engramor (EngramOr) Privacy Policy

This Privacy Policy applies to the engramor web application and platform, accessible at https://engramor.com and https://app.engramor.com (“Engramor”, “we”, “us”, or “our”).

The data controller responsible for personal data processed in connection with your Engramor account and website interactions is Damianos Pappas, operating as Engramor in Greece (European Union). For any privacy questions, data subject access requests, data deletion requests, or concerns regarding our data practices or Google API integrations, you may contact us directly at damianos.pappas@googlemail.com.

Where a studio uses Engramor to manage its own customers (bookings, appointment reminders, consent forms, and customer records), the studio acts as the Data Controller for its customers' personal data, and Engramor acts as the Data Processor acting strictly on the studio's documented instructions in accordance with Article 28 of the EU General Data Protection Regulation (GDPR).

Engramor is a business-to-business (B2B) studio-management software web application built for professional tattoo studios, piercing studios, nail salons, beauty salons, lash & brow studios, and appointment-based service businesses. Studios and their staff use Engramor to:

• Publish a branded online booking page and installable progressive web app (PWA) where customers can request appointments, answer intake questions, and pay booking deposits via Stripe.
• Manage studio calendars, artist/specialist schedules, waitlists, and automated appointment confirmation and reminder emails.
• Collect, verify, and permanently archive digital client consent and health-intake forms signed on a phone or tablet via QR code, complete with SHA-256 cryptographic integrity fingerprints.
• Log daily sessions, prices, payment methods, tips, VAT, and studio expenses, including a blind front-desk cash verification workflow and monthly team payout statements.
• Maintain customer CRM profiles, send aftercare, infill/refresh, and win-back emails, request post-visit reviews, and track studio supply inventory, lot numbers, and expiry dates.
• View financial analytics, multi-studio comparisons, self-learning revenue forecasts (Outlook), and optional business intelligence summaries.

We collect personal and operational data only when necessary to provide, secure, and maintain the Engramor service. Below is a complete breakdown of the categories of data we collect and the methods by which we collect them:

3.1 Account registration and studio profile data (collected directly from studio users)

• Identity and contact data: full name, display name, email address, phone number, studio name, studio address, and assigned role (Master Admin, Owner, Manager, Front Desk/Counter, or Artist/Specialist).
• Authentication credentials: username and cryptographically hashed password (hashed using bcrypt; plain-text passwords are never stored or visible to us).
• Studio configuration data: business hours, service menus, pricing, deposit rules, commission/split percentages, VAT settings, custom staff terminology, and brand logo/theme colours.

3.2 Studio operational, booking, financial, and consent records (collected through use of the application)

• Appointment and booking records: requested service, preferred artist or specialist, appointment date/time, duration, booking status, intake notes, and optional reference photos uploaded by the customer or studio.
• Session and financial records: session revenue entries, payment methods (cash, card, bank transfer, Stripe deposit), tip amounts, blind counter verification entries, supplier expense logs, and generated payout statements.
• Digital consent and intake forms: client full name, date of birth, contact details (email, phone, address), emergency contact, relevant medical/allergy declarations required for safe tattoo, piercing, or beauty procedures, guardian details (where applicable), electronic signature image, template version, signing timestamp, and SHA-256 document hash.
• Customer CRM and communication preferences: visit history, aftercare and marketing email opt-in/unsubscribe status, and post-visit feedback ratings.
• Inventory and supply records: item names, batch/lot numbers, expiry dates, stock quantities, and supplier names.

3.3 Payment processing data (collected via Stripe)

• When a customer pays a booking deposit or a studio processes a card payment through Stripe, payment card details (card number, CVV, expiration date) are entered directly into Stripe's PCI-DSS Level 1 compliant checkout interface and are never transmitted to or stored on Engramor servers. Engramor receives only the Stripe payment intent ID, payment status, amount, currency, and last-4-digit receipt reference.

