LegalPrivacy Policy.

SKINGRAPHICA PTY LTD (ACN 684 257 261, ABN 54 684 257 261) is responsible for your personal information. Under the GDPR and UK GDPR we are the controller. Our registered office is The Trust Building, Suite 703, Level 7, 155 King Street, Sydney NSW 2000, Australia.

For any privacy question or request, email policies@skangraphica.com. Please put “Privacy” in the subject line.

• EU representative. Personal Care Regulatory Ltd., Digital Office Centre, Swords, Dublin, K67 E5AO, Ireland.
• UK representative. Personal Care Regulatory Ltd., St. John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.
• Person in charge of the protection of personal information (Quebec). Our Privacy Officer, contactable at policies@skangraphica.com.

You are in control of how we use your information for marketing and tracking. These are your main choices.

• Cookies and tracking. Use the Your privacy choices link in the footer of every page to accept or reject analytics and marketing cookies, or to change your mind at any time. Where the law requires consent, including in the European Union, the United Kingdom and Switzerland, we do not use these cookies until you agree.
• Opt out of sale, sharing and targeted advertising. Use the same Your privacy choices link. We also treat a Global Privacy Control signal sent by your browser as a valid request to opt out for that browser.
• Email and SMS marketing. Unsubscribe using the link in any marketing email, reply STOP to any marketing text or email policies@skangraphica.com.
• Ink-Profiler™. Answering is optional. You can withdraw your consent and ask us to delete your answers at any time.
• Public profiles. Ranked artists and Hall of Fame members can ask us to correct their public profile or, in the cases explained in clause 15, to remove it.
• Your rights. You can ask to access, correct or delete your information and exercise the other rights described in clause 22 by emailing policies@skangraphica.com.

The information we collect depends on how you interact with us. It may include the following.

• Identity and contact details such as your name, email address, phone number and delivery and billing addresses.
• Order and transaction information such as the products you buy, prices, discounts, gift card use, delivery details and returns. Payments are processed by Shopify Payments and other payment providers. We do not receive or store your full card number.
• Account information such as your login, order history, saved addresses and preferences.
• Delivery and customs information needed by Zonos and FedEx to calculate duties and taxes, clear customs and deliver your order.
• Communications such as emails and messages you send our concierge, details of appointments you book with us through Calendly and notes from video appointments with the concierge. We do not record video appointments.
• Marketing preferences including whether you have subscribed to emails or texts and how you interact with our messages.
• Reviews including your rating, comments, display name and any photos you upload.
• Gift card details including the purchaser’s and recipient’s names and email addresses and any personal message.
• Care planner details such as the date of your next tattoo appointment and your email address.
• Ink-Profiler™ answers about your skin and tattoos, which may include information about your health. See clause 5.
• Program submissions such as photos of your tattoos submitted to STATUS, the name of your artist or studio and any information in the photo or its metadata.
• Artist and studio information for the rankings and our programs. See clause 15.
• Device and usage information such as your IP address, approximate location derived from it, browser and device type, pages viewed, clicks, scrolling and the referring website, collected through cookies and similar technologies. See clause 10.
• Social media information when you interact with our profiles on Instagram, TikTok, YouTube, Pinterest, Facebook or X, such as your handle and public comments.

You do not have to give us your personal information, but if you do not we may be unable to process an order, answer a question or let you take part in a program. You can browse the Site without telling us who you are.

• Directly from you when you place an order, create an account, subscribe, write a review, book an appointment, use the care planner or Ink-Profiler™, submit a photo or apply to a program, including through forms provided by Tally or Shopify.
• Automatically through cookies, pixels and similar technologies when you use the Site and open our emails.
• From third parties including Shopify, payment and buy now pay later providers such as Afterpay and Klarna, Zonos, FedEx, Okendo and social media platforms.
• From public sources and our inspectors for the Global Artist Rankings. See clause 15.
• From other people such as a friend who buys you a gift card or a client who names you as their artist.

The Ink-Profiler™ tool asks questions about your skin and your tattoos so it can suggest suitable products. Some answers, such as skin sensitivity, allergies or skin conditions, may be health information. Health information is sensitive information under Australian law and data concerning health under the GDPR and UK GDPR. It may also be consumer health data or sensitive personal information under some United States state laws.

Because of this, we handle Ink-Profiler™ answers with extra care.

