Privacy Policy

The personal data described in this policy is processed by the controller operating the TattooVerseCo platform. See the contact section below for questions and requests.

The list below is what the platform actually records today. Not everyone gives all of it: what is processed depends on the role you chose and the features you use.

• Account: your email address, your password (stored hashed, never in plain text), your language preference, the date the account was created, and the moment you accepted the terms.
• Profile: your display or business name, your username, your bio, your city and country, your profile picture, years of experience, the styles you work in, your portfolio images, your Instagram and TikTok handles, and your website.
• Studio and supplier profiles: in addition to the above, a street address, coordinates derived from that address, a phone number and a contact email, plus house rules and amenities.
• Tattoo requests: placement, size, coverage, styles, colour preference, timing, your free-text description and notes, and your budget range.
• Optional skin tone: you may add a skin tone range to a request. The field is optional, it is never used to filter or sort anyone, and it exists only so an artist can judge how ink will read on you.
• Images: reference pictures and — if you choose to upload one — a photo of the area the design is meant for. These are not public: they sit in private storage and are only ever shown through short-lived signed links.
• Quotes, bookings and messages: the amount and content of quotes you send and receive, appointment dates and times, and the content of messages you exchange on the platform.
• Job posts and applications: the listings you publish, the applications you send, and whatever you write in them.
• Notification preferences: which subjects you want email or in-app notifications about, the separate opt-in you give for marketing messages, and — if you use the mobile app — your device’s push token.
• Technical records: your IP address and browser information appear in the security and error logs produced by requests to our servers.

• To create your account and keep you signed in.
• To show your profile, your requests and your listings in the parts of the platform they belong to.
• To connect clients with artists and studios, and to run the quote, booking and messaging flow.
• To send transactional notifications such as appointment reminders, new quotes and new messages.
• To send product news and promotional messages — only if you separately opted in.
• To prevent abuse, fix faults, and keep the service secure.

We do not sell personal data. We use the service providers below to keep the platform running; each of them processes data on our behalf and on our instructions.

• Supabase — database, authentication and file storage. Your account, profile, requests, messages and uploaded images are stored here.
• Resend — delivery of transactional email. The recipient address and the message content are passed on.
• Hetzner — the servers the web application runs on.
• CARTO and OpenStreetMap — the base imagery for the discovery map. When you open the map your browser requests tiles from CARTO directly, and your IP address is visible in that request. If you never switch to the map tab, the request never happens.
• Nominatim (OpenStreetMap) — turning a studio or supplier address into coordinates so it can be shown on the map. This request is made by our server, not by your browser.
• Google Analytics — only if you have accepted analytics cookies in your cookie preferences. The address of the page you are on is transferred to Google; nothing else is.
• Meta — only if you have accepted marketing cookies in your cookie preferences. In that case, alongside the address of the page you are on, the email address and phone number you type into the form fields on the sign-in and sign-up pages are also transferred to Meta in hashed form; you do not have to submit the form for that to happen. See the Cookie Policy for details.

Beyond these, data may be shared with competent public authorities where a legal obligation requires it.

Some of the providers above are established outside Türkiye, and your data is processed abroad to the extent those services are used.

We keep your account and profile data for as long as your account is open. Expired tattoo requests follow a separate rule: once a request’s validity period has passed, the images you uploaded are deleted and the skin tone value, if any, is cleared.

You have the rights the applicable law grants you over your personal data. You can send a request to the contact address below.

Your account data and your uploaded images are protected by row-level access rules: a record can only be read by the parties who need to reach it. Images never sit at a public address; a short-lived signed link is generated for each viewing. Connections are encrypted in transit.

The platform is intended for adults and is not designed for users below the age of majority.

When this policy changes, the effective date at the top of the page is updated. We will tell you separately when a change matters to you.

You can write to us about anything in this policy or about your personal data.