Privacy policy

Version of Oct 22, 2026. This page describes what Kayru actually does with data — it was written from the code, not from a template. If anything here stops being true, the page changes first.

Who we are

Kayru is a service of Eikon (Eikon Marketing LTDA, CNPJ 42.391.768/0001-83), with registered office at Av. Anápolis, n. 2134, Qd. 03, Lt. 01, Sala 103, Vila Concórdia, Goiânia/GO, CEP 74770-270 and customer service at Rua do Saveu, Qd. 21-A, Lt. 04, n. 261, Sobrado 01, Jardim Atlântico, Goiânia/GO, CEP 74343-520. For everything about personal data, including data subject requests and communications from Brazil’s National Data Protection Authority (ANPD), contact contato@kayru.com.br.

Data protection officer (DPO): Julian Magossi, at contato@kayru.com.br, for data subjects and for the ANPD.

Two kinds of person, two roles

Tattoo artist (subscriber): whoever creates a workspace in Kayru. For the account, subscription and billing data, and for the security and access logs, Eikon is the controller: it decides how and why that data is processed.

The artist’s client: whoever fills in the quote form, signs the health form or has a record created by them. The artist is the controller of that data; Eikon is the processor: it processes that data on the artist’s behalf and according to their instructions, only so the service works, and never uses it for any other purpose, nor cross-references it between workspaces.

What we store

From the artist’s account: name and email of the Google account used to sign in (we store no password — sign-in is Google’s), professional name, form address, WhatsApp (if given), time zone, language and the version of the terms accepted.
From the subscription: state, period and trial dates, the Stripe identifiers and the notifications Stripe sends to Kayru (billing events, stored whole for auditing — they contain the billing data Stripe itself keeps, such as amount, currency and the card’s last digits when it includes them). The card number never passes through Kayru — it goes straight to Stripe.
From the workspace (the artist’s data about their clients): client record (name, phone, email, Instagram, date of birth, internal notes), quote requests and the reference photos sent (stored as files on the server, outside the database), opportunities and the stage history, scheduled sessions, follow-up reminders, the message texts the artist wrote as templates and the record that a conversation was opened (not what was exchanged on WhatsApp), financial entries, testimonials sent by clients and support tickets (with screen, browser and version when it is a bug report).
From the health form (sensitive data): at the artist’s request and under their instructions, the form the client fills in and signs: answers about health conditions (sensitive personal data, art. 11 of the LGPD), CPF (Brazilian taxpayer number), date of birth, drawn signature, whether image use is authorised, the text and version of the accepted consent form and the signature trail (date and time, IP address and browser). Answers, CPF and signature are stored encrypted in the database. The form link reaches the client by email, when they have an email on file, or through the WhatsApp conversation opened by the artist. After signing, a client who enters an email on the form itself receives a PDF copy of the form as an attachment, with a verification code; anyone holding that code can check at kayru.ink/verificar that the form exists — and, by uploading the PDF, whether the file is the original (the file is read only for the calculation and is not stored) —, seeing only the studio name, the date and time of signing, the signature mode, the consent form version and the document hash — never the name, CPF or answers of the person who signed.
From the public form: the fields filled in, the campaign parameters from the URL (utm, campaign id) when present, and an anonymous fingerprint of the sender’s network address, used only to limit abuse — the address itself is not stored.
From the optional connections: if the artist connects Google Calendar, Business Profile or Meta Ads, we store the access credential encrypted (with a key kept outside the database), the email or name of the connected account and what each integration brings, described under Integrations, below. Disconnecting deletes the credential immediately.
Technical: server access logs (such as IP address, page requested and time), for 6 months, as required by Brazil’s Internet Civil Framework (Law 12,965/2014, art. 15), and for security and diagnosis. No third-party trackers on the private pages.

What for, in what role and on what legal basis

We do not sell data, we do not advertise with it and we do not use the artists’ clients’ data for anything beyond the artist’s own service. Each use, with the data involved, Eikon’s role, the legal basis and the period:

Creating and maintaining the account and the workspace

Data: those of the artist’s account, listed above.
Eikon’s role: controller.
Legal basis: performance of the contract with the artist (LGPD, art. 7, V).
For how long: as long as the account exists; see workspace deletion, below.

Charging the subscription

Data: those of the subscription, listed above.
Eikon’s role: controller.
Legal basis: performance of the contract and compliance with a legal or regulatory obligation (LGPD, art. 7, II and V).
For how long: as long as the account exists and, afterwards, for the period tax law requires and as needed to defend rights.

Protecting the service, preventing abuse and diagnosing faults

Data: server access logs and the anonymous fingerprint of the network address of whoever sends the public form.
Eikon’s role: controller.
Legal basis: Eikon’s legitimate interest in keeping the service secure and running (LGPD, art. 7, IX).
For how long: access logs for 6 months (Internet Civil Framework, art. 15).

