Privacy policy

Who operates VOI Studio

VOI Studio is operated by Mark James Graham, an individual sole trader, ABN 41 244 585 735. Contact admin@voi.studio about this policy or your information.

Each studio using VOI Studio manages its own workspace and customer relationships. Victims of Ink is one studio using the software. A studio's enquiry notices and privacy policies describe its own collection and use of client information; this platform policy does not replace them.

Information used to provide the platform

We process account and contact details, studio and staff profiles, workspace settings, subscription and payment references, and support and security records. Studios may enter enquiries, client contact details, appointment records, notes, images, consent responses, communication history and payment records to run their business.

We use this information to provide the features the studio requests, control workspace access, support users, maintain security and troubleshoot the service. Payment and subscription providers process payment details; VOI Studio stores the references and status information needed for the relevant workflow rather than full card details.

Connecting Google Ads

A studio owner or administrator can choose Connect Google in the Google Ads integration settings. Google asks for permission to manage Google Ads data and use its Data Manager service. Those permissions are broad; the connection workflow uses them to read accessible advertiser accounts, manager relationships and conversion-action settings, read campaign performance, and validate and send eligible qualified-lead and purchase conversions to the destinations the studio selects.

Account information includes account identifiers, names, currency, timezone and conversion ownership. Conversion-action information includes its identifier, name, type, category, status and whether it is used as a primary goal. VOI Studio uses these details to offer account choices, verify the selected destination and display the saved connection.

VOI Studio does not use this connection to change campaigns, budgets, bids or conversion-action settings. Connecting an account does not by itself enable conversion delivery.

Conversion information sent to Google

When conversion delivery is enabled for the studio, VOI Studio sends eligible first tattoo bookings as qualified leads and completed, fully paid tattoo invoices as purchases. Each is linked to an enquiry with coherent recorded Google advertising click evidence. A record contains an enquiry-journey or order identifier, event time and click identifier, together with the selected conversion destination. Purchases also carry invoice value and currency. Consultation bookings do not qualify.

These conversion uploads do not contain customer names, email addresses, phone numbers, enquiry notes, photos or consent-form responses. General marketing preferences are not treated as permission for advertising-data use. Google processes the submitted information under its own applicable terms and privacy policy.

VOI Studio retains submitted record details, Google request identifiers and delivery results to prevent duplicate delivery, explain failures and show processing status. Processing success does not guarantee that Google attributes a conversion to an advertisement.

Google Ads reporting

VOI Studio reads and caches campaign names and identifiers, daily spend, clicks, impressions and the counts and values attributed to the studio's selected conversion actions. Studio owners and administrators use these reports to assess advertising performance. Reports show the advertiser account's currency and timezone and may change as Google processes later conversions.

Connecting Gmail and the studio inbox

Where this feature is enabled, a studio owner or administrator can authorise read-only Gmail access and confirm the mailbox returned by Google. We verify a Google-issued account identifier to associate the grant safely, and read the mailbox address so the administrator can confirm the correct inbox. Gmail access is separate from Google Ads.

VOI Studio searches for email conversations associated with the studio's enquiries and reads matching message headers, subjects, timestamps, snippets and attachment names. Studio Agent monitoring also checks the latest reply body for follow-up signals and stores selected snippets and derived review flags alongside follow-up state.

Opening Email inbox starts a separate, read-only mailbox index. This imports message and thread identifiers, sender and recipient headers, subjects, timestamps, snippets, read status and Gmail labels across mailbox history, including archived, sent, draft, spam and trash messages. These records and any studio tags are stored in the studio's restricted database so administrators can browse and search quickly. New mail and changes are checked while the inbox is open and by the scheduled worker. Importing mail does not add it to the daily follow-up queue or send it to AI.

When an administrator opens a conversation, the inbox loads its message text and attachment names. Readable message text is cached for up to seven days, stops being returned after expiry, and is removed by daily cleanup subject to service availability and backup retention. Inline message-body parts may be read even when Gmail stores them separately. An administrator can download an attachment through the authenticated inbox, within its displayed size limit. Downloads are not retained as a separate attachment cache. A short-lived in-memory conversation cache is limited to the signed-in staff member and current mailbox, and expires within five minutes or the stored body expiry, whichever comes first. Mailbox headers, snippets and studio tags remain while the connection is active, until the source message is removed and reconciliation completes, the mailbox is disconnected or replaced, or the studio is deleted.

