Privacy Policy

1. Who we are

Tattou LTD ("Tattou", "we", "us", "our") is the data controller for personal information collected through tattou.co and related services (the "Platform"). We're registered in England and Wales (Company No. 16564819), registered office Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE.

If you have questions about this policy or how we handle your data, contact us at hello@tattou.co.

2. What information we collect

2.1 Information you give us

• Account details: name, email, password, business details (for artists/studios)

• Profile content: portfolio images, flash designs, bio, pricing, availability

• Booking information: quotes, messages, appointment details

• Payment information: processed by Stripe; we do not store full card details ourselves

• Consent and health form responses: submitted by clients as part of a booking (see Section 6, this is treated with additional care)

• Identity verification information: submitted to Stripe as part of onboarding artists/studios for payments

2.2 Information collected automatically

• Device and usage information (browser type, IP address, pages visited)

• Cookies and similar technologies (see our Cookie Policy)

3. How we use your information

We use your information to:

• Provide and operate the Platform (accounts, bookings, quotes, messaging, payments)

• Process deposits and subscription payments via Stripe

• Send transactional communications (booking confirmations, account notifications)

• Provide customer support

• Maintain the security and integrity of the Platform

• Calculate and administer the referral program, where applicable

• Meet our legal and regulatory obligations

We do not sell your personal information.

4. Legal basis for processing

We process personal data on the following bases:

• Contract — to provide the services you've signed up for (accounts, bookings, payments)

• Legal obligation — for example, retaining certain records for tax or consumer protection purposes

• Legitimate interests — for example, maintaining platform security, preventing fraud, and improving our services

• Consent — for certain communications and, where applicable, non-essential cookies

If you're in the UK, these bases are the ones recognised