactional account emails from account@inked-world.com.
• OpenFreeMap — map tiles, loaded by your browser when you view a map.
• Nominatim (OpenStreetMap) — converting a place name into a location; the request is sent from our servers.
• Official RDAP servers of domain registries (IANA list) — public domain registration lookup, used when a profile claim is verified through a website domain; the request is sent from our servers.
• Google Fonts — an icon font loaded by your browser on the pricing page and in signed-in dashboard and administration areas.

Some of these providers process data outside Mauritius and outside your country of residence.

7. How long we keep data

• Error logs: 30 days.
• View-counting fingerprints: 7 days.
• Rate-limiting data: deleted by an hourly clean-up once expired.

Other data (account, profiles, content, claims, requests and audit records) has no fixed automatic deletion period. It is kept while your account or the profile exists, or as long as needed for the purposes above and our legal obligations.

8. Your rights

Depending on the applicable law, including the Mauritius Data Protection Act 2017 and, where it applies, the EU General Data Protection Regulation (GDPR), you can ask to access your data, correct it, erase it, object to or restrict its processing, and receive a copy of the data you provided.

To exercise these rights, write to hello@inked-world.com or use our data request form. We may ask you to confirm your identity. We answer within one month.

You can also lodge a complaint with the Data Protection Office of Mauritius or, if you live in the European Economic Area, with your local data protection authority.

9. Cookies

We only use cookies and local storage that are necessary for the service or that remember your choices. We do not use analytics or advertising cookies. See our Cookie Policy.

10. Changes to this policy

We may update this policy. The date at the top of this page shows the current version.

11. Contact

For any question about your data: hello@inked-world.com. Operator details are available in our Legal Notice.