Privacy Policy

The personal data described in this policy is processed by the controller operating the TattooVerseCo platform. See the contact section below for questions and requests.

The list below is what the platform actually records today. Not everyone gives all of it: what is processed depends on the role you chose and the features you use.

• Account: your email address, your password (stored hashed, never in plain text), your language preference, the date the account was created, and the moment you accepted the terms.
• Profile: your display or business name, your username, your bio, your city and country, your profile picture, years of experience, the styles you work in, your portfolio images, your Instagram and TikTok handles, and your website.
• Studio profiles: in addition to the above, a street address, coordinates derived from that address, a phone number and a contact email, plus house rules and amenities.
• Tattoo requests: placement, size, coverage, styles, colour preference, timing, your free-text description and notes, and your budget range.
• Optional skin tone: you may add a skin tone range to a request. The field is optional, it is never used to filter or sort anyone, and it exists only so an artist can judge how ink will read on you.
• Images: reference pictures and — if you choose to upload one — a photo of the area the design is meant for. These are not public: they sit in private storage and are only ever shown through short-lived signed links.
• Quotes, bookings and messages: the amount and content of quotes you send and receive, appointment dates and times, and the content of messages you exchange on the platform.
• Job posts and applications: the listings you publish, the applications you send, and whatever you write in them.
• Notification preferences: which subjects you want email or in-app notifications about, the separate opt-in you give for marketing messages, and — if you use the mobile app — your device’s push token.
• Mobile app: the app asks for access to your photo library so you can add images. Only the images you pick are uploaded; the camera and the rest of your library are not accessed. The language you choose in the app is saved to your account so notifications reach you in it.
• Reports and blocks: the reports you send (who you reported, the reason and what you wrote) and the list of users you block. When a message is reported, the message as it read at that moment and as it was first sent are kept so it can be reviewed even if it is later deleted or edited; only platform staff can see them. If an account is suspended, a record of that decision is kept.
• Technical records: your IP address and browser information appear in the security and error logs produced by requests to our servers.

• To create your account and keep you signed in.
• To show your profile, your requests and your listings in the parts of the platform they belong to.
• To connect clients with artists and studios, and to run the quote, booking and messaging flow.
• To send transactional notifications such as appointment reminders, new quotes and new messages.
• To send product news and promotional messages — only if you separately opted in.
• To prevent abuse, fix faults, and keep the service secure.
• To review reports, remove content that breaks the rules and, where needed, suspend accounts.

We do not sell personal data. We use the service providers below to keep the platform running; each of them processes data on our behalf and on our instructions.

• Supabase — database, authentication and file storage. Your account, profile, requests, messages and uploaded images are stored here.
• Resend — delivery of transactional email. The recipient address and the message content are passed on.
• Firebase Cloud Messaging (Google) — push notifications to your phone, if you allowed them in the mobile app. Your device’s notification token and the notification’s title and short text are passed on; the content of your messages is not.
• Hetzner — the servers the web application runs on.
• CARTO and OpenStreetMap — the base imagery for the discovery map. When you open the map your browser requests tiles from CARTO directly, and your IP address is visible in that request. If you never switch to the map tab, the request never happens.
• Nominatim (OpenStreetMap) — turning a studio address into coordinates so it can be shown on the map. This request is made by our server, not by your browser.
• Google Analytics — only if you have accepted analytics cookies in your cookie preferences. The address of the page you are on is transferred to Google; nothing else is.
• Meta — only if you have accepted marketing cookies in your cookie preferences. In that case, alongside the address of the page you are on, the email address and phone number you type into the form fields on the sign-in and sign-up pages are also transferred to Meta in hashed form; you do not have to submit the form for that to happen. See the Cookie Policy for details.

Beyond these, data may be shared with competent public authorities where a legal obligation requires it.

Some of the providers above are established outside Türkiye, and your data is processed abroad to the extent those services are used.

We keep your account and profile data for as long as your account is open. Expired tattoo requests follow a separate rule: once a request’s validity period has passed, the images you uploaded are deleted and the skin tone value, if any, is cleared. Deleting your account also deletes your list of blocked users; reports are kept after an account is deleted so that their review can be completed.

You have the rights the applicable law grants you over your personal data. You can send a request to the contact address below.

Your account data and your uploaded images are protected by row-level access rules: a record can only be read by the parties who need to reach it. Images never sit at a public address; a short-lived signed link is generated for each viewing. Connections are encrypted in transit.

The platform is intended for adults and is not designed for users below the age of majority.

When this policy changes, the effective date at the top of the page is updated. We will tell you separately when a change matters to you.

You can write to us at tattooverseco@gmail.com about anything in this policy or about your personal data.