Answering support

Data: the ticket text and, in a bug report, screen, browser and version; a copy goes by email.
Eikon’s role: controller.
Legal basis: performance of the contract with the artist (LGPD, art. 7, V).
For how long: as long as the workspace exists.

Making Kayru work for the artist

Data: those of the workspace and the public form, listed above: clients, requests, photos, calendar, finances, messages, automatic emails to the client and testimonials.
Eikon’s role: processor, on behalf of the artist, who is the controller.
Legal basis: set by the artist, as controller, according to their relationship with each client.
For how long: as long as the workspace exists, or until the artist deletes the record or erases the client inside the product.

Health form

Data: health data, CPF, date of birth, signature, image authorisation and signature trail.
Eikon’s role: processor, on behalf of the artist, who is the controller.
Legal basis: one of the grounds in art. 11 of the LGPD, which the artist, as controller, sets and documents. The form the client signs asks for specific and highlighted consent for the health data; when processing is based on consent, it can be withdrawn, subject to the retention period below.
For how long: the signed form, for 5 years from the signature, even after the client is deleted and the space is removed; see How long, below.

Integrations the artist connects (Google, Meta Ads)

Data: encrypted credentials and the data described under Integrations, below.
Eikon’s role: processor, on behalf of the artist, who is the controller.
Legal basis: for Eikon, performance of the contract with the artist, who requests the connection; for third parties’ data, the basis set by the artist.
For how long: credential deleted on disconnecting; data brought in, as long as the workspace exists.

Ad measurement on the form (Meta Pixel and Conversions API)

Data: those described under Meta Pixel and Conversions API, below.
Eikon’s role: processor, on behalf of the artist, who is the controller.
Legal basis: the visitor’s consent, requested on the form itself (LGPD, art. 7, I).
For how long: Kayru keeps no copy of what it sends to Meta; at Meta, according to Meta’s terms.

Integrations

Google

Sign-in: we receive from Google the name and email of the account used to sign in.

Google Calendar, only if the artist connects it: Kayru reads the calendar list to find the primary one and reads that calendar’s events to show the artist’s availability; of those events it stores only identifier, title, start, end and whether they were removed. It creates, updates and deletes only the events Kayru itself created — the booked sessions, with the client’s name in the title and the session location. The session’s private note does not go to Google.

Business Profile, only if the artist connects it: reviews are read when the screen opens, for display, and are not stored.

Kayru’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. That data is not sold or used for advertising.

Transactional email

Kayru sends emails through Brevo (Sendinblue SAS, France), from the sender avisos@kayru.ink. Recipient, sender, subject and body of the messages pass through it: the emails Kayru sends on the artist’s behalf to their client (health form link, session reminder, aftercare, review request and touch-up — the artist can switch each one off, and the client can opt out through the link in the email itself), the PDF copy of the health form the client signed (with health answers and CPF; it is the data subject’s own document and does not depend on that opt-out), copies of support tickets and billing and end-of-trial notices.

Meta Ads

Only if the artist connects it, and with read-only permission (ads_read): Kayru reads and stores, per campaign and per day, the campaign’s identifier and name, spend, currency, impressions, clicks and leads. It does not create or change ads.

Meta Pixel and Conversions API

Only if the artist switches on their own Pixel, and only on their quote form. In that case, the form shows a banner with Accept and Decline. Only after the visitor accepts does the browser load the Pixel, which records the visit (PageView) and the request submission (Lead), and Kayru’s server sends the same Lead to Meta through the Conversions API, with: hashed phone and email (SHA-256), IP address, browser (user-agent), the _fbc and _fbp identifiers, the form URL and the event identifier. If the visitor declines, nothing goes to Meta. The health form and testimonial pages never load the Pixel.

Who we share with

Providers that process data so Kayru works. Each one receives only what it needs for its role.

Hosting provider: — Hostinger, with server and database in the United States. Application server, database and files: it holds all the data described on this page.
Cloudflare R2: — backup copy of the database, photos and forms, encrypted before it leaves the server. It is stored on Cloudflare’s network.
Dropbox: — second backup copy, encrypted the same way, in the United States.
Stripe: — subscription billing: the artist’s and the payment’s data; the card goes straight to Stripe.
Brevo: — sending of transactional emails: recipient, subject and content of the messages.
Google: — sign-in; Calendar and Business Profile, only if the artist connects them.
Meta: — only if the artist connects or switches them on: reading of Meta Ads and Pixel and Conversions API (with the visitor’s consent), as described under Integrations.

International transfer: Hostinger and Dropbox store data in the United States, Brevo processes data in the European Union, and Cloudflare, Stripe, Google and Meta may process data outside Brazil. These transfers rely on art. 33 of the LGPD, according to each provider’s data processing terms.

