Privacy policy · TattooInn

Who we are

TattooInn is run by Selfound Ltd (company number 16450921), registered in England and Wales at Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, England. In this policy, we and us mean Selfound Ltd.

We are the controller of the personal data described here. Our ICO registration number is [ICO REGISTRATION NUMBER]. For any privacy question, write to privacy@tattooinn.com.

TattooInn is a marketplace. Artists are independent businesses. Where an artist uses your data for their own purposes, the artist is a separate controller. We say where that applies below.

What we collect

From clients:

Account: your email address, your name if you give one, a hashed password if you set one, and your settings for emails and healed photos.
Requests: your idea, placement, size, colour, budget range, dates, reference images or links, whether it is your first tattoo, and your confirmation that you are 18 or over.
Messages and quotes between you and an artist.
Bookings: the session time, price, deposit, balance, any tip, payment status, and any move or cancellation.
Consent form: your full name, date of birth, signature, six yes or no health answers, an allergy note of up to 300 characters, and the time you signed. The health questions cover pregnancy; heart conditions, diabetes or epilepsy; blood thinners or antibiotics; allergies; a skin condition on the area; and alcohol or drugs in the last 24 hours.
Reviews: your rating, your words, a fresh photo and a healed photo if you add them, how many weeks it had healed, and whether the artist may show the photo.
Saved artists and designs, artists you block, and reports you send us.
Your aftercare plan once the artist marks a session as done.

From artists:

Account and profile: your email, name, handle, bio, styles, prices, deposit, cancellation policy, availability, request filters and auto-reply.
Studio: the studio name and address. These are shown publicly.
Work: your portfolio photos and flash designs.
Licence: your council, registration number, premises, expiry date, the date we checked, and any certificate you upload.
Payments: your Stripe account number and whether your account can take payments and payouts. Your identity and bank details are held by Stripe, not by us.
Plan: your plan, its state, and Stripe's customer and subscription numbers.
Fee records, your private notes about clients, and your import records.

From visitors: if you join the waiting list, your email address and postcode. Like any website, our servers and the providers named below receive technical details such as your IP address and browser.

You do not have to give us any of this, but without an email address you cannot have an account, without a request there is nothing for an artist to quote, and without a signed consent form an artist cannot tattoo you.

Where it comes from

Mostly from you. Some comes from other people on TattooInn: an artist's private notes about a client, a client's review of an artist, or a report about an artist.

Stripe tells us whether a payment, refund, payout or card dispute went through.

If an artist asks us to build their profile, we read the public pages they point us at: their website and a link page. If Instagram import is offered and the artist authorises it, we read their own Instagram posts through Instagram's official interface. Those pages may show other people, such as clients in tattoo photos.

We look up a studio's postcode or address to place it on a map and find its council.

Why we use it, and our lawful basis

We must have a lawful basis under Article 6 of the UK GDPR for each purpose.

Run your account, pass requests and messages, take deposits and balances, handle refunds and keep booking records. Basis: contract (Article 6(1)(b)).
Check that a client is 18 or over before a request or session. Basis: our legitimate interest in preventing the tattooing of under-18s, which is illegal in the UK (Article 6(1)(f)).
Collect and store a consent form for your artist. Basis: contract, and the artist's and our legitimate interests in a safe session and a record of it (Article 6(1)(b) and (f)). For the health answers see the next section.
Charge artist fees and plans, keep accounting records and meet tax duties. Basis: contract and legal obligation (Article 6(1)(b) and (c)).
Import an artist's website or Instagram. Basis: the artist's consent (Article 6(1)(a)). You choose to start it, nothing goes live until you confirm it, and you can withdraw consent at any time.
Send service emails: sign-in links, request and booking updates, payment and dispute notices, licence notices. Basis: contract.
Send aftercare reminders, the six-week healed photo prompt and saved-flash alerts. Basis: contract for the aftercare service, and legitimate interest for the others. You can switch each off in Settings.
Show an artist's public profile and a client's healed photo. Basis: contract for artists. For a client's photo, consent (Article 6(1)(a)), given by ticking the box on your review.
Check and display an artist's council registration, and keep licences current. Basis: legitimate interests in client safety and trust (Article 6(1)(f)).
Handle reports, blocks, takedown requests and complaints. Basis: legitimate interests, and legal obligation where the law requires it.
Keep the service secure, prevent fraud and abuse, and fix faults. Basis: legitimate interests.
Tell people when we open in their area. Basis: consent (Article 6(1)(a)), given when you join the waiting list.