Reading email does not enable sending. An owner or administrator can separately choose Enable replies in Integrations, grant Gmail send permission and confirm the mailbox. Authorised staff can then explicitly send replies, including selected attachments, from VOI Studio through that mailbox. The recipient receives the email and Gmail keeps its normal sent copy. No AI advice or follow-up rule can send it automatically. A separate Enable read status sync choice requests Gmail permission to update messages and confirms the mailbox. Once enabled, opening a conversation marks its captured known unread messages read; staff can also mark the latest received message unread. These read/unread changes synchronize with Gmail. The application restricts this permission to read status and does not archive, delete or change other Gmail labels. Read-status operation receipts store message identifiers, requested state and outcome until studio deletion; they contain no message text. Uncertain changes are checked against Gmail before another action. Matching and follow-up classifications can be incomplete or incorrect; calls and conversations outside the connected mailbox may be missing. Staff should check the source conversation before contacting a client or recording an outcome. Gmail content is not used to target advertising or added to Google Ads conversion uploads.

Reply drafts are private to the staff member who saves them. Draft text, recipients and selected attachments are stored in the restricted studio database for up to seven days after the last save; they are not Gmail drafts. A submitted reply snapshot is retained for up to seven days to prevent duplicate or changed submissions. Non-content delivery receipts, including request and message identifiers, status and timestamps, remain until studio deletion. If delivery cannot be confirmed, the app blocks resending that attempt until its status is resolved. These replies and attachments are not sent to AI.

Optional manual AI briefings

Connecting Gmail does not enable AI processing. Where available, an authenticated studio owner or administrator can separately enable AI lead briefings after accepting the data-use notice. Each briefing is generated only when an administrator accepts the notice and requests it. Relevant enquiry text, up to eight saved email snippets, a recorded follow-up note and app-determined booking and follow-up facts are sent to OpenAI through its API. We omit contact fields, advertising identifiers, attachments and payment details, and reduce obvious identifying text. Free text may still contain personal information; this is not anonymisation.

AI briefings are internal suggestions for authorised staff to check against the source conversation. They do not change bookings, contact permissions, follow-up priority or recorded loss reasons, and are not sent to clients. The legacy AI email-drafting feature remains disabled. New briefings store validated output and non-content usage receipts, without saving a separate source snapshot. We request that OpenAI not retain the response as retrievable API application state. Security and abuse-monitoring retention may still apply, commonly for up to 30 days, as described in OpenAI's API data controls. API data sharing for model improvement must be disabled before activation; Google data is not used to train general-purpose AI models.

Optional Studio Agent monitoring and memory

Where available, Studio Agent requires separate ongoing-processing consent from an authenticated studio owner or administrator. Monitoring periodically checks saved enquiries, booking information, outcomes and matching Gmail evidence to prepare follow-up cases and in-app alerts. When AI advice is also enabled, the service may send minimised enquiry text, selected email excerpts, app-determined facts, relevant approved studio memories and recent case-specific chat to OpenAI for background advice or answers to administrator questions. For a question about a selected enquiry, these excerpts may be drawn from its full message bodies, with text minimisation and size limits applied before sending them to OpenAI. Optional semantic search sends minimised memory or question text to OpenAI to create numerical search vectors stored in the studio database. Connecting Gmail or enabling manual briefings does not enable Studio Agent.

Administrators can save, correct and forget studio memory. Suggested preferences require explicit staff approval before they are saved for future advice. Memory is private to the studio; it does not train model weights or pool learning between studios. Advice cannot send client messages, change bookings or lift contact restrictions. Staff remain responsible for checking the evidence and recording actual outcomes. Free-text minimisation is not anonymisation, and the API data controls and security retention described above also apply.

Studio Agent chat and advice stop being returned after 30 days. Approved studio memories expire within 180 days, and any lead-linked memory within 30 days. Bounded cleanup runs when the workspace or worker is used; physical removal can wait while the service is inactive. Forgetting deletes the active memory text and vector. Disabling the agent's AI clears its stored chat, advice, derived memories and vectors; approved administrator-authored studio memories remain available to edit or forget. Non-content consent, audit and usage receipts remain until studio deletion. Backups expire under their applicable lifecycle. These rules do not delete the underlying enquiry, Gmail evidence or follow-up records.

