Privacy Policy

01Overview and scope

This Privacy Policy explains how Inkwell Labs(“Inkwell”, “we”, “us”) handles personal data when you visit our website, use the Inkwell application, or open a client portal we host on someone's behalf.

For the account you create with us, Inkwell is the data controller. For the content you put inside your workspace — including any personal data about your own clients — you are the controller and Inkwell is your processor. See Client portals.

This policy is written to satisfy the GDPR, the UK GDPR, and the CCPA/CPRA. It sits alongside our Terms of Service.

02What we collect

Information you give us

• Account data — name, email address, password hash, avatar, and the identity provider you used (Google, GitHub) if you signed in that way.
• Workspace content — notes, documents, tasks, journals, boards, habits, goals, time entries, meetings, messages, and files you upload.
• Client and project data — the names, emails and details of clients, invoices and portal guests you add.
• Billing data — plan, billing country, tax identifiers and the last four digits and brand of your card. Full card details go straight to our payment processor and never touch our servers.
• Support correspondence — what you write to us, and what we write back.

Information we collect automatically

• Device and log data — IP address, browser and operating system, referring page, and timestamps of requests.
• Usage data — which features you open and how often, error traces, and performance timings.
• Session data — the authentication cookie that keeps you signed in, and local preferences (theme, density, accent) stored in your browser.

What we do not collect

• We do not run advertising networks, ad pixels or cross-site trackers.
• We do not buy personal data from data brokers.
• We do not knowingly collect data from children — see below.

03Why we use it

We only process personal data where we have a lawful basis to do so. Under the GDPR, those bases are:

Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override yours. You may object at any time — see Your rights.

04Cookies and local storage

We use as few cookies as we can get away with. There is no advertising cookie on any Inkwell property.

Your browser can block or delete cookies at any time; essential cookies are required to stay signed in. We honour Global Privacy Control and Do Not Track signals as an opt-out of analytics.

Our Cookie Policy names every individual cookie, what it does, and how long it lasts.

05AI processing

When you use the AI sidekick, the content you point it at is sent to our AI provider, processed to produce a response, and returned to you.

• Prompts and outputs are not used to train any model. Our provider contract prohibits it.
• Our provider retains data transiently for abuse monitoring and deletes it on a short schedule.
• We store your prompts and responses in your workspace so you can revisit them. Delete them and they are gone.
• AI features are opt-in per action. Content is never sent anywhere until you ask for a response.

06Who we share it with

We do not sell or rent personal information, and we have not done so in the preceding twelve months. We share data only with the processors we need in order to run Inkwell, each bound by a written data-processing agreement:

We also disclose personal data in three other narrow cases:

• When you tell us to — for example, by sharing a client portal or connecting an integration.
• When the law requires it — in response to a valid legal process. We review every request, push back on overbroad ones, and notify you unless legally barred from doing so.
• In a business transfer — if Inkwell is acquired or merges, your data may move with the service. We will notify you beforehand, and the acquirer stays bound by this policy or one no less protective.

07International transfers

Inkwell is operated from, and uses subprocessors in, the European Union and the United States. Where we move personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), plus supplementary technical measures — encryption in transit and at rest, and access controls that limit who can see what. A copy of the safeguards is available on request from thekodevs@gmail.com.

08How long we keep it

We keep personal data only as long as we need it for the purpose we collected it:

• Workspace content — until you delete it, or 30 days after you close your account.
• Backups — encrypted, rolling, deleted within 90 days.
• Log and device data — 30 days, then aggregated or discarded.
• Billing records — 7 years, because tax law says so.
• Support correspondence — 2 years after the ticket closes.

Deleting an item in the app removes it from production immediately and from backups on the schedule above.

09How we protect it

No system is perfectly secure, but we take this seriously and design for it from the start:

• TLS 1.2+ for all data in transit; AES-256 encryption at rest.
• Row-level security in the database, so a request can only ever reach rows the signed-in user owns.
• Journal entries are additionally encrypted at the application layer, with the key managed in a separate vault — and they are never shared with the AI assistant.
• Passwords stored as salted hashes. We can never read yours.
• Least-privilege access for staff, granted only for a specific support request, logged and time-boxed.
• Automated dependency scanning, and encrypted, tested backups.

If a breach affects your personal data, we will notify the relevant supervisory authority within 72 hours and tell you without undue delay where the risk to you is high. Report a vulnerability to thekodevs@gmail.com.

Our Security page goes into detail: how workspace isolation is enforced by the database rather than by application code, who at Inkwell can see what, and our responsible-disclosure policy.

10Your rights

Depending on where you live, you have some or all of these rights:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — have your data deleted (“the right to be forgotten”).
• Portability — export your data in a structured, machine-readable format. Available self-serve at any time from Settings → Data.
• Restriction and objection — pause or object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting processing done before you withdrew it.
• Non-discrimination — we will never degrade your service because you exercised a privacy right.

Exercise any of these by emailing thekodevs@gmail.com. We respond within 30 days, free of charge. We may ask you to verify your identity first.

If you are in the EEA or the UK and you think we have got this wrong, you may lodge a complaint with your local supervisory authority — though we would appreciate the chance to fix it first.

11Client portals and workspace data

When you invite a client into a portal, you are the controller of their personal data and Inkwell processes it on your instructions. In that role we:

• Process portal data only to deliver the Service to you.
• Do not use it for our own purposes, and never for marketing.
• Bind our staff and subprocessors to confidentiality.
• Help you respond to a data-subject request within a reasonable time.
• Delete or return the data when you close the portal or your account.

You are responsible for having a lawful basis to put your clients' data in Inkwell, and for telling them you have. If you need a signed Data Processing Agreement, write to thekodevs@gmail.com and we will send one.

12Children's privacy

Inkwell is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact thekodevs@gmail.com and we will delete the account and its content promptly.

13Changes to this policy

We will update this policy as Inkwell changes. The “last updated” date at the top always reflects the current version. For material changes — a new purpose, a new category of recipient — we will email you or show an in-app notice at least 14 days before the change takes effect, and where the law requires it, ask for your consent.

14Contact us

For anything in this policy, including data-subject requests and DPA enquiries, reach our privacy team: