Last updated: October 2026
The controller is Janek Mazur, Sopot, Poland, operating as a natural person. Contact: contact@link.tattoo.
link.tattoo handles two quite separate sets of information, and our legal role differs between them.
| Whose data | Our role | What that means |
|---|---|---|
| The artist’s — account, email, page content | Controller | We decide why and how it is used, and this notice governs it. |
| The client’s — booking requests sent to an artist | Processor | The artist decides why it is collected and what happens next. We store and deliver it on their behalf. |
In plain terms: if you sent a booking request, the artist is responsible for your information and you should contact them first. We will help.
All of it goes to the artist you contacted. We do not use it to market to you and we do not sell it.
Please do not put medical details in the form. The form only asks for a simple “yes” or “no” on whether you have a health condition or allergy to discuss. Do not type specific medical diagnoses into any text boxes. If you need to tell an artist about a skin condition, medication, or pregnancy, tell them directly in the DMs or via email once they reply. Health information is a special category under GDPR, and our database is specifically designed not to collect or hold it.
| What | Basis |
|---|---|
| Running your account and page | Performance of a contract |
| Delivering a booking request to an artist | Legitimate interests of the artist and the client, as processor on the artist’s instructions |
| Keeping the service secure and working | Legitimate interests |
| Anonymous usage measurement (section 7) | Legitimate interests |
| Launch email to people who reserved a handle | Consent |
| Who | What they hold | Where |
|---|---|---|
| Google (Firebase) | Accounts, page data, booking settings, booking requests | United States (nam5 region). Transfers outside the EEA are governed by Standard Contractual Clauses and the EU-US Data Privacy Framework. |
| Our hosting provider | The website files, and uploaded images on disk | GoDaddy (United States/Global) |
| The artist you contacted | Your whole request | Their dashboard, and wherever they choose to reply from |
Your data leaves the EU. Our database runs in Google’s nam5 region in North America and our web host is GoDaddy, so what you type into a booking request, and any photos you attach, are physically stored in the United States. Google covers this transfer under its Standard Contractual Clauses and its certification under the EU-US Data Privacy Framework; GoDaddy under its own Standard Contractual Clauses. We say this plainly because the GDPR requires it, and because you should know where your data is.
No advertising networks. No data brokers. Nothing is sold.
Photographs are stripped of EXIF metadata on upload, including any GPS coordinates your phone attached. That happens before the file is stored, so a location tag on a photo of your arm does not survive the upload.
We set no cookies. The site uses browser storage (localStorage
and IndexedDB) to keep you signed in and to remember editor settings such
as which requests you have read. That is necessary for the service to
work.
We keep anonymous usage counts for our own measurement
only: which screens of the booking form are reached and left, how long
they take, which dashboard features are used. This runs on our own
server. No third party receives it, there is no cross-site tracking and
there is no advertising network. A record contains the event, the screen,
a session identifier that is generated per browser tab and discarded when
the tab closes (sessionStorage), a device class (phone,
desktop, or Instagram’s in-app browser), the domain you arrived from, the
artist’s public handle and, if you are a signed-in artist, your account
identifier. It never contains an answer you typed, a name, an email
address, a phone number or a photograph. Your IP address is not stored; a
salted hash of it that changes every day is kept so that visitors can be
counted without being identified or followed from one day to the next.
Retention of these records is not yet limited. They are currently kept until deleted by hand. Automatic deletion after 13 months is being introduced.
Typefaces are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser requests them when a page loads, which sends your IP address to Google. We are moving the fonts onto our own server. The service itself runs on Google Firebase (section 5), so your browser also connects to Google’s servers to load page data and to sign in; that is necessary to provide the service.
We do not use Google Analytics or any other third-party analytics. There is no cookie banner: we set no cookies and run no third-party analytics or advertising, so there is nothing to consent to. The Google Fonts request above is the one open item, and it is being removed rather than consented.
Under GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, ask us to restrict it, or ask for it in a portable format. You can also withdraw consent where consent is the basis.
Email contact@link.tattoo and we will respond within one month. If you are a client, contact the artist you sent the request to first — they decide what happens to it. We will pass on a request that reaches us.
You can complain to your data protection authority. In Poland that is the Prezes Urzędu Ochrony Danych Osobowych (UODO).
The service is for people aged 18 and over. Tattooing minors is restricted or banned in most places, and artists set their own rules on the form. We do not knowingly collect information about children; if you believe we have, tell us and we will remove it.
Access to accounts and requests is controlled by server-side rules: a booking request can only be read by the artist who received it. Traffic is encrypted in transit. Uploaded images are re-encoded on arrival, which removes embedded metadata.
No system is perfectly secure. If a breach affects your rights we will notify the supervisory authority within 72 hours and tell you where required.
We will update this notice as the product changes and update the date at the top. For material changes we will tell you in the dashboard or by email.