Last updated: 2026-10-13 · Version 2026-09-10
BookVoya ("we", "us") provides booking and DM-management software for independent tattoo artists ("artists"). This page explains what data we collect, why, and how to control it. If you are in Türkiye, the KVKK Aydınlatma Metni sets out the same processing in Turkish and in the form the KVKK requires; it prevails for you if the two ever differ.
The answer differs depending on whose data it is, and the distinction matters:
| Basis | Used for |
|---|---|
| Performance of a contract | Creating your account and providing the features you use |
| Legal obligation | Invoices, accounting and tax records |
| Establishing or defending a legal claim | The record of which terms version you accepted, and when |
| Legitimate interests | Security, abuse prevention, and improving the service — balanced against your rights, which is why measurement is anonymous |
| Consent | Connecting an Instagram account, and turning on AI-assisted drafting. Both are optional and can be withdrawn at any time. |
Data is stored in a database on our hosting infrastructure in Germany, reached only over encrypted connections. Passwords are stored only as salted hashes. Instagram access tokens are encrypted at rest (AES-256-GCM) and are never displayed in plain text. Access to artist data is scoped per-artist and enforced on the server — one artist cannot see another's data. The database and uploaded files are backed up daily, keeping 14 rolling copies.
Because our servers are in Germany, storing your data there is a transfer abroad for users in Türkiye. It is made on the basis that it is necessary to perform our contract with you and, where required, your explicit consent.
Only the infrastructure providers needed to run the service, each listed with its role and current status at Subprocessors. We do not use any external analytics provider, advertising network, tracking pixel, or data broker.
| Data | Kept for |
|---|---|
| Account and settings | While the account is active; deleted within 30 days of a deletion request |
| Client booking records | While your account is active; deleted with it |
| Instagram access token | Deleted immediately when you disconnect |
| Instagram message records | While connected; deleted on disconnect or account deletion |
| Terms acceptance record | For the life of the account and the limitation period afterwards (10 years) |
| Invoices and accounting records | 5 years, where a payment was made (tax law) |
| Support correspondence | 2 years after the request is closed |
| Anonymous measurement events | 12 months |
| Backups | 14 rolling copies; deleted data ages out with that cycle |
Artists can disconnect their Instagram account at any time from the BookVoya dashboard, which deletes the stored access token immediately. To request full deletion of your account and associated data, see our Data Deletion page.
You also have the right to ask what we hold, to have it corrected, to object to processing based on legitimate interests, to receive a copy in a portable format, and to withdraw a consent you gave. Email privacy@bookvoya.com and we answer within 30 days. If you are in Türkiye, the formal application route and your KVKK Article 11 rights are set out in the KVKK Aydınlatma Metni; you may also complain to the Kişisel Verileri Koruma Kurulu.
Each version of this policy carries a version identifier, shown at the top. If we make a change that materially affects your rights we give notice and, where required, ask you to accept the new version.
Questions about this policy: privacy@bookvoya.com
Everything else, plus our postal address and phone: Contact & Support