Storage, protection and sharing

Stored Google OAuth refresh credentials are encrypted in server-side storage. Access to connection settings and reports is restricted to authorised studio owners and administrators; credentials are not exposed in the browser. We use encrypted network connections and access controls to protect information.

We use hosting, database and other service providers to operate the requested features. Google connection information is processed through our hosting and database providers, including Vercel and Supabase, and OpenAI when separately enabled AI assistance is requested or authorised ongoing Studio Agent processing runs. These services may process information outside Australia. Information is shared with Google when needed for the studio's authorised connection and conversion delivery.

We do not sell Google user data. We use it to provide or improve the connection features described here. Human access is limited to the circumstances allowed by Google's policy, such as your affirmative agreement for support, investigating security issues, or meeting legal obligations.

VOI Studio's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used to train general-purpose AI models.

Retention, disconnection and deletion requests

We retain information for the purposes described in this policy, including providing the service, maintaining security, preventing duplicate conversions, resolving disputes and meeting applicable recordkeeping obligations. Retention depends on the record and its purpose; there is no automatic fixed-duration purge of Google delivery history.

Disconnect in the studio's Google Ads settings removes access from that studio's active connection and pending setup, and prevents new delivery authorisations. If another studio connection or pending setup still uses the same Google grant, its access is retained. When no connection or pending setup needs the grant, we queue revocation at Google. A delivery already authorised or received by Google may still complete. Saved connection settings and delivery history remain in the workspace; disconnect does not delete information already received by Google.

We verify a Google-issued account identifier during connection and store a private hash of it to associate authorisations safely across studios. For the Ads connection, we do not request your Google email address or profile for this purpose. An unused credential may remain encrypted in restricted cleanup storage until Google confirms revocation or a failed or uncertain removal is resolved. It cannot be used for advertising delivery from that cleanup storage. We then delete the retained credential and keep the cleanup result as security evidence.

You can also remove VOI Studio's access through your Google Account connections. This removes the Google account's app-wide grant and can affect other studios you connected with that same Google account. Contact admin@voi.studio to request access, correction or deletion of platform information, including retained Google connection and delivery records. We will verify your authority and explain what can be deleted and what must be retained. History deletion is handled through support, not automatically by the Disconnect button.

For information a studio collected about you as its client, contact that studio first so it can assess the request for its records. We can assist the authorised studio with platform handling.

Gmail disconnection and retained history

Disconnecting Gmail stops new mailbox checks through the studio connection and cancels pending setup. A request already in flight may finish at Google; results from an obsolete connection cannot replace current lead evidence. Saved thread snippets, follow-up records and previously generated drafts remain in the workspace, marked as needing a fresh check where appropriate. Disconnect is not history deletion.

The separate Email inbox cache has a different lifecycle: disconnecting or replacing its Gmail connection deletes the cached mailbox records, message text, private inbox drafts and VOI studio tags for that connection. An explicitly confirmed sending or read-status permission upgrade for the same verified Google account preserves this cache and drafts. A reply already authorised for sending may still complete after disconnection; its delivery receipt is retained, independently of the inbox cache. Submitted reply snapshots still expire within seven days. After a source message is deleted and reconciled, we retain only its deletion marker until disconnect, replacement or studio deletion to stop delayed requests restoring the removed message. This does not delete messages in Gmail or the studio's retained lead and follow-up records. Historic backups expire under their applicable lifecycle.

Unused credentials remain encrypted in restricted cleanup storage until safe removal at Google is confirmed. Removal may wait for another connection, an in-flight request or an uncertain response to be resolved. Legacy credentials whose issuing application is unverified are held for support review, not automatically assigned to the new application. Historic backups may contain records from earlier storage implementations and expire under the applicable backup lifecycle.

New AI lead briefings expire after 30 days and are removed by the next daily cleanup, subject to service availability and the backup lifecycle. Changes to saved evidence or the Gmail connection make an older briefing unavailable. Disabling AI briefings deletes their cached text and prevents in-flight results from being published. Minimal consent, request and token-use receipts without enquiry or briefing text remain for audit and duplicate-request prevention until studio deletion. These rules do not automatically delete the underlying Gmail evidence, follow-up history or legacy draft snapshots. Contact admin@voi.studio to request deletion. We verify authority, explain any required retention and assist the studio with the request.

Questions and policy changes

Contact admin@voi.studio with privacy questions or complaints. We will update this policy when our practices change and obtain further consent where required before using Google data for a new purpose.