Privacy Policy

1. Who we are and what this policy covers

Session is operated by Mitchell Celaya. Our Instagram integration may appear in Meta as “Session.Desk - IG.” Session helps tattoo artists manage inquiries, conversations, intake details, appointments, and deposit tracking. Questions about this policy can be sent to Mitchcelayatattoos@gmail.com.

This policy covers information handled by Session. Artists and studios also make their own decisions about their client relationships and records. Their privacy practices, and those of services such as Instagram, payment processors, and calendar providers, may be covered by separate policies.

2. Information we process

• Setup requests: when online requests are available, we store the name, studio, email, optional phone and message you provide so the Session team can review your inquiry. Please do not include your clients' personal information.
• Support and account requests: account email, user identifier, any linked studio identifier, request reference and timestamps used to handle requests and keep an audit trail. When you delete your account, we delete your account and studio data within 7 days and email you when it's done.
• Account and business details: names, email addresses, phone numbers, business profiles, account settings, services, pricing, and booking preferences supplied by account holders.
• Conversations and intake: messages, timestamps, sender identifiers, reference and placement photos, attachments, tattoo ideas, and other information people submit to an artist through Session or a connected messaging service.
• Google account and calendar data: your name, email address and profile picture when you sign in with Google, and, when an account holder connects Google Calendar, the events and free/busy information on the connected calendar. Section 5 explains exactly how Session uses Google data.
• Instagram connection data: professional account identifiers and usernames, authorization credentials, Instagram-scoped messaging identifiers, and message content and metadata made available through the authorized Instagram integration.
• Booking and payment records: requested dates, appointment details, quotes, deposit amounts, payment status, and transaction identifiers. Payment information entered on a Stripe checkout page is processed by Stripe.
• Connected calendars: connection information, availability, and appointment information used to check or manage bookings when an account holder connects a calendar.
• Technical information: authentication and preference data, request and error logs, usage records, and technical information such as IP addresses or browser details made available to our hosting and service providers.

Information comes from account holders, clients communicating with artists, authorized integrations, and use of the service. Please provide only the information needed for your inquiry or booking.

3. How we use information

We use information to operate accounts, display and organize conversations, collect intake details, assist with replies, follow an artist's booking settings, coordinate appointments, track deposits, and provide support. We also use relevant records to diagnose problems, measure service usage, protect accounts, prevent misuse, and meet applicable legal obligations.

An authorized Instagram connection allows Session to receive and respond to messages for the connected professional account. Artists control the available automatic-reply settings and can take over conversations themselves.

4. AI-assisted messaging

When AI features are used, relevant conversation content, intake information, business instructions, and, where supported, submitted images are sent to an AI service provider to produce replies, summaries, or booking assistance. Session currently uses Anthropic for AI processing. Business preferences and conversation context can be used to tailor the assistance.

AI-generated responses may be sent automatically when the artist enables the applicable features. Artists can review conversations and take over. AI-generated information can be incorrect; contact the artist to clarify appointment, pricing, or other booking details.

5. Google sign-in and Google Calendar

Sign in with Google. If you choose “Continue with Google,” Google shares your name, email address and profile picture with Session. We use them only to create your account, sign you in and show who is signed in. We do not request access to your Gmail, contacts, files or any other Google data for sign-in.

Google Calendar. An account holder can connect their own Google Calendar so Session can book appointments without double-booking them. With the account holder's permission, Session:

• checks free/busy times on the connected calendar so it only offers or confirms appointment times that are open;
• reads events on the connected calendar so they appear in the account holder's Session schedule and block those times;
• creates an event when the account holder confirms a booking, and updates or deletes that event if the appointment is rescheduled or cancelled;
• receives change notifications from Google so changes made in Google Calendar are reflected in Session.

Session only reads and writes the single calendar the account holder connects. Session's AI features receive only whether dates and times are open or unavailable, not the titles or details of calendar events.

Limited Use. Session's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing features described above. We do not sell it, use it for advertising, or use it to train or improve generalized AI or machine-learning models, and people do not read it unless the account holder asks for help with a specific issue, it is needed for security or to comply with the law, or it has been aggregated and anonymized for internal operations.

Storage and disconnecting. Google access credentials are stored on our servers with restricted, service-only access. Disconnecting Google Calendar in Session's calendar settings removes the stored Google credentials and stops change notifications. Appointment records already in Session remain until deleted under Section 9. You can also remove Session's access at any time from your Google Account at myaccount.google.com/permissions.

6. Who receives information

The artist or studio involved in a conversation, its authorized users, and authorized Session personnel may access information needed to manage bookings, provide support, or maintain the service.

Service providers process information needed for their functions. These include Supabase for account and data services, Netlify for hosting, Inngest for background processing, Anthropic for AI features, SendBlue for SMS messaging, Meta for Instagram messaging, Stripe for payments, Google for sign-in and Google Calendar, and calendar providers connected by the account holder.

We may disclose information when required by law, to address fraud or security incidents, to protect legal rights, or at your direction. Third-party services also process information under their own applicable terms and privacy policies.

7. Cookies and browser storage

Session uses cookies and similar browser storage for functions such as authentication, security, and remembering preferences, including the display theme. Browser settings can limit or remove this storage, but doing so may prevent sign-in or affect features.

8. Retention, security, and processing locations

We retain information for as long as needed to provide the service, maintain relevant booking and transaction records, address support or security issues, resolve disputes, and meet legal obligations. The appropriate period depends on the information and its purpose; this policy does not set a single deletion period for every record.

Disconnecting Instagram removes the stored connection credentials from Session. It does not automatically erase conversations, attachments, or booking records already stored in Session. You can request deletion using the process below. Where information remains in backups or must be retained for legal or security reasons, deletion may be subject to those limitations.

We use safeguards such as authenticated access, permission checks, and restricted handling of integration credentials. No online service can guarantee absolute security. Information may be processed in the United States and other locations where our service providers operate.

9. Your choices and privacy requests

Depending on applicable law, you may have rights to access, obtain a copy of, correct, or delete your information, or to object to or limit certain processing. Contact Mitchcelayatattoos@gmail.com to make a request, ask a question, or ask us to reconsider a response. You may also have the right to contact your local privacy regulator.

Account holders can disconnect Instagram in Session's integration settings and can revoke the app's access through the relevant Meta or Instagram account controls. Revoking access does not by itself delete records already held by Session or the artist.

For deletion, follow our data deletion instructions. We may need to verify your identity or authority over the account and coordinate with the relevant artist. We respond within the time required by applicable law and explain any information that must be retained.

10. Children

Session is designed for professional tattoo businesses and their booking inquiries and is not directed to children under 13. If you believe a child has provided personal information through Session, contact us so we can investigate and address it. Artists remain responsible for age and consent requirements for their services.

11. Updates and contact

We may update this policy as our service or practices change. The current version will be posted on this page with its effective date, and additional notice will be provided where required.

For privacy questions or requests, contact Mitchell Celaya at Mitchcelayatattoos@gmail.com.