• Your answers are processed in your own browser to show your result. They are not sent to us and we do not store them.
• Answering is optional and you can still shop without using the tool.
• If you choose to share your profile or results with our concierge, we use them only to answer your question. We keep them for 24 months after your last contact with us, unless you ask us to delete them sooner by emailing policies@skangraphica.com.
• We never use Ink-Profiler™ answers for advertising and we never sell them. Analytics and replay tools are switched off on the tool, so your answers are never recorded.

Photos of tattoos and the details you share with our concierge may also reveal sensitive information, for example about your health, beliefs or associations. We use them only for the purpose you gave them to us and we never use them to make assumptions about you.

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy explains your additional rights.

• To process, deliver and support your orders, including payment, fraud checks, customs clearance and returns.
• To create and manage your account.
• To provide concierge advice and manage appointments.
• To send care reminders after a purchase and, if you use the care planner, stage by stage reminders before and after your appointment.
• To provide Ink-Profiler™ product suggestions with your consent.
• To send marketing by email or text where you have agreed or where the law otherwise allows, and to measure how our messages perform.
• To publish and moderate reviews.
• To issue, deliver and redeem gift cards.
• To run the STATUS program, the Hall of Fame, the Global Artist Rankings, Featured Artists, the GRAPHICA Program, the Studio Partner Program and Signature Studios, including calculating and paying referral commissions and preparing letters for ranked artists.
• To understand how the Site is used and improve it, including through analytics, heatmaps and replays of how pages are used.
• To keep the Site, our customers and our business secure and to detect and prevent fraud.
• To comply with our legal obligations, such as tax and consumer law, and to establish, exercise or defend legal claims.

We will not use your information for a purpose that is unrelated to these purposes unless you agree or the law permits it.

If the GDPR or UK GDPR applies to you, we rely on the following legal bases.

• Contract. To process orders, deliver products, manage your account, issue gift cards and run programs you join.
• Legal obligation. To keep tax and accounting records, respond to lawful requests and meet consumer law obligations.
• Legitimate interests. To prevent fraud, secure the Site, improve our products and services, moderate reviews, send care reminders that relate to a purchase, publish the Global Artist Rankings and keep business records. We balance these interests against your rights and you can object at any time.
• Consent. For marketing emails and texts where consent is required, non essential cookies including analytics and replay tools and the publication of your submitted photos where consent is the appropriate basis.
• Explicit consent. For Ink-Profiler™ answers and any other health information.

If you use the care planner, we use the appointment date and email address you give us to send stage by stage reminders by email through Klaviyo. We also send care reminders after you buy a product to help you use it as intended. These reminders are about products you have chosen. Each one includes a link to stop receiving them.

We keep your care planner details until 12 months after the last reminder is sent, unless you ask us to delete them sooner.

We send marketing emails through Klaviyo, including our newsletter, welcome messages and reminders about items left in your checkout. We only send marketing where you have subscribed or where the law otherwise permits, for example under the Spam Act 2003 (Cth) in Australia. In the European Union and the United Kingdom we send checkout reminders only where you have agreed to receive marketing.

Every marketing email identifies SKINGRAPHICA and contains a working unsubscribe link. We action unsubscribe requests within 5 business days.

SMS. We may offer marketing by text message. We will only send marketing texts if you have given your express consent by subscribing to them. If you subscribe to texts, you agree to receive recurring automated marketing messages at the number you give us. Consent is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. We do not share mobile numbers or SMS consent with third parties for their own marketing.

Our Site uses cookies, pixels and similar technologies. We group them as follows.

• Strictly necessary. Needed for the Site to work, such as keeping items in your cart, checkout, security, fraud prevention and remembering your privacy choices. These cannot be switched off.
• Preferences. Remember choices such as your country and currency.
• Analytics. Help us understand how the Site is used. We use Shopify analytics and Microsoft Clarity. Clarity creates heatmaps and replays that show how visitors move through, click on and scroll pages. We configure Clarity to mask text you type into forms and other sensitive content, so it is not captured. Clarity is switched off entirely on our Ink-Profiler™ tool, so your answers there are never recorded.
• Marketing. Used to measure and personalise advertising, including on social media platforms. We use the Meta pixel and Google tags, including Google Analytics and Google Ads conversion measurement. They tell these platforms which pages you view and what you buy, so we can measure our advertising and show you relevant ads on their services.

