Seraph is a one person business in Alberta. Alberta privacy law applies to us in full, and this page is how we meet it.
Seraph is operated by Johnothan Andres, carrying on business as Seraph, a sole proprietorship registered in Alberta. Canada Business Number 704900034.
Being a one person business changes nothing about the duties we owe you, and we do not treat it as though it does.
Your privacy contact
Johnothan Andres, Privacy Officer · [email protected]
Your studio is responsible for its own records of you. We are responsible for the link that recognises you as the same person if you book at more than one studio.
A studio’s client records. The studio is responsible for its own records of you. Seraph handles that information on the studio’s behalf, and only to run its bookings, messaging, and payments.
Seraph’s own account holders. Studio owners, artists, managers, and visitors to this website. Seraph is responsible, and this policy governs.
The link between studios. We identify clients by phone number, so if you book at two studios we recognise you as the same person. That is our decision rather than any studio’s, so we answer for it.
What it does not mean: a studio cannot see another studio’s clients, bookings, notes, or history. Cross studio visibility is blocked in the software deliberately. Showing one shop’s client history to another would be showing it to a competitor.
Both of us are answerable for your information at the same time. We do not treat handling data on a studio’s behalf as a reason we are off the hook for it.
Almost everything here is collected because Alberta health law requires it, or because a retention rule depends on it. Nothing is collected in case it turns out useful later.
- Name and contact details
- Alberta health law requires your studio to keep a record of who was tattooed and how to reach them.
- Date, description, artist
- The same health record: what was done, when, and by whom.
- Date of birth
- Sets how long your records are kept, and confirms you are old enough to be tattooed. Nothing else.
- Health and allergy notes
- Your safety. Sensitive, and held to a higher standard than the rest.
- Signed consent records
- Evidence of what you agreed to, and the exact wording you agreed to.
- Photographs
- Only where you consent, and only for the surfaces you chose.
- Bookings and payments
- Running the booking and taking deposits.
- Messages and delivery status
- Sending reminders, and proving they were sent.
We do not sell personal information. We do not use client data to train models. We do not run advertising on it.
We measure how the product is used with totals only. Nothing in our analytics identifies you.
We look at totals, not at people. Our analytics hold counts such as how many bookings were made in a month, with nothing that ties a row back to you.
Where a total would be small enough to point at one person, we suppress it rather than publish it.
If we ever wanted to analyse information that could identify you, we would ask first.
Our systems run on United States infrastructure, so that is where your information is processed.
- Google (Firebase)
- Hosting, database, sign in. United States.
- Stripe
- Payments. United States.
- Twilio
- Text messages. United States.
- Resend
- Email. United States.
These providers operate on United States infrastructure, so your information is subject to United States law while it is being processed there. We protect it with the same safeguards described in section 7, and we require each provider to protect it to a comparable standard by contract.
Questions about this can go to [email protected].
Two years minimum because health law says so, ten years for a signed consent, and if you were under 18 when you were tattooed, until you turn 28.
- Your service record
- At least 2 years. Alberta health law sets this, and it applies to every tattoo.
- Signed consent, adult
- 10 years. That is how long a claim can be brought, so the signed consent is kept for as long as it could be needed.
- Signed consent, under 18 at the time
- Until you turn 28. The clock does not start until you are 18, so this is the same date whether you were 14 or 17 at the time.
- Tax and financial records
- 6 years. Canada Revenue Agency.
At the end of a period we either destroy the record or strip it of anything identifying. The schedule is a ceiling as well as a floor: keeping records longer than we need is itself a breach, so we do not.
Encrypted in transit and at rest, with access limited to the people who need it and a record of who looked at what.
Your information is encrypted both while it travels and while it is stored. Access is limited by role, so someone who does not need a record cannot open it. Each studio is isolated from every other, so one shop’s data is never reachable from another’s.
Access to sensitive records is logged. Health details and signed consent are held to the strictest standard we apply, because they are the most sensitive things in the system.
Security is covered in more detail on our security page.
Get a copy of your information, have it corrected, withdraw a consent, or ask us to delete what we are not required to keep.
Access. Ask for a copy of your personal information, and for information about how it has been used and disclosed.
Correction. Ask us to correct an error or omission.
Withdraw consent. At any time, on reasonable notice. We then stop using the information for that purpose. Withdrawal is not retroactive, and it does not override a record we are legally required to keep.
Deletion. Ask and we will, subject to the retention rules in section 6. Where a record must be kept, we strip the identifying anchor so what remains cannot be traced to you, and we show you exactly what is deleted and what is kept before we proceed.
Alberta privacy law gives you the right to see your information and to have it corrected. It does not give a general right to have it erased, but we offer deletion anyway. The only limit is the records we are legally required to keep, listed in section 6.
To exercise any of these
Email [email protected]. We respond within 45 days, which is the deadline Alberta sets.
Appointment messages are part of the service and always send. Marketing only goes to people who ticked a box that was not pre ticked.
Confirmations, reminders, deposit requests, and receipts are part of the service you booked. Canadian anti spam law exempts them from the consent requirement for exactly that reason.
Marketing is separate. It goes only to people who gave express consent through an unchecked box, recorded with the date and the exact wording shown. You can withdraw it at any time.
Every automated message, transactional or marketing, says who sent it, on whose behalf, how to reach us, and how to stop receiving them. The consent exemption removes only the consent requirement. The identification and unsubscribe requirements still apply, and we meet them. Unsubscribes take effect immediately, well inside the ten business days the law allows.
Stop receiving messages
Reply STOP to any text, use the unsubscribe link in any email, or go to seraph.ink/unsubscribe.
If a breach could seriously harm you, we tell you and the regulator.
If a breach of your information creates a real risk of significant harm, we notify the Alberta privacy regulator and the people affected, as the law requires.
You must be 18 to book through Seraph. That is our policy, not the law, and we will not tell an artist otherwise.
The platform requires clients to be 18 or older. This is our policy and each studio’s policy. Alberta sets no minimum age to be tattooed. We will not tell an artist the law requires one when it does not. Municipal bylaws may differ.
Where a person under 18 does appear in a record, Alberta applies a maturity test rather than an age cutoff, so a young person capable of understanding may exercise their own privacy rights. We do not assume a parent controls a minor’s information.
Email us and we will help.
Start here
Johnothan Andres, Privacy Officer · [email protected]
If this policy changes, the new version is posted here with an updated date.