This policy covers the Sparkle Studio web application and mobile apps (the “Service”) and this website, sparklestudio.me. It is written in plain language on purpose. If something here is unclear, ask us.
1. Who we are
The Service is operated by Sparkle Studio LLC, an Arizona limited liability company. You can reach us at support@sparklestudio.me.
2. Two kinds of people
Sparkle Studio is software for small businesses built on custom work - tattoo and permanent make-up studios, hair and bridal, cake makers and event planners, jewelry makers, wrap and restoration shops, florists, and custom artists - and the people who work in them. This policy calls each such business a “studio”. That means we handle information about two kinds of people:
- Studio users — owners, team members, apprentices and front-desk staff who sign in to the Service. They are our customers. A studio may be one person or have many employees; we’re built to scale as your business does.
- Clients of those studios — the people a studio books and does work for. A studio enters and receives information about its clients in the Service. Clients do not have accounts with us.
If you are a client, the studio or the person whose account holds your record is the one that collected your information and decides how it is used. Sparkle Studio processes it on that studio’s behalf and under its instructions. Questions about your record can go to the studio or to us; we will route them to the right place.
3. What we collect
From studio users
- Account details: name, email address, the studio or studios you belong to, your role, and your sign-in activity.
- What you enter while using the Service.
- Technical logs: IP address, browser or app version, device type, and the actions you take, which we keep for security and support.
About clients, as entered by a studio
- Contact details: name, phone number, email address, preferred language.
- Project and appointment records: the work being discussed or done, reference photos and specifications, quotes, deposit status, appointment or delivery dates, notes.
- Intake forms, waivers, consent forms and approvals, which for some services (body art, for instance) may include health information a studio needs before the work (allergies, medications or conditions that affect healing), and a record of which version of a form was signed and when.
- Identity checks a studio performs, such as confirming an ID document. Where the Service records an ID, it keeps only what the studio’s record-keeping rules require.
- Messages: text messages, emails and Instagram direct messages exchanged between a studio and its clients through the Service, including attachments.
From connected services
- Google Calendar, when a provider connects it: the events the Service creates and reads in a dedicated calendar (see section 7).
- Instagram, when a studio or someone working in one connects a professional account: the account’s identifier and username, and the direct messages sent to and from it (see section 8).
- Twilio and SendGrid, which carry the Service’s text messages and emails and report whether each was delivered.
On this website
This website uses Google Analytics to count visits and see which pages are read. Google Analytics sets cookies (their names begin with _ga) to recognize a returning browser, and sends Google the pages you view, your approximate location, and your browser and device type. We have turned off Google’s advertising features and signals, we do not combine this with anything that identifies you, and Google Analytics does not log or store IP addresses. Google describes its handling of this data in its privacy policy; its opt-out browser add-on stops the collection, as does blocking cookies for this site. Our hosting provider keeps ordinary server logs. The Service itself sets only the cookies it needs to keep you signed in.
4. How we use it
- To run the studio’s operations in the Service: inquiries, projects, quotes, deposit readiness, scheduling, forms and agreements, messaging and reminders.
- To send the messages a studio asks us to send to its clients, in English or Spanish.
- To keep the Service secure, to support you, and to keep the records the law or a studio’s own policies require.
- To improve the Service, using aggregate information that does not identify anyone.
We do not sell personal information. We do not use it for advertising. We do not use client information to market to clients.
6. Text messages
Studios use the Service to text their clients: appointment reminders, deposit and quote updates, links to forms and approvals, and follow-up check-ins. A client is texted only after agreeing to it with the studio. Replying STOP to any message ends texts from that studio through the Service; replying HELP returns contact information. The full program description is on the SMS program page.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with the subcontractors that deliver the messages, such as Twilio, is limited to what delivery requires.
7. Google user data
A provider can connect a Google account so that the Service creates a dedicated “Sparkle” calendar and writes their appointments to it, and reads those events back to keep the two in step. The Service requests access to calendar events and to create a calendar. It does not read other calendars, contacts, mail or files. Disconnecting in the Service revokes the access token and deletes it from our systems.
Sparkle Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Instagram data
A studio, or a person working in one, can connect an Instagram professional account so that direct messages sent to it appear in the Service’s inbox and can be answered from there. For a connected account we hold its Instagram identifier and username, the messages and attachments exchanged with it, and the identifiers Instagram attaches to them. We use this data only to show and send those messages inside the Service; we do not use it for advertising or share it beyond the providers in section 5.
Disconnecting an account in the Service, or removing Sparkle Studio from your Instagram account’s connected apps, revokes and deletes the access token and clears the account identifiers. Messages already received stay in the studio’s records as part of its client history. How to ask for more is on the data deletion page.
9. Security
The Service is built with HIPAA-aligned technical safeguards even though, today, Sparkle Studio is not a HIPAA covered entity and does not offer a business associate agreement:
- Encryption in transit and at rest, with the tokens and secrets of connected services sealed with their own keys.
- Least-access roles: each studio user sees only what their role allows, and the database enforces the separation between studios.
- An append-only audit trail of every edit and of every view of sensitive records.
- Identity checks and consent forms kept to what a studio’s record-keeping requires.
No system is perfectly secure. If we learn of a breach affecting your information, we will tell the affected studio and, where the law requires, you.
10. How long we keep it
We keep a studio’s records for as long as its account is active and for as long as its own record-keeping obligations require afterwards. Client records, consent forms and messages are part of a studio’s business records; a studio can export them at any time and can ask us to delete them when they are no longer needed. Technical logs are kept for a limited period for security. Retention periods for identity checks and conversation history are being set with counsel and will be stated here.
11. Your choices
- Clients: ask the studio you dealt with to see, correct or delete your record, or write to us and we will route the request. Reply STOP to stop texts.
- Studio users: update your details in the Service; a studio owner can close the studio’s account and export its data first.
- Connected services: disconnect Google Calendar or Instagram in the Service at any time.
- Deletion: see the data deletion page.
Where state law gives you additional rights over your personal information, you can exercise them by contacting us; we will not treat you differently for doing so.
12. Children
The Service and this website are not directed at anyone under 18. Studios are responsible for the age and consent requirements of the services they provide.
13. Changes
We will update this policy as the Service changes and when counsel completes its review. The date at the top is the date of the current version. Material changes will be announced in the Service.