Where we rely on legitimate interests we have weighed them against your rights and freedoms, and you can object (see Your rights).

Your answers on a consent form are health information. This is special category data under Article 9 of the UK GDPR. We process it on your explicit consent (Article 9(2)(a)), which you give when you sign the form. We use it only so your artist can decide whether it is safe to tattoo you. We never use it for marketing or to build profiles.

Who is responsible: your artist uses the form for their own legal, insurance and safety duties, so the artist is a controller of the information on it for those purposes. We are a separate controller for collecting it through TattooInn, storing it securely, keeping it for the period below, and showing it only to your artist. Ask the artist how they handle their copy.

You can withdraw consent at any time, but the artist may then be unable to tattoo you. We may still keep a signed form for the period below where it is needed to deal with a legal claim or an insurer (Article 9(2)(f)).

Only the artist you booked sees your answers. Artists can also keep private notes about their clients, such as allergies or how they sit. Those notes are never shown to the client.

Who sees your data

Artists see your name and what you send them: your request, messages, booking and consent form. Other clients and the public do not.

An artist's profile, studio address, prices, portfolio, flash and reviews are public. A healed photo is shown on an artist's profile only if you ticked the box on that review and your account-wide photo setting is on.

We do not routinely read messages. We may read a conversation that has been reported, or when the law requires it.

A report about an artist is not shown to the artist, and we do not tell them who sent it.

We do not sell personal data. We share it with the companies in the next section, with professional advisers, and with the police or a regulator when the law requires it.

Companies we use

These companies process personal data for us or receive it as part of the service.

Hetzner, our hosting. Our server and database run in a Hetzner data centre in the EU, currently in Finland. Uploaded photos and licence certificates are stored on that server.
Stripe, payments. Stripe takes card payments, pays artists through Stripe Connect, runs plan billing and handles card disputes. Stripe's script is loaded on every page of our site, not only on payment pages. Stripe is an independent controller for its own regulated purposes, such as identity checks and fraud prevention, and publishes its own privacy policy. Stripe may process data in the UK, the EU and the US.
Mailgun, email. Mailgun delivers our emails, so it receives recipients' email addresses and the content of each email. Mailgun processes our email in the US.
OpenAI, profile import. When an artist asks us to import their website, we send the text of their public pages to an OpenAI model (gpt-4.1) to fill in profile fields. We send text only, not photos, and no client data. OpenAI processes it in the US.
Meta (Instagram), only if an artist authorises an Instagram import. Meta receives the artist's authorisation and returns their own posts.
Google Fonts. Your browser loads our fonts from Google, so Google receives your IP address and browser details.
OpenStreetMap Foundation. Your browser loads map tiles from it, and we send it a studio's street address to find a map pin. It receives your IP address when you view a map.
postcodes.io, a UK postcode lookup. We send it a studio's postcode.
unpkg.com, a content delivery network that serves our map library to your browser. It receives your IP address.

We use no analytics or advertising provider, and we send no text messages.

Sending data outside the UK

Hetzner's EU data centres are covered by the UK's adequacy regulations for the EEA.

Mailgun and OpenAI process data in the US. Stripe and Google may also process data in the US. For these transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified under it. Where it is not, we rely on the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in the provider's terms.

Ask us at privacy@tattooinn.com for more about the safeguards.