We use Shopify’s customer privacy banner to collect your choices. Where the law requires consent, analytics and marketing cookies are off until you agree. Elsewhere you can turn them off at any time through Your privacy choices. You can also block or delete cookies in your browser, although some parts of the Site may not work properly.

Microsoft retains Clarity recordings for up to 30 days and other Clarity data for up to 13 months.

Reviews are collected and published through Okendo. When you write a review we publish your rating, comments, display name and any photos you add, and we may show that you are a verified buyer. We may send you an email inviting you to review a product you bought. You can ask us to remove your review at any time by emailing policies@skangraphica.com.

Gift cards are issued through Shopify. When you buy a gift card we collect your name, email address and payment details and, if you send it to someone else, the recipient’s name, email address, your message and the delivery date you choose, so the card can be delivered and redeemed. We use the recipient’s details only to deliver the card and manage its balance, and we do not add the recipient to our marketing unless they subscribe.

When you contact our concierge by email or book a video appointment through Calendly, we use your details and the information you share to answer your questions and give you general product advice. Our email and productivity systems are provided by Microsoft. Concierge advice is general information and not medical advice. Please do not send us more health information than you need to.

When you submit a photo to STATUS we use it, your details and the artist details you provide to assess your submission, manage your membership tier and benefits, and, if you are inducted, feature you in the Hall of Fame. Our assessment may use automated tools to help detect images generated or altered by artificial intelligence, and we may contact the artist named to confirm the work. A member of our team makes the final decision on every submission.

Hall of Fame features and other published submissions may show your photo, your first name or chosen display name and the artist and studio credited. You can ask us to remove a published photo at any time, as explained in our Terms of Service.

We publish the Global Artist Rankings (Black Ivy, GRAPHICA and NOVA) and run programs for artists and studios. For these purposes we collect and use the following information about tattoo artists and studio owners.

• Public profile information such as name, studio, city, styles, Instagram handle and published work, collected from public sources such as Instagram, studio websites and media coverage.
• Inspector assessments made by our anonymous inspectors against our published criteria and the citations we write.
• Program information such as applications, contact details, payment and tax details for referral commissions and records of referrals.
• Letter requests containing the information an artist gives us so we can prepare a letter confirming their ranking.

Each ranked artist has a public profile showing their name, studio, city, styles, Instagram handle and citation. We publish the rankings as editorial content in our legitimate interest, and in the public interest in independent commentary on the art of tattooing. Places are never for sale.

Ranked artists can ask us at any time to correct or update factual information in their profile. Artists may also object to their profile being published. We will consider every objection carefully, and where the law gives you the right to have your information removed we will remove it. We keep inspector identities confidential so that assessments remain independent.

If you are an artist who has applied to or joined a program, we use your information to run that program and to pay you. We share commission details only with our payment and accounting providers and professional advisers.

We share personal information only as needed for the purposes in this policy. We require our service providers to protect it and to use it only to provide services to us. The types of recipients are as follows.

• Ecommerce platform and site tools such as Shopify (store, accounts, checkout and privacy banner), Locksmith (access control for parts of the Site) and form providers such as Tally.
• Payment providers such as Shopify Payments, digital wallet providers, Afterpay and Klarna.
• Cross border and delivery partners such as Zonos and FedEx, and customs authorities in the destination country.
• Marketing, reviews and analytics providers such as Klaviyo, Okendo, Google Analytics and Microsoft Clarity, and the advertising platforms Meta and Google if you allow marketing cookies.
• Referral program provider UpPromote, which tracks referrals from artists and studios so we can pay their commission.
• Communication and scheduling providers such as Microsoft and Calendly.
• Professional advisers such as our accountants, auditors, lawyers and insurers.
• Authorities where the law requires or permits, such as tax authorities, regulators, courts and law enforcement.
• A buyer or successor if our business or assets are sold or restructured, subject to confidentiality and this policy.
• The public where you choose to publish information, such as reviews and Hall of Fame features, and for ranked artist profiles as explained in clause 15.

We do not sell personal information for money. Some laws treat allowing advertising cookies or pixels on our Site as a sale or sharing of personal information. Clause 24 explains this and how to opt out.

We are based in Australia. Many of our service providers are located overseas or store information in data centres in other countries. As a result your information may be disclosed to, stored in or accessed from countries including the United States, Canada, member states of the European Union, the United Kingdom and Australia, and other countries where those providers or their subprocessors operate.

