Privacy Notice

URBANEE (sole proprietorship), owner: Egor Dvortsevoy

Heylstraße 11, 10825 Berlin, Germany

Email: support@tattoodeck.com

We are not legally required to appoint a data protection officer; please send requests to the address above.

For the website, our marketing communication and the accounts of our customers (studios, artists) we act as controller.

For the data a studio processes about its own clients in Tattoodeck (appointments, contact details, consent forms, health information, images), that studio is the controller. We act as processor under Art. 28 GDPR and only on the studio's instructions. A data processing agreement is available on request.

• Account data: name, email address, password hash or Google sign-in, studio name, role, language and time zone

• Studio master data: address, Instagram handle, logo, services and working hours; phone number and VAT ID only if the studio voluntarily enters them

• Usage data: sign-in and change timestamps, audit logs, technical logs

• Technical data: IP address, date and time of access, page requested, browser type — kept as server logs for security and troubleshooting

• Communication: emails and support requests sent to us

• Billing data: subscription status, plan, artist count and checkout identifiers. We never receive card or bank details; those are processed solely by Stripe.

• Content processed for the studio: client records, appointment history, requests, reference images, messages, and consent forms including health answers and signature

• Providing the Service, contract performance, registration, login, support: Art. 6(1)(b) GDPR (contract)

• Invoicing, subscription management, tax and commercial record keeping: Art. 6(1)(b) and (c) GDPR

• Operations, security, fraud and abuse prevention, troubleshooting, product improvement: Art. 6(1)(f) GDPR (legitimate interests)

• Transactional emails such as appointment confirmations, reminders, portal links and consent requests: Art. 6(1)(b) GDPR or the studio's instruction

• Marketing communication, where it takes place: Art. 6(1)(a) GDPR (consent), revocable at any time

• Health data in consent forms: processed by the studio on the basis of Art. 9(2)(a) GDPR (explicit consent of the data subject); we process it solely as processor.

Health answers from the consent quiz are special categories of personal data under Art. 9 GDPR. Within a studio they are visible only to the owner, management and the treating artist, enforced by database-level access rules.

Signed forms are immutable and stored with timestamp, IP address and checksum. PDF files are held in private storage and accessed only through short-lived signed links.

Client signing links are single-use and expire after 72 hours.

• Database, authentication and file storage hosting: Supabase, data centre in the European Union (Frankfurt am Main)

• Application and website hosting, content delivery: Cloudflare

• Payment processing for subscriptions: Stripe Payments Europe, Ltd. (Dublin, Ireland) — receives billing and contact data for payment, subscription management and invoicing

• Client deposits, where enabled: Stripe, using the respective studio's own credentials

• Email delivery: Resend or our host's delivery service, sending via notify.tattoodeck.com

• Calendar connections, where enabled: Google Calendar, Apple iCloud (CalDAV), Calendly, Cal.com — only after the studio explicitly links them; while a connection is active, appointment data is transferred to that provider

• Tax advisers, legal advisers and authorities where legally required

Agreements under Art. 28 GDPR are in place with all processors. Transfers to third countries take place only on the basis of an adequacy decision or EU standard contractual clauses (Art. 44 et seq. GDPR).

• Account data: for the term of the contract, then deleted within 30 days to 3 months

• Invoices and accounting records: 10 years pursuant to Section 147 AO and Section 257 HGB

• Signed consent forms: 10 years, then deleted automatically

• Server and security logs: usually 30 days

• A studio's client data: as instructed by the studio; deletion or anonymisation on request, while signed consent records are retained as evidence until the end of the retention period

Strictly necessary: login session, language selection, theme and security features (Art. 6(1)(f) GDPR, Section 25(2)(2) TDDDG). These are required to operate the site and are set without consent.

Statistics — Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Used only after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), with IP truncation. It processes pseudonymous usage data such as pages viewed, time on page, approximate region, device and traffic source. Transfers to Google LLC in the US may occur, based on EU standard contractual clauses and the EU-US Data Privacy Framework.

Marketing — Meta Pixel and Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). Also only after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We use it to measure the performance of our Instagram and Facebook ads and to build audiences. Meta processes cookie identifiers and event data such as page views and sign-ups, partly as a joint controller with us and partly on its own responsibility; transfers to the US may occur (standard contractual clauses, EU-US Data Privacy Framework).

We use Google Search Console to review our visibility in Google Search. It sets no cookies on this website; we only see aggregated search data without personal reference.

Identifiers and storage periods in use: Google Analytics 4 sets “_ga” (2 years) and “_ga_<property ID>” (2 years); the Meta Pixel sets “_fbp” (3 months) and may process the click parameter “fbclid” / “_fbc” (3 months). Your consent decision itself is stored locally in your browser (local storage, key “td.consent.v2”) together with its timestamp, so we do not show the banner again and can evidence your choice.

Events transmitted: to Google Analytics 4 we send page views plus individual actions such as sign-in (“login”) and submitted booking requests (“booking_request_submitted”). To Meta we send page views (“PageView”) and the successful creation of a studio or artist account (“CompleteRegistration”) — without revenue or price parameters.

No customer data matching: we do not send email addresses, phone numbers or names to Meta or Google (no custom audience uploads, no advanced matching). Client data held in Tattoodeck is never used for advertising.

Joint controllership: for the collection of pixel data we have concluded an Art. 26 GDPR arrangement with Meta (Meta Controller Addendum); Meta handles the information duties for its own further processing. You can also object to advertising use directly with the providers: in Meta’s “Ad preferences” settings or at myadcenter.google.com.

On your first visit a banner asks for your consent. No statistics or marketing services load before consent is given. You can change or withdraw your choice at any time via “Cookie settings” in the footer; processing then stops going forward. Stripe's checkout sets its own cookies necessary for payment.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to withdraw consent at any time.

Please send requests to support@tattoodeck.com. We respond within one month.

If your request concerns data a studio processes about you, please contact that studio directly; we forward requests where needed. In Tattoodeck, studios can run access, export and deletion for their clients themselves.

Fonts are served from our own servers in the EU. No Google Fonts or other external content delivery networks are loaded from visitors' browsers, so no IP addresses are transferred to third parties outside the EU.

We apply appropriate technical and organisational measures: encryption in transit (TLS), encryption at rest, role-based access rules at database level, tenant separation, private file storage with short-lived signed links, audit logs and least-privilege access.

You may lodge a complaint with a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

We update this notice when the Service or the legal situation changes. The current version is always available on this page; the date is shown at the end.