Privacy Policy

Last updated: July 11, 2026

Wisettly is a CRM platform for tattoo studios. This policy explains what data we collect, how we use it, and your rights under the GDPR and other applicable privacy laws.

1. Who we are

Wisettly is operated by Morenoaldo AB, a company registered in Sweden. If you have any questions about this policy or your data, contact us at info@wisettly.com.

2. Data we collect

We collect only the data necessary to provide our service:

Account data — email address and password when you create an account.
Studio data — studio name, logo, and configuration settings you provide.
Client data — names, contact details, project details (tattoo idea, placement, size, style, skin tone where the client provides it), reference images, and booking information — added by you or extracted automatically from the messages and booking forms your clients send.
Messages — email conversations synced from your connected Gmail account, and Instagram/Facebook Page messages when a studio routes them to Wisettly (configured through Meta's developer tools).
Booking and payment records — session dates, artist assignments, and deposit records you create, plus payment records created automatically from payment-confirmation emails (for example Stripe receipts) found in your connected mailbox. Wisettly does not process payments and never holds funds: payments are handled entirely by the studio’s own payment provider (for example the studio’s own Stripe account), and Wisettly only stores the record so the studio can track deposits and see who has paid.
Usage data — basic logs to maintain service reliability (no advertising tracking).

3. How we use your data

To provide and operate the Wisettly platform for your studio.
To generate AI-powered summaries, reply drafts, translations, and booking insights using Anthropic's Claude API. Conversation text and client reference images may be included in the data processed by Anthropic. This data is processed solely to generate the requested output for your studio, is not used to train generalized AI or ML models, and is not shared with any other AI platform.
To identify new client inquiries and payment confirmations: Wisettly sends the subject line and a short preview of recent inbox emails to Anthropic for classification; emails classified as unrelated are not imported or stored.
To keep examples of the replies you send so the AI can draft future replies in your studio's own voice. These examples are only used for your studio and are deleted with your account.
To sync messages from Gmail, Instagram, and Facebook on your behalf when you connect those accounts.
To send emails you trigger — replies to clients, booking confirmations, team invitations, and (if you use the campaigns feature) promotional emails to your own clients. Campaign links include an identifier so your studio can see which clients expressed interest.
To maintain security, prevent fraud, and fix technical issues.

We do not sell your data. We do not use your data for advertising.

4. Third-party services

Wisettly uses the following third-party services to operate:

Supabase — database and authentication (servers in the European Union, AWS eu-west-1, Ireland).
Anthropic — AI-generated summaries, reply drafts, translations, and booking insights (Claude API). Email content from your connected Gmail account — including conversation text and client reference images — is sent to Anthropic's Claude API to generate the summaries and drafts shown in your inbox, and short previews of recent inbox emails are sent for classification of new inquiries and payment confirmations. This data is processed under Anthropic's commercial API terms: it is not used to train generalized AI or ML models, is not retained by Anthropic beyond processing, and is never shared with any other AI tool or platform.
Google Gmail API — to read and send email on behalf of studios that connect their Gmail account. Wisettly accesses the mailbox threads relevant to running the studio: threads under the studio's configured label, replies in existing client conversations, new client inquiries identified in the inbox, and payment-confirmation emails. Those conversations and payment records are stored in Wisettly so the studio can work with them. The connected account is also used to send the emails the studio triggers (client replies, booking confirmations, team invitations, campaigns). Disconnecting Gmail from Settings stops Wisettly from using the account; to fully revoke the OAuth grant, also remove Wisettly under Google Account → Security → Third-party access. Conversations already synced remain in your CRM until you delete them or your account, or request their deletion.
Google Calendar API — to keep bookings in sync for studios and artists that connect Google Calendar: Wisettly can read your calendar list and existing events, and create, update, or remove the booking events it manages on the connected calendar (for example when a booking is cancelled). Disconnecting from Settings stops Wisettly from using the calendar; to fully revoke the OAuth grant, also remove Wisettly under Google Account → Security → Third-party access.
Apple Push Notification service — to deliver notifications (new messages, booking and schedule changes, and service alerts) to the Wisettly iPhone app. A device push token and the notification content (which can include client names and message previews) pass through Apple.
Resend — email delivery for studios without a connected Gmail account (message content and recipient address pass through Resend).
Meta (Instagram / Facebook) — to receive and send direct messages when a studio routes its Instagram or Facebook Page messages to Wisettly (configured through Meta's developer tools).
Vercel — hosting and content delivery.

5. Google API Limited Use disclosure

Wisettly's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Wisettly:

Only requests access to Gmail data (read and send), Google Calendar data (calendar list and events, read and write), and the connected Google account's email address (to identify the connection) — and only when explicitly authorized by the studio owner or artist.
Does not use Google user data to serve advertising.
Does not allow humans to read Google user data unless the user has given explicit permission, it is necessary for security purposes, or it is required by law.
Does not share, sell, or transfer Google user data to third parties, except to the sub-processors listed in Section 4 that are strictly necessary to operate the service.
Limits use of Google data to providing or improving the features described in this policy.

6. Data storage and security

Your data is stored in Supabase on servers located within the European Union. All data is encrypted in transit (TLS) and at rest. Database records are isolated per studio and enforced at the database level — each studio can only access its own data. Client reference images are stored at unguessable URLs.

7. International transfers

Some of the sub-processors listed in Section 4 may process data outside the European Economic Area: Anthropic (message text and images sent for AI processing), Apple (push notification content), Meta (social messages), Resend (email delivery), and Google (Gmail and Calendar APIs). Where data leaves the EEA, these transfers rely on the safeguards in each provider's data processing agreement (EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework).

8. Data retention

We retain your data for as long as your account is active. Conversations and records synced from connected accounts remain in your CRM after a disconnect until you delete them or request their deletion. If you delete your account, your data is permanently deleted within 30 days, except where retention is required by law.

9. Your rights (GDPR)

If you are located in the European Economic Area, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate data.
Erasure — request deletion of your data ("right to be forgotten").
Portability — receive your data in a structured, machine-readable format.
Objection — object to certain processing of your data.
Withdraw consent — disconnect Gmail or Google Calendar at any time from Settings (see Section 4 for how to fully revoke the Google grant); Instagram/Facebook routing is removed through Meta's tools or by contacting us.

To exercise any of these rights, email us at info@wisettly.com. We will respond within 30 days.

10. Cookies and local storage

Wisettly stores your login session in your browser's local storage. We do not use tracking or advertising cookies.

11. Children's privacy

Wisettly is intended for use by tattoo studio professionals and their adult clients. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has provided us with personal data, please contact us at info@wisettly.com so we can delete it promptly.

12. Changes to this policy

We may update this policy from time to time. If changes are significant, we will notify active users by email. The date at the top of this page reflects the most recent update.

13. Contact

Questions or requests about this privacy policy:
info@wisettly.com
Morenoaldo AB · Linköping, Sweden