Australia. Before we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, mainly through contract terms. We remain accountable for how those recipients handle your information as the Privacy Act requires.

EU and UK. When information about you is transferred from the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on an appropriate safeguard. These include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and certification under the EU-U.S. Data Privacy Framework and its UK extension where a provider is certified. You can ask us for more information about these safeguards by emailing policies@skangraphica.com.

Canada and Quebec. Before information about Quebec residents is communicated outside Quebec we assess whether it will receive adequate protection, as Quebec law requires.

We use some computer programs that help make decisions using personal information. In line with the Australian Privacy Principles that apply from 10 December 2026, and with the GDPR and UK GDPR, we explain them here.

• Order fraud screening. Shopify’s fraud analysis uses order, payment, device, IP address and address information to assess the risk that an order is fraudulent. A high risk result may lead to an order being held. A member of our team reviews any held order before it is cancelled. No order is cancelled automatically.
• STATUS submissions. Automated tools help detect images generated or altered by artificial intelligence. A member of our team makes the final decision.
• Ink-Profiler™. The tool suggests products automatically from your answers. These suggestions do not affect your rights or your ability to buy any product.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. If you have a question about any of these processes, or would like a person to review a decision, email policies@skangraphica.com.

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires. Typical periods are as follows.

• Order, payment and tax records for at least 7 years after the end of the relevant financial year, to meet Australian tax and corporate record keeping laws.
• Account information while your account is open and for 2 years after it is closed, unless you ask us to delete it sooner and we are not required to keep it.
• Marketing records until you unsubscribe. After that we keep only your email address or number on a suppression list so we do not contact you again.
• Ink-Profiler™ answers and care planner details for the periods stated in clauses 5 and 8.
• Concierge correspondence for 3 years after our last contact.
• Rankings records, including published profiles and citations, as part of our editorial archive. Inspector working notes for 3 years after the year of the ranking.
• Program and commission records for at least 7 years for tax purposes.

When we no longer need information we delete it or make sure it no longer identifies you.

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include using reputable providers with strong security certifications, encryption in transit, access controls and multifactor authentication for our team and limiting access to people who need it.

No system is completely secure. If we experience a data breach that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours where required, and affected individuals where there is a high risk to them. We will also meet the breach notification requirements of other places where you live, such as Canada, Quebec and United States states.

Please keep your account password secure and tell us straight away at policies@skangraphica.com if you think your account has been compromised.

The Site and our products are intended for adults. You must be 18 years or older to buy from us, create an account or join our programs. We do not knowingly collect personal information from children under 18, and the Site is not directed to children under 13 within the meaning of the United States Children’s Online Privacy Protection Act.

If we learn that we have collected information from a child, we will delete it. If you believe a child has given us information, please email policies@skangraphica.com.

We are monitoring the Australian Children’s Online Privacy Code, which the Information Commissioner must register by 10 December 2026, and will update this policy if it applies to the Site.

Depending on where you live, you may have some or all of the following rights. We will respond to every request in line with the law that applies to you.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. If we decline, we will tell you why and you can ask us to note your request with the information.
• Deletion. Ask us to delete your information, unless we need to keep it for a lawful reason.
• Restriction and objection. Ask us to limit how we use your information or object to processing based on legitimate interests, including profiling. You can object to direct marketing at any time and we will stop.
• Portability. Receive information you gave us in a structured, commonly used and machine readable format, or ask us to send it to another organisation.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing before you withdrew.
• Automated decisions. Ask a person to review a decision made by automated means and give your point of view.
• Opt out of sale, sharing and targeted advertising and limit the use of sensitive information where United States state laws give you these rights.
• Non discrimination. We will not treat you differently for exercising your rights.

In Australia you may deal with us anonymously or using a pseudonym where it is practicable, for example when asking a general question. We usually respond to requests within 30 days.

If the GDPR or UK GDPR applies to you, the following also applies.

• We are the controller of your personal data. Our EU and UK representatives are named in clause 1.
• Our legal bases are explained in clause 7 and our international transfer safeguards in clause 17.
• We will respond to requests within 1 month. We may extend this by up to 2 further months for complex or numerous requests, and we will tell you if we do.
• You can complain to us first using the complaints process in clause 28. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work or where an alleged infringement took place. A list of EU authorities is available at edpb.europa.eu. In the UK the authority is the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
• Where we use non essential cookies, including analytics and replay tools, we do so only with your consent, which you can withdraw through Your privacy choices.