How long we keep it

Account details, saved items and messages: while your account is open, or until you ask us to erase them as described under Your rights.
Sign-in: a sign-in link works for 15 minutes. A login session lasts 14 days. An email change link works for 7 days.
Requests: an unanswered request closes after 7 days. A quote is open for 5 days unless the artist sets another time. The records stay in your history while your account is open.
Signed consent forms: for as long as the artist and we may need them for insurance and legal claims. Our policy is to delete a form seven years after the session.
Booking, payment, fee and dispute records: six years, which is the period the law requires for accounting records. If you ask us to erase your account we keep these against an anonymous ID.
Reviews and healed photos: until you ask us to remove them or you switch your photo setting off.
Artist licence details: while the artist's account is open. When an artist uploads a new certificate, the old file is deleted.
Imported data that an artist has not confirmed: we review abandoned imports and delete them, normally within 30 days of the last activity. If you withdraw consent to an import, we delete the run, everything it found and all candidate photos straight away. Photos you already confirmed stay, because they are now your portfolio.
Reports and blocks: for as long as they are needed to protect people on TattooInn.
Waiting list: until we open in your area or you ask us to remove you.
Technical logs: for as short a time as we can while we keep the service secure and working.

Automated tools

We make no decision about you with a legal or similarly significant effect by automated means.

Two tools use simple rules. A budget-fit tag tells an artist whether a client's budget reaches the artist's minimum charge. Filters can add a note such as Below your minimum. An artist still sees every request and decides for themselves.

The import tool reads an artist's public pages and drafts profile fields. Every field stays private and pending until the artist confirms it, edits it or rejects it.

An artist whose council registration has expired is left out of search until it is renewed. This is a visibility rule, not a decision about a person's rights.

Children

TattooInn is for people aged 18 and over. Tattooing anyone under 18 is illegal in the UK. A client must confirm they are 18 or over to send a request, and the consent form checks their date of birth against the session date. If we learn that someone under 18 has an account, we will close it and erase their data.

Keeping data safe

We use encrypted connections, hashed passwords, access limits so that people see only their own data, and a private area for licence certificates. Card numbers are entered into Stripe and do not pass through our servers. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

Your rights

Under the UK GDPR you can ask to see your data, correct it, erase it, restrict or object to how we use it, take a copy in a portable format, and withdraw consent at any time. Withdrawing consent does not affect what we did before you withdrew it.

Write to privacy@tattooinn.com. We reply within one month. If your request is complex we may take up to two months longer, and we will tell you. It is free. We may ask you to prove who you are.

Deleting your account: there is no delete button yet, so ask us by email. If you have a booking with a deposit paid and the session still to come, we ask you to cancel it or finish it first. We then erase your name, email, saved items and messages. We keep signed consent forms and money records for the periods above, with money records held against an anonymous ID, because the law and insurers need them. We tell you exactly what we will erase and keep before we do it.

Taking a photo down: if you are a client and do not want your tattoo shown on TattooInn, write to privacy@tattooinn.com with a link to the photo and we will remove it. If you are an artist and someone has used your work without permission, send us the link and evidence it is yours. We take the work down while we look into it.

Cookies and similar tools

We set no advertising, analytics or tracking cookies, so there is no cookie banner. Our own cookies are needed to run the service.

_tattooinn_key: our session cookie. It keeps you signed in and protects forms from forgery. Your browser removes it when you close it.
_tattooinn_web_user_remember_me: set only if you tick stay signed in. It lasts 14 days.
Stripe: Stripe's script is loaded on every page and may set Stripe's own cookies, or read device signals, to take payments and prevent fraud. We use Stripe only to take payments. These cookies are set by Stripe under its own policy, and you can block them in your browser without losing access to TattooInn other than the payment pages.
Google Fonts, OpenStreetMap and unpkg.com set no cookies for us, but they receive your IP address when your browser loads from them.

Pages also use your browser's session storage for technical housekeeping, such as reconnecting a live page. It holds no personal data and is cleared when you close the tab.

Complaints

Tell us first at privacy@tattooinn.com and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you may go to court.

Changes to this policy

If we change this policy in a way that matters, we will tell signed-in users by email before it applies. The date at the top shows when it last changed.