For how long

For as long as the space exists. Cancelling the subscription deletes nothing: the tattoo artist can still sign in, read and export for 12 months, and is warned by email before that period ends. After that, the space may be deleted, except for the signed health forms.
Deleting the whole space: at the tattoo artist’s request, at contato@kayru.com.br. Eikon carries out the deletion within 15 days, except for the signed health forms, kept as described below. Backup copies expire on the schedule below.
Erasing a client: the artist does it inside the product, immediately. Name, contacts, notes, request texts, form answers, photos and session notes are removed; amounts and dates remain, without identification, as the business history.
Signed health form: the tattoo artist downloads each form as PDF while the space exists and during the 12 months after the subscription ends. Eikon keeps the signed forms, encrypted, for 5 years from the signature, also after the client is deleted and the space is removed, for the regular exercise of rights in judicial, administrative or arbitration proceedings (LGPD, art. 7, VI, and art. 11, II, d). After the space is removed, a form is only delivered to the tattoo artist who collected it, to the client who signed it, or by order of a competent authority. After the 5 years, the form is deleted.
Integration credentials: deleted on disconnecting.
Server access logs: 6 months, as required by Brazil’s Internet Civil Framework (art. 15). Other technical logs: up to 7 days.
Billing records: for the period tax law requires.
Backup copies: on the server, 14 days. Off the server, encrypted: every copy from the last 14 days, one per day for up to 90 days and one per month for up to 12 months. Deleted data ceases to exist in the copies when the last copy containing it expires. If an old copy has to be restored, client erasures already carried out are applied again.

Your rights (LGPD, the Brazilian data protection law)

Art. 18 of the LGPD guarantees you, as data subject:

confirmation that we process your data;
access to the data;
correction of incomplete, inaccurate or outdated data;
anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
portability of the data to another provider;
deletion of data processed with consent, except where the law provides for retention;
information about whom we share the data with;
information about the possibility of not giving consent and the consequences of refusing;
withdrawal of consent;
objection to processing carried out without consent, when it breaches the LGPD;
petition to the ANPD against whoever processes your data.

How to ask: at contato@kayru.com.br, free of charge. We may ask you to confirm your identity before handing over or deleting data. An artist’s client should preferably go to the artist, who is the controller of their data; if you write to us, we forward the request to the artist and help with the answer.

Export: under Settings, the artist downloads immediately, without asking, a ZIP file with one CSV per table — clients, opportunities and stages, calendar, finances, follow-up reminders, message templates and records, forms and answers, photo metadata, support tickets and testimonials. The health form is left out of the ZIP: it is encrypted, and is read and printed one at a time on the client’s record. Also left out are the photo files, the subscription state, the credentials, the spend read from Meta and the appointments read from Google; these can be requested at contato@kayru.com.br.

Minors

Kayru accounts are only for people aged 18 or over. Kayru’s electronic health form does not accept anyone under 18. If the artist records data of a child or adolescent in other modules, such as the client record or a quote request, they must observe the minor’s best interest, art. 14 of the LGPD and, where required, the consent of a parent or legal guardian.

Security

Each workspace is isolated in the database by a rule of the database itself, not only by the application. Integration credentials and the health form’s answers, CPF and signature are stored encrypted. Backup copies are encrypted before they leave the server. Access is always over HTTPS. There is no Kayru password to leak: sign-in is Google’s.

Security incidents

If a security incident involving personal data occurs, Eikon assesses what happened and the risk, and acts to contain it. It notifies the affected tattoo artist by email within 48 hours of confirming the incident, with what is known so far, and cooperates with them. For clients’ data, the tattoo artist, as controller, notifies the ANPD and the data subjects, within the period set by ANPD regulation when notification is required, with Eikon’s support. For account and subscription data, Eikon notifies. To report an incident: contato@kayru.com.br.

Cookies

What Kayru stores in your browser, by category:

Necessary: the kayru_sessao cookie, which keeps the artist signed in for up to 14 days, and the application’s session cookie, which holds the protection against forged requests (CSRF) and preferences such as language. The product does not work without them.
Display preference: the light or dark theme is kept in the browser’s local storage (localStorage) and does not leave your device; the kayru_cfg_aba cookie remembers, for 30 days, the last tab opened in Settings.
Meta identifiers: only on the quote form of an artist who switched on the Pixel, and only if the visitor accepts, the Pixel may create or read Meta cookies, such as _fbp and _fbc. Declining prevents this. Apart from that case, there are no third-party advertising or analytics cookies on Kayru’s pages.

Changes

If this policy changes in anything that matters, the artist is notified by email before the change takes effect. The date at the top says which version is in force.