Privacy Policy

Markex Pty Ltd (ABN 66 680 006 839) operates Canory. In this policy, “Markex”, “Canory”, “we”, “us”, and “our” refer to Markex Pty Ltd.

We are based in Australia. You can contact us about privacy at legal@canory.co.

This policy is designed around the Australian Privacy Act 1988 and Australian Privacy Principles where they apply, as well as privacy laws that may apply to people in other regions.

Canory is a freemium and subscription software platform for tattoo artists and studios. It connects public artist and studio pages, websites, enquiries, bookings, calendars, forms, client communication, flash, billing, and artist-studio working relationships.

Account holders use Canory to run their businesses and may collect information from tattoo clients through Canory-powered pages and forms. Markex determines how account, platform, billing, security, and product information is handled. An artist or studio generally determines why it collects its own client information; in that context, Markex handles the information to provide Canory on that customer's behalf.

Information you or another person provides

• Account and profile information: name, email address, account type, authentication identifiers, profile details, settings, and legal acceptance records.
• Artist and studio information: business details, public profile content, working locations, availability, services, portfolio images, artwork, flash, social handles and content, and artist-studio relationships.
• Client and workflow information: enquiries, contact details, booking requests, appointments, calendar information, messages, forms, consent and aftercare records, reference images, and connected client history.
• Uploads and content: text, prompts, images, artwork, portfolio files, form attachments, messages, and other material supplied, connected, or published through Canory.
• Billing information: selected plan, subscription and transaction status, billing country, Stripe customer and subscription identifiers, and limited payment metadata. Complete payment-card details go directly to Stripe and are not stored by Canory.
• Communications: support enquiries, service-related emails, and inbound or outbound email content handled through Canory.

Sensitive information

A tattoo artist or studio may configure a form that asks for health, accessibility, consent, identification, or other sensitive information relevant to a tattoo service. That business is responsible for requesting only information it lawfully needs and giving any additional notice or obtaining any consent required by law. Markex processes that information to provide the requested form and workflow features.

Information from connected services

If you choose Google or Apple sign-in, we receive the account identifier and profile details you authorise that provider to share. If you connect or identify a social account, we may retrieve public or authorised profile details, posts, images, captions, engagement information, and related metadata through the social platform or a social-data provider.

Technical and diagnostic information

Canory and its infrastructure providers may process IP addresses, request times, browser and device information, referring pages, session identifiers, security events, error details, and diagnostic performance data. Sentry is configured not to collect cookies, request or response headers, request bodies, query parameters, AI inputs or outputs, database query data, or general user-profile information. A Canory user ID may be attached to an error event to help diagnose an account-specific problem.

Public-page analytics

Canory measures visits and actions on published artist and studio link-in-bio pages so the relevant account holder can understand page views, approximate daily visitors, link clicks, form and booking actions, traffic sources, device categories, countries, and crawler activity. Recognised crawlers and other automated traffic are reported separately from ordinary page activity.

This measurement is first party. Canory does not place an analytics cookie or store a raw IP address, complete referring URL, or complete browser user-agent string for this feature. Approximate visitors are calculated with a pseudonymous identifier that changes each UTC day. Detailed events are retained for no more than seven days and are then removed after daily summaries are produced.

Information we do not collect or use

Canory does not sell personal information, share it for cross-context behavioural advertising, use advertising cookies, or use a third-party general product-analytics platform for link-in-bio measurement. We do not request contact lists or address books and do not intentionally collect precise device location.

We use information to:

• create accounts and provide, maintain, personalise, and secure Canory;
• operate public pages, websites, enquiries, bookings, calendars, forms, messages, uploads, billing, and artist-studio relationships;
• process subscriptions, send service communications, and provide support;
• prevent fraud and misuse, investigate errors, enforce our Terms, and protect Canory, its users, and others;
• meet legal, accounting, dispute-resolution, and regulatory obligations; and
• send marketing communications where permitted and in accordance with your communication choices.

AI-assisted features

Canory uses OpenAI GPT-5.5 with GPT-4o fallback paths. Information you supply or connect—including profile details, portfolio imagery, prompts, and social-account content—may be sent to OpenAI when an AI-assisted feature is invoked or enabled. We use the result to produce recommendations, summaries, site or card content, and artist-specific personalisation.

Markex does not use customer content to train general or shared AI models. OpenAI states that data submitted through its business and API offerings is not used to train its models by default. OpenAI processes that data under its own business and privacy terms.

Canory may retain an artist-specific style or personalisation profile and use it for that artist's account. This is not a general model trained for other customers. AI-assisted outputs are probabilistic and may be inaccurate, incomplete, biased, or unsuitable. Users must review them before publishing or relying on them. AI-generated images or generated elements are synthetic or modified content and should not be treated as documentary photographs of real people, places, or events without independent verification.

Publishing and schedule controls

Public artist and studio surfaces display information the relevant account intentionally publishes. Artists control their calendar and studio schedule data. A studio may use an artist's schedule only where the artist has allowed that access through an active relationship or supported collaboration setting.

Canory uses cookies and similar browser storage that are necessary to authenticate users, protect controlled surfaces, remember limited service state, and keep the platform secure. We do not currently use advertising or general analytics cookies.

Most browsers let you block or delete cookies, but blocking necessary cookies may prevent sign-in or other protected features from working. Because Canory does not perform cross-site behavioural advertising, we do not currently change our practices in response to a browser's Do Not Track signal.

We use service providers to operate Canory. A provider receives information only where its service is used and as needed for the purpose described below.

Providers may use their own subprocessors and infrastructure. Their policies explain their independent practices. Canory may replace a provider or add another provider as the service changes; material changes will be reflected in this policy.

Account information, user content, communications, forms, bookings, calendars, uploads, and artist-specific personalisation are generally kept while the account exists so Canory can provide the service.

When an account is removed, deletion of associated active data begins. We do not promise a fixed deletion deadline. Limited copies may remain temporarily in backups, security and diagnostic records, billing or transaction records, dispute files, or records Markex must keep to comply with law or protect legal rights. Information may also be retained where another person's account or an artist's or studio's lawful business record requires it.

Stripe and other providers retain information under their own policies. Technical logs and diagnostic events are kept for limited operational periods determined by current service configuration and may be retained longer where needed for security, investigation, or law.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal information, object to certain processing, withdraw consent where processing relies on consent, or complain to a privacy regulator.

Email legal@canory.co to exercise a right. Describe your request and the Canory account, email address, booking, form, or interaction it concerns. We may ask for information reasonably necessary to verify identity and protect other people's information. We will respond within the period required by applicable law.

If information was collected by an artist or studio through a Canory-powered page, that business may be best placed to respond first. We will assist the relevant Canory customer with a valid request where Markex processes information on its behalf.

Markex is based in Australia, but Canory's providers may process or store information in Australia, the United States, and other countries where they or their subprocessors operate. Information may also transit through other regions as part of normal internet routing.

Where required, we rely on provider data-processing terms, contractual protections such as Standard Contractual Clauses, adequacy decisions, or another lawful transfer mechanism. The laws in a destination country may differ from those where you live.

Canory accounts are for people aged 18 or older. We do not knowingly allow a person under 18 to create an account.

Artists and studios are responsible for complying with laws that apply if they provide services to a minor or collect a minor's information through a Canory-powered form, including obtaining parental or guardian authority where required. If you believe a child's information was provided without appropriate authority, contact legal@canory.co.

We use reasonable technical and organisational measures designed to protect personal information. These include HTTPS encryption in transit, provider-managed encryption at rest, access controls, authenticated sessions, restricted administrative credentials, row-level database controls, private or signed file access where appropriate, and privacy-filtered diagnostic reporting.

No internet service can guarantee absolute security. Keep account credentials confidential and contact us promptly if you suspect unauthorised access. If a data breach occurs, we will investigate and notify affected people and regulators where required by law.

We may update this policy as Canory, our providers, or applicable law changes. We will publish the revised policy with a new last-updated date. For a material change, we will provide additional notice where appropriate, such as by email, an in-product message, or a prominent website notice.

Where a change requires consent rather than notice, we will ask for that consent separately. A Privacy Policy link or notice is not itself consent to optional processing.

For privacy questions, requests, or complaints, contact:

Markex Pty Ltd
ABN 66 680 006 839
Australia
legal@canory.co

Please provide enough detail for us to understand the issue. We will acknowledge and investigate privacy complaints and respond within a reasonable period or the period required by applicable law.

Australia

Where the Australian Privacy Act applies, you may request access to or correction of personal information Markex holds about you. You may also complain to us about our handling of personal information. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

European Economic Area and United Kingdom

Where GDPR or UK GDPR applies, our legal bases include:

• Contract: to create an account and provide the Canory features you request.
• Legitimate interests: to secure, support, diagnose, and improve the service, communicate with users, and protect legal rights, balanced against your rights.
• Consent: for optional processing where consent is requested, including certain marketing or sensitive-information uses.
• Legal obligation: to keep required records and respond to lawful requests.

You may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your local supervisory authority. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to legal exceptions. Canory does not use its AI personalisation to make those decisions.

Markex has not appointed a data protection officer or an EEA/UK representative. Direct requests to legal@canory.co. International transfers use the safeguards described in section 9 where required.

California

This supplement applies to the extent California privacy law applies to Markex. In the preceding 12 months, Canory may have collected and disclosed the following categories for the business purposes described in this policy:

Canory does not sell personal information or share it for cross-context behavioural advertising. We therefore do not provide a “Do Not Sell or Share” opt-out link. California residents may request to know, access, delete, or correct covered information and may use an authorised agent. We may verify the requester's identity and the agent's authority. We will not discriminate against a person for exercising an applicable privacy right.