3.4 Website onboarding inquiry and support communications

• When you submit an onboarding or beta access request on engramor.com, we collect your full name, studio name, email address, phone number, and selected plan preference. This inquiry is transmitted directly to our support inbox via EmailJS so we can set up your studio workspace or respond to your question.

3.5 Automatically collected technical, log, and analytics data

• Security and audit logs: IP address, sign-in timestamps, browser user agent, session identifiers, and administrative audit-log entries recording creates, edits, exports, and permission changes within a studio account.
• Website analytics: aggregate website usage metrics (pages visited, approximate region, device category, session duration, and referring traffic source) collected via Cloudflare Analytics and Google Analytics 4 with Google Consent Mode v2 (analytics storage remains disabled by default until a visitor grants consent via the cookie banner). We do not use cross-site advertising trackers or sell personal data.

3.6 Google user data (collected only upon explicit user authorization via OAuth 2.0)

• If a studio owner, staff member, or studio customer chooses to connect a Google account or use “Sign in with Google”, we receive only the specific data permitted by the OAuth 2.0 scopes authorized on Google's consent screen. All details regarding our collection, use, storage, protection, sharing, and deletion of Google user data are set out in full in Section 4 (“Google user data”) below.

Engramor provides optional integrations with Google services using Google OAuth 2.0. Every Google integration is disabled by default, must be explicitly initiated by the user via Google's official OAuth consent screen, requests the minimum possible scope required for that specific feature, and can be disconnected at any time with a single click. This section explains exactly what Google user data we access, how we use it, how we store and secure it, and how users can revoke access or delete their data.

4.1 What Google user data is accessed by our application (Data Accessed & OAuth 2.0 Scopes)

• Sending Studio Emails via Gmail API (scopes: https://www.googleapis.com/auth/gmail.send, openid, https://www.googleapis.com/auth/userinfo.email): A studio owner (or platform administrator for the platform's own notification address) can choose “Connect with Google” to send studio emails through their own Gmail account instead of configuring SMTP passwords. When authorized, we receive the connected Gmail email address (to display which account is connected and to populate the From header) and an OAuth token restricted solely to sending messages (gmail.send). We use this permission exclusively to send emails triggered by the studio: booking confirmations, appointment reminders, deposit/payment receipts, copies of signed consent forms, aftercare instructions, review requests, and opt-in newsletters composed by the studio. Engramor does not request gmail.readonly, gmail.modify, or full mailbox scopes, and cannot read, view, list, search, modify, or delete any emails or threads in your Gmail inbox.
• Studio Backups via Google Drive API (scope: https://www.googleapis.com/auth/drive.file): A studio can optionally enable automatic or on-demand backup of its own studio records, reference photos, and signed PDF consent forms to its own Google Drive. Because we use only the narrow drive.file scope, Engramor can only view, create, update, or manage the specific files and folders that Engramor itself creates inside your Google Drive. Engramor cannot view, list, open, download, modify, or delete any other existing files or folders in your Google Drive.
• Customer & User Authentication via Google Sign-In / OpenID Connect (scopes: openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile): Customers visiting a studio's booking page or studio app can choose “Continue with Google” to sign in. When they do, we receive their basic Google profile information (Google unique account identifier sub, email address, display name, and profile picture URL if present) and use it solely to authenticate their session and link them to their own appointment history with that studio.
• Appointment Synchronization via Google Calendar API (scope: https://www.googleapis.com/auth/calendar.events / https://www.googleapis.com/auth/calendar): A studio can optionally connect a Google Calendar so confirmed studio appointments, reschedules, and cancellations are automatically written to the calendar designated by the studio. We write and update only the studio's appointment events on the selected calendar.

4.2 How our application uses Google user data (Data Usage)

• Strictly for user-facing functionality: We use Google user data solely to provide and improve the specific user-facing application functionality that you explicitly chose to enable (sending studio emails via Gmail, backing up studio files to Google Drive, syncing appointments to Google Calendar, or authenticating via Google Sign-In). We never use Google user data for any reason other than providing or improving your application's user-facing functionality.
• No advertising or marketing profiling: Google user data is never used for serving advertisements, retargeting, personalized advertising, creditworthiness assessment, or market research.
• No AI/ML model training: Google user data obtained through Google APIs is never used to train, fine-tune, develop, or improve any artificial intelligence or machine learning models (whether proprietary or third-party) and is never transmitted to any third-party AI service.
• Strict human-access prohibition: No human at Engramor reads or inspects Google user data unless: (a) we first obtain your affirmative, documented consent to troubleshoot a specific technical support issue you reported; (b) it is strictly necessary for security purposes (such as investigating active abuse or a security incident); or (c) it is required to comply with applicable law.

4.3 With whom we share, transfer, or disclose Google user data (Data Sharing & Transfer)

• We never sell, rent, lease, or trade Google user data to any third party, advertiser, or data broker, and we never transfer Google user data to third parties for reasons other than providing or improving the application's user-facing functionality.
• We do not share, transfer, or disclose Google user data to third parties except in the following limited circumstances permitted by the Google API Services User Data Policy: (1) to our core infrastructure hosting subprocessors (listed in Section 7, such as AWS RDS and Hetzner in the EU) solely as necessary to store encrypted tokens and execute the user-facing features on your behalf under binding data processing and confidentiality obligations; (2) when required to comply with applicable laws, regulations, or enforceable governmental requests; or (3) in connection with a merger, acquisition, or sale of assets, only after providing explicit prior notice to affected users.

4.4 Data protection mechanisms for sensitive data (Data Storage & Security Protection)

• Encryption at rest: OAuth 2.0 refresh tokens and connection credentials are encrypted at the application layer using AES-256 encryption before being stored in our database, which is hosted on encrypted storage volumes within the European Union. Short-lived OAuth access tokens are held in volatile server memory only for the duration of active API requests (up to one hour) and are not written to disk.
• Encryption in transit: All communications between your browser, Engramor's servers, and Google API endpoints are encrypted in transit using HTTPS / TLS 1.2+ (TLS 1.3 supported).
• Tenant isolation & access control: Every Google OAuth connection is cryptographically bound to the specific studio tenant or customer account that authorized it. Role-based access controls (RBAC) ensure that only authorized studio administrators can manage studio-level connections.

4.5 Disclosures about data retention and deletion (Data Retention & Deletion)

• Retention period: We retain your Google OAuth token and connected account identifier only for as long as you keep the integration enabled on your active account.
• In-app disconnection & immediate token deletion: You can disconnect any connected Google account at any time inside the application under Settings → Connections → Disconnect. Clicking Disconnect immediately revokes the token with Google and permanently deletes the stored encrypted OAuth token and connected email address from our database.
• Revoking access via Google Account settings: You can also revoke Engramor's access at any time directly from your Google Account security page at https://myaccount.google.com/permissions.
• Account closure and deletion requests: When a studio or customer account is closed, all associated Google OAuth tokens and Google user data are permanently deleted within 30 days (and immediately upon manual disconnection). You may also request immediate deletion of any Google user data at any time by emailing damianos.pappas@googlemail.com, and we will complete the deletion and confirm in writing within 30 days.

Engramor complies fully with the Google APIs Terms of Service. Engramor does not use Google APIs (including the Google Gemini API, Vertex AI, Google Drive API, Gmail API, or Google Sign-In) or any other artificial intelligence technology for AI NCII (AI-generated Non-Consensual Intimate Imagery), sexually explicit content, nudity, or synthetic media (“deepfakes”).

Engramor includes optional business-administration AI helpers powered by Google Gemini models (via the Google Gemini API / Vertex AI) that a studio owner can enable or disable per studio. These tools are strictly B2B administrative productivity aids:

• Business financial reports & Q&A (“Ask your studio”): analyzes the studio's own aggregate operational numbers (revenue totals, expense categories, booking counts, and retention rates — with customer names stripped before processing) to produce written financial summaries and scheduling recommendations.
• Business email & review-reply text drafts: generates draft text for appointment reminders, studio newsletters, or polite replies to customer Google reviews, which studio staff review and edit before sending.
• Abstract email header backgrounds: generates an abstract geometric colour-gradient banner for the top of a studio newsletter derived from the studio's brand colour palette. Studios cannot enter custom image prompts: Engramor uses a fixed, server-controlled system prompt that explicitly forbids people, faces, human bodies, skin, and nudity, and enforces Google's strictest safety filter thresholds blocking any suggestive or explicit output.

Strict safety and privacy guarantees for AI features:

• Engramor never generates, edits, alters, or manipulates photographs or images of real people, faces, or bodies, and never creates, processes, or distributes non-consensual intimate imagery (AI NCII), nudity, or sexually explicit imagery of any kind.
• Photographs uploaded by studios or their customers (such as tattoo, piercing, nail, or beauty reference/portfolio photos) are stored solely as static files in private storage and are never sent to any AI image generator or AI vision model.
• Studio data processed by Gemini is used strictly on a per-request basis to return the requested business summary or text draft to that studio and is never used to train AI models. Google user data (Section 4) is never sent to any AI service.

Under the EU General Data Protection Regulation (GDPR) and UK GDPR, we process personal data only when a valid legal basis applies:

• Performance of a contract (GDPR Art. 6(1)(b)): processing your account details, studio configuration, booking records, session logs, and user-enabled integrations is necessary to provide the Engramor platform under our Terms of Service.
• Explicit consent (GDPR Art. 6(1)(a) & Art. 9(2)(a)): connecting a Google account via OAuth 2.0, accepting optional analytics cookies, opting into studio marketing emails, and submitting health/allergy disclosures on digital studio consent forms are based on explicit user consent, which may be withdrawn at any time.
• Legal obligation (GDPR Art. 6(1)(c)): retaining financial transaction records for tax/accounting compliance and preserving signed procedure consent forms to satisfy applicable health, safety, and professional documentation regulations.
• Legitimate interests (GDPR Art. 6(1)(f)): maintaining security audit logs, preventing fraud and unauthorized access, rate-limiting abusive traffic, and ensuring platform reliability. You have the right to object to processing based on legitimate interests (see Section 11).

We do not sell, rent, or trade personal data to third parties. We share personal data only with vetted infrastructure and service providers (“subprocessors”) strictly as necessary to host, secure, and deliver the Engramor service. Each subprocessor is bound by a Data Processing Agreement (DPA) and confidentiality obligations:

We will update this list before adding or replacing any subprocessor that handles personal data. Aside from these service providers, we disclose data only when required by applicable law, regulation, or valid court order.

Our primary application servers and databases are hosted in the European Union (Germany). Where a third-party service provider processes limited data outside the European Economic Area (EEA), such transfers are protected by adequacy decisions of the European Commission (such as the EU–U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46, supplemented by encryption in transit and at rest.

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, or resolve disputes:

• Active studio accounts and operational records: retained for the duration of your active Engramor account. When you request account deletion, your account and studio records are deleted within 30 days.
• Google OAuth tokens and connected account data: deleted immediately when you click Disconnect in Settings → Connections, and within 30 days if your studio account is closed or you email us a deletion request.
• Customer records and studio-configurable retention: studio owners can export or erase any individual customer's personal data at any time from Settings → Customer data (GDPR export and erase tools) and can configure automated retention periods (minimum 6 months) to purge expired records.
• Signed consent form records: retained for the retention period set by the studio or permanently where required by applicable health, safety, and legal documentation rules governing tattoo, piercing, and cosmetic procedures.
• Uploaded files and reference photos: retained only while linked to an active booking or record; permanently deleted from Cloudflare R2 and server storage when the parent record or studio account is deleted.
• Website onboarding inquiries: retained until we have responded to your request and deleted within 90 days if the inquiry does not proceed to an active account.
• Security and audit logs: retained for 12 months to ensure platform security, detect unauthorized access, and support forensic investigations.
• Email marketing opt-out / unsubscribe records: minimal suppression records are kept permanently so that unsubscribed recipients are never emailed again.

We implement strict technical and organisational security controls designed to protect personal data and Google user data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: all web and API traffic is encrypted using HTTPS / TLS 1.2 and TLS 1.3 with HSTS enforced.
• Encryption at rest: database volumes are encrypted at rest, passwords are hashed with bcrypt, and third-party OAuth tokens (such as Google OAuth refresh tokens) are additionally encrypted at the application layer with AES-256.
• Role-based access control (RBAC) & tenant isolation: a 5-tier permission hierarchy (Master Admin, Owner, Manager, Counter/Front Desk, Artist/Specialist) and strict multi-tenant database isolation ensure users only see data belonging to their own studio and permitted by their role.
• Private object storage & cryptographic integrity: uploaded files and signed consent PDFs are stored in private, non-public Cloudflare R2 buckets and EU server storage, with SHA-256 cryptographic hashes verifying document integrity.
• Audit logging & rate limiting: administrative actions, data exports, and authentication attempts are logged and protected by automated rate limiting.

Depending on your location (including under the EU GDPR, UK GDPR, and California Consumer Privacy Act / CCPA), you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): request confirmation of whether we process your personal data and receive a copy of that data.
• Right to rectification (Art. 16 GDPR): request correction of inaccurate or incomplete personal data.
• Right to erasure / “Right to be forgotten” (Art. 17 GDPR): request deletion of your personal data where there is no overriding legal obligation to retain it.
• Right to restriction of processing (Art. 18 GDPR): ask us to restrict how we process your personal data in specific circumstances.
• Right to data portability (Art. 20 GDPR): receive your personal data in a structured, commonly used, machine-readable format (JSON / CSV / PDF).
• Right to object (Art. 21 GDPR): object to processing based on legitimate interests or opt out of marketing communications at any time via the one-click unsubscribe link in every campaign email.
• Right to withdraw consent (Art. 7(3) GDPR): withdraw previously granted consent at any time (for example, by disconnecting a Google account or updating cookie preferences) without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at damianos.pappas@googlemail.com. If you are a customer of an individual studio that uses Engramor, you may contact either that studio directly or email us and we will assist the studio in fulfilling your request. We respond to all verified requests within 30 days.

We use a minimal set of cookies and browser storage technologies:

• Strictly necessary authentication & security storage: session tokens and CSRF/security state required to keep you signed in to app.engramor.com or a studio's customer portal, and a local storage flag recording your cookie banner choice on engramor.com.
• Optional website analytics cookies (Google Analytics 4): on engramor.com, Google Analytics 4 is configured with Google Consent Mode v2 so that analytics cookies (_ga) are denied by default and are only set if you explicitly click “Accept” on our consent banner. We do not use advertising, remarketing, or third-party tracking cookies.

Engramor is a B2B software platform intended for adult business professionals (18 years of age and older). We do not knowingly allow individuals under 18 to create an Engramor studio account. Where a studio lawfully provides a piercing, beauty, or other service to a minor client with parental or legal guardian consent, the studio's digital consent form records the parent or legal guardian's identity, relationship, and signature on the studio's instructions.

If you believe we have infringed your data protection rights, we encourage you to contact us first at damianos.pappas@googlemail.com so we can resolve the issue promptly. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) — our lead supervisory authority in Greece (https://www.dpa.gr) — or with the national data protection authority in the EU/EEA Member State where you reside or work (https://edpb.europa.eu).

We may update this Privacy Policy from time to time to reflect new features, regulatory requirements, or changes in our data practices. The “Last updated” date at the top of this page always indicates the effective date of the current version. Material changes affecting active studio accounts or the handling of Google user data will be communicated to registered users in advance by email.

Contact us: For any questions about this Privacy Policy, our data collection and usage practices, or our compliance with Google API policies, please email Damianos Pappas at damianos.pappas@googlemail.com.