Effective date: August 14, 2026
Contents
This Privacy Policy explains how Slip Technologies LLC ("SLIP," "we," "us," or "our") handles personal information in connection with the SLIP check-in, digital waiver, and payment-collection platform, including the marketing site at myslip.app, the staff dashboard, and the client check-in kiosk (the "Service"). It works alongside our Terms of Service.
Two very different groups of people show up in SLIP, and the rules are not the same for each. Find yourself below before reading on.
You run or work at a studio that uses SLIP. You created an account, or someone at your studio created one for you. Parts 1–10 are about you, and we are the business responsible for your information.
You got a tattoo or piercing and filled out a form on a tablet. You do not have a SLIP account — you gave your information to a studio, and SLIP is the software that studio uses to store it. Section 11 is written for you, and it is short.
SLIP handles two distinct categories of information, and the difference decides who is accountable for what.
| Category | Whose information | Our role |
|---|---|---|
| Account & site data | Studio owners, artists, staff, and visitors to myslip.app | We are the business (a "controller"). We decide what is collected and why, and this policy governs it. |
| Client Data | People who check in at a studio — waivers, signatures, health screening answers, contact details | We are a service provider (a "processor") acting only on that studio's written instructions under Section 6 of our Terms. The studio is the business responsible for it. |
In plain terms: we built the filing cabinet and we keep it locked, but the studio decides what goes in it, who may open it, and when it is emptied. We do not use Client Data for our own purposes — not to market to clients, not to build profiles, not to train models, and not to sell to anyone.
Everything below is collected either because you typed it in or because it is a necessary byproduct of running the Service. We collect no personal information from data brokers or public records.
| Category | What it actually is | Why we collect it | Source |
|---|---|---|---|
| Identifiers | Your name, email address, username, and studio name | To create and secure your account, to contact you about the Service, and to send password resets | You |
| Account credentials | A hashed password — never the password itself — and password-reset tokens, also stored hashed | To authenticate you | You |
| Professional information | Your role (artist, piercer, admin), commission percentages, and your e-signature if you add one | To run the staff dashboard, split payments correctly, and produce earnings reports | You or your studio's admin |
| Lead information | Name, email, and optional studio name, if you submit the "Get Started" form | To reply to your enquiry about SLIP | You |
| Commercial information | Your subscription plan, billing status, and transaction records for payments processed through your studio | To bill you and to give you revenue analytics | You and Stripe |
| Internet activity | On marketing pages only: pages viewed, buttons clicked, approximate region, browser and device type | To measure whether the landing page works — how many readers try the demo or request access | Automatic (see below) |
| Technical logs | IP address, request paths, timestamps, and error diagnostics | To keep the Service running, rate-limit abuse, and debug failures | Automatic |
We use PostHog for product analytics, and it runs on the marketing pages (/, /pricing, /terms) and nowhere else. There is no client-side analytics or third-party JavaScript on the kiosk, the pre-check-in screens, or the staff dashboard — the pages where personal information is actually entered and displayed. That is not a policy promise we ask you to take on faith; it is enforced in three independent places in our codebase, including a Content-Security-Policy header that makes it technically impossible for those pages to contact an analytics endpoint at all.
Where analytics do run, session recording, surveys, and heatmaps are switched off, anonymous readers are not given stored profiles, and we honor your browser's Do Not Track setting. Our error-monitoring tool (Sentry) is configured never to capture request bodies, cookies, or IP addresses, so the contents of a check-in form cannot end up in an error report.
We do not use advertising pixels, retargeting tags, or ad-network trackers of any kind.
We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not profile you for advertising.
We disclose personal information only to vendors who help us run the Service, each under a written contract that limits them to that purpose. We do not authorize any of them to use it for their own purposes.
| Vendor | What it does for us | What it can see |
|---|---|---|
| Render | Application hosting | Traffic and application logs |
| Supabase | Managed Postgres database | Stored data, encrypted at rest |
| Stripe | Processing the payments your studio takes from clients (Stripe Connect), and subscription billing where your Account is billed through Stripe | Billing details and payment records. Card numbers are entered on Stripe's own hosted pages and never reach SLIP's servers or database. |
| PostHog | Marketing-site analytics | Marketing page events only |
| Sentry | Error monitoring | Stack traces, configured to exclude request bodies and IP addresses |
| Email delivery | Transactional email (password resets, aftercare instructions, reports) | Recipient address and message contents |
We may also disclose personal information when required by law, to respond to a valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets — in which case we will notify you before your information becomes subject to a different privacy policy.