This notice applies to California residents and supplements the rest of this policy. We provide it whether or not the California Consumer Privacy Act applies to us. In the 12 months before the date of this policy we collected the following categories of personal information, for the purposes described in clause 6.

• Identifiers such as name, email address, postal address, phone number, IP address and online identifiers.
• Customer records such as billing and delivery details. Payment card details are handled by our payment providers.
• Commercial information such as purchase history, returns and gift card use.
• Internet and network activity such as browsing behaviour on the Site, interactions with our emails and replay and heatmap data.
• Approximate geolocation derived from your IP address. We do not collect precise geolocation.
• Audio, electronic and visual information such as photos you submit or upload with reviews.
• Professional information about tattoo artists and studios for the rankings and our programs.
• Inferences such as product preferences drawn from your purchases and Ink-Profiler™ answers.
• Sensitive personal information such as health related Ink-Profiler™ answers and account login credentials. We use sensitive personal information only for purposes permitted by California law, such as providing the service you asked for, so we do not offer a separate right to limit.

Sources, recipients and retention. The sources are described in clause 4, the categories of recipients in clause 16 and retention periods in clause 19.

Sale and sharing. We do not sell personal information for money. If you allow marketing cookies or pixels, identifiers and internet activity may be made available to advertising platforms, which California law may treat as selling or sharing for cross context behavioural advertising. We use the Meta pixel and Google advertising tags. You can opt out through Your privacy choices or by sending a Global Privacy Control signal. We do not knowingly sell or share the personal information of consumers under 16.

Your rights. You have the rights to know, delete, correct, opt out of sale and sharing and not to be discriminated against for using these rights. You can use an authorised agent. We will verify requests by matching information you give us with information we hold. We respond within 45 days, which we may extend by a further 45 days where necessary.

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, may have rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and certain profiling. Where these laws apply we also ask for your consent before processing sensitive data such as health related Ink-Profiler™ answers.

To exercise a right, email policies@skangraphica.com. If we decline your request, you may appeal by replying to our decision with the word “Appeal” in the subject line. We will respond to your appeal within the time the law requires, and if you are not satisfied you may contact your state Attorney General.

Residents of Washington, Nevada and Connecticut have additional rights over consumer health data, which are set out in our Consumer Health Data Privacy Policy. We do not sell consumer health data.

We handle the personal information of people in Canada in line with the Personal Information Protection and Electronic Documents Act and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25.

You can ask to access or correct your information and, for Quebec residents, to receive computerised information in a structured, commonly used technological format. Where the Site offers settings that would allow you to be identified, located or profiled, they are switched off by default for Quebec residents until you choose to turn them on. You may withdraw your consent at any time, subject to legal or contractual restrictions.

Our person in charge of the protection of personal information is named in clause 1. You may also complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or, in Quebec, the Commission d’accès à l’information at www.cai.gouv.qc.ca.

Email policies@skangraphica.com and tell us what you would like us to do. To protect your information we will ask you to verify your identity, usually by confirming details linked to your order or account. If someone makes a request on your behalf, we may ask for proof that they are authorised.

We do not charge for requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, and we will explain why. If we cannot do what you ask, we will explain the reasons and how you can complain.

If you have a concern about how we have handled your personal information, please email policies@skangraphica.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the privacy regulator where you live.

• Australia. The Office of the Australian Information Commissioner at www.oaic.gov.au or 1300 363 992.
• European Union. The data protection supervisory authority in your member state. A list is available at edpb.europa.eu.
• United Kingdom. The Information Commissioner’s Office at ico.org.uk.
• Canada. The Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
• California. The California Privacy Protection Agency at cppa.ca.gov.

We may update this policy to reflect changes in the law or in how we handle personal information. We will publish the updated policy on the Site with a new date. If we make a significant change, we will tell you by email or by a notice on the Site before it takes effect, and where the law requires we will ask for your consent.

SKINGRAPHICA PTY LTD (ACN 684 257 261, ABN 54 684 257 261). Registered office The Trust Building, Suite 703, Level 7, 155 King Street, Sydney NSW 2000, Australia.

Privacy questions, requests and complaints go to policies@skangraphica.com.