Privacy

Creating an account gets us an email address and a display name. You can also tell us your usual drink and the month and day of your birthday, and neither is required. We do not ask for the year, so what we hold is a date to celebrate rather than a date of birth. Enter a contest, and we keep the artwork, its title, the description and the story you write for it, the name you want credited, how you heard about the contest if you tell us, and a record of which version of the contest terms you accepted and when. Your vote tells us which entry you picked. The workshop application collects whatever you put into it, from your name and contact details to your idea.

Sending Chloe a tattoo idea collects your contact details, idea, placement and size preferences, budget and availability if you give them, optional comfort requests, and reference images or links. We also keep your private conversation, appointment details, shared designs, and design approval history. Medical screening and formal tattoo consent happen separately with Chloe.

Getting in line for one of Chloe's flash events needs a Beanchain account. It keeps the name you give, how many tattoos and the designs you pick, and where on your body if you say, and it uses your account's email. Chloe can note what you paid at the table. You also confirm you are 18 or older. Chloe sees the line and your email so she can tell you when it is your turn. Shop staff do not. Your places in line and the flash tattoos you get stay in your account, under Your tattoos. Once Chloe has tattooed you, you are one of her clients, so her studio shows your flash tattoo and any touch-up you ask for. The Up next board at the table, which anybody can open, shows the line as first names and last initials only.

On the production site, GA4 counts page visits and clicks on things like directions and phone calls. We don't use it to personalize ads, though Google's own cookies are part of how it works.

The home page also loads a script from inKind, which can show a pop-up with an inKind offer. To count how often you have seen it, inKind sets its own cookies here and makes an identifier for your device from details your browser shares, like its screen size, language and time zone. It tells inKind when the pop-up is shown and on which page. Anything you type into the pop-up, like an email address or phone number, goes to inKind.

All of that runs accounts, contests, and voting, and answers workshop applications. Your usual is so the person behind the counter knows what you like. Your birthday is for a free drink. Analytics tells us which pages actually help someone find the shop.

Signing in works by email: we send you a link rather than asking for a password. Changing your email address works the same way, with a link to confirm it.

If you enter a contest, we may email you about your entry: when it arrives, when it has been reviewed, and a few reminders while voting is open. You can turn the reminders off in your account details.

If you apply to sell your work in our marketplace, we may email you about it: when your application has been decided, when a monthly report is coming due or overdue, when we have answered one, when a month's statement is final, when we have paid you, if a payout to you is reversed, and if we remove you from the marketplace.

The birthday email goes only to people who check the box for it. It arrives on the morning of your birthday, about your free drink and nothing else. The box starts unchecked, and you can uncheck it in your account details whenever you want.

We also send emails about the shop, like news and upcoming events. To stop any email from us, write to contact@bchain.coffee and a person will take you off the list.

If you get in line for a flash event, we email you a link to your place, and again when you are almost up, when it is your turn, if your place moves or is given up, if the event ends before your turn, or if the event is cancelled. If Chloe tattoos you and has picked aftercare for that event, we email it to you the next morning. A place in line sends nothing else.

If you book a time at a flash event, we email you a link to your booking, a reminder the day before when you booked at least 12 hours ahead, your new time if Chloe moves it, and the same emails about your turn, a missed turn and a cancelled event. A booking sends nothing else.

Tick Email me when there's a flash tattoo event coming up (on a flash event's sign-up, the tattoo request form, your request's own page, or your account details) and we email you when Chloe announces a flash event. The box starts unticked, like the birthday one. Every one of those emails has a link that stops them, and you can untick the box in your account details.

Tattoo emails tell you when your request arrives, when there is a message or design to review, and about appointment bookings, changes, cancellations, and reminders. Verified accounts authorized to manage Chloe’s studio also receive operational notifications. Emails link to the private workspace without including your message contents or reference images. Use the secure link to read and reply on the site. Tattoo inquiries are measured separately from the shop’s sales leads, without sending form contents to analytics.

Supabase also stores tattoo requests and private images. Chloe, people authorized to manage her tattoo studio, and site admins can access her client records. Shop staff do not get this access automatically. Reference images and shared designs stay private. Only photos Chloe deliberately publishes appear in her portfolio. Private request pages and tattoo staff tools do not load analytics.

Supabase holds accounts, contest entries, and votes. Netlify hosts the site and collects the workshop application form. Resend sends all of our email, so your address passes through them. Google runs sign-in, if you choose to use it, and the analytics. Some of what GA4 measures, like a click to call or get directions, is set up to feed our Google Ads account as a conversion, so Google can learn which visits led somewhere. Cloudflare checks that a sign-in request isn't a bot, through Turnstile.

inKind runs the pop-up on the home page and keeps what you enter into it, under inKind's own privacy policy.

Eventbrite carries some of our free events. If you RSVP there, your name and email go to Eventbrite, and we can see who is coming, because we are the organizer. We don't put those addresses anywhere else.

Our staff tools connect to the shop's own Google account, the one that runs our Google Business Profile and our events calendar. Only a site admin can connect it, and only the shop's account is ever connected. Nobody who visits the site, or signs in to it with Google, is asked for this access.

Through that connection the site posts our events and updates to the Business Profile, keeps the profile's special hours in step with ours, and puts events on the shop's events calendar: it makes them, changes their details and marks them cancelled when a member of staff asks it to. It reads only what those jobs need: which location on the account is the shop, the hours the profile shows, and the events on that one calendar. It does not open anything else in the account.

The key Google gives us for the account is stored encrypted, used only by our own server, and shared with no one. What comes back from Google is used only for those jobs, and never for ads. The shop can take the access back at any time in its Google account settings.

Beanchain Coffee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don't sell your data, and we don't show ads on this site. The inKind pop-up is an offer from a company we work with, not an ad network.

The tattoo intake uses a private cookie for one hour to connect reference uploads to your form. Opening a secure tattoo email link sets a private access cookie for seven days. You can close that email access from your request page. Email links expire after 30 minutes and work once; you can request a fresh link without making an account.

Signing in sets a session cookie, so the site remembers you between pages. It also sets one small cookie holding the name you chose, the letters on your account button, and whether you work here, so a page built before you arrived can still show your account menu. That one leaves your email address out on purpose. Neither is used for anything else. On the production site, analytics cookies come from Google as well, and the home page carries inKind's cookies for its pop-up.

You don't need an account to use this site. Everything public here is readable while you're signed out.

Want your data gone? Email us and a person will delete your account and anything attached to it. There is no automated button yet.

Questions about any of this go to contact@bchain.coffee.