We have never sold personal information, and we do not "share" it for cross-context behavioral advertising as California defines that term. We run no advertising pixels and no ad-network integrations, so there is nothing for a "Do Not Sell or Share My Personal Information" link to switch off. If that ever changes, we will add the link, update this policy, and honor Global Privacy Control signals before we begin.
This applies to Client Data absolutely: a studio's client records are never sold, shared, licensed, or used for our own marketing under any circumstances.
| Category | Retention period |
|---|---|
| Account and professional information | For as long as your account is active, then deleted within 90 days of account closure |
| Client Data (waivers, screening answers, client records) | Controlled by your studio for as long as its account is active. After cancellation we retain it for 90 days so you can export or reactivate, then delete it. See the note below. |
| Billing and transaction records | Up to 7 years, as tax and accounting rules require |
| Lead form submissions | 24 months from submission, or until you ask us to delete them |
| Marketing analytics events | 12 months |
| Technical and error logs | 90 days |
| Backups | Deleted data persists in encrypted backups for up to 30 days after deletion, then ages out |
Studios: this is your responsibility to get right. Many states require body-art consent and health screening records to be retained for a set number of years — commonly three to seven, but the rule is set by your state or county health authority, not by us. Our 90-day post-cancellation window is a grace period for you to export your records, not a substitute for your own retention obligations. Export your data before you cancel.
California's CPRA sets the most detailed standard in the United States, and by its own thresholds it does not currently apply to SLIP — we are well under the revenue and consumer-count triggers, and we do not sell data. We are telling you that rather than implying otherwise, and then extending the rights anyway.
We honor the rights below for everyone who uses SLIP, in any state or country. You do not need to tell us where you live, and we will not ask you to prove it.
You may use an authorized agent to make a request on your behalf; we will ask for proof of their authority.
Email info@myslip.app with what you want us to do. There is no form to fill in and no account required.
We will:
We will verify your identity before acting — typically by confirming you control the email address on the account, and for deletion requests by a second confirmation. We ask for no more information than we need to be confident it is you, and we do not retain what you send us for verification beyond the life of the request.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information, we will notify you and any required authority within the timeframes the law sets.
For clients
This section is for you if you filled out a waiver on a tablet at a tattoo or piercing studio.
The studio — not SLIP — is responsible for your information. You gave it to them; we are the software they use to hold it securely. We do not use it for our own purposes, we do not market to you, and we do not sell it.
What the studio's copy of SLIP holds about you: your name, contact details, and date of birth; your address; your physician's name and address if the studio asks for it; your yes/no answers to health screening questions; your signature on the waiver; any photos the studio uploads to your record; and a record of what you paid.
To see, correct, or delete your information, contact the studio directly. They control the record and can act on it immediately. We cannot delete a studio's client record on a client's request — doing so unilaterally would destroy a consent document the studio may be legally required to keep. If you have contacted your studio and cannot get a response, email us at info@myslip.app and we will help you reach them.
What we can tell you now: your information is encrypted, it is never sold or shared, no advertising or analytics trackers run on the check-in screens you used, and your health screening answers are visible only to staff at the studio you visited.
The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16 for our own purposes. SLIP accounts require you to be at least 18.
Some studios lawfully serve minors with parental consent, in which case a minor's information may appear in that studio's client records. That collection is the studio's responsibility under the laws of its state, and Section 11 applies — contact the studio. We never sell or share the personal information of consumers under 16, in any circumstances.
We will update the effective date at the top when this policy changes. For material changes — a new category of information, a new purpose, or any change to Section 6 — we will email account holders at least 30 days in advance. Continuing to use the Service after a change takes effect means you accept the updated policy.
Privacy questions, requests, and complaints all go to the same place:
If you are a California resident and are unsatisfied with our response, you may contact the California Privacy Protection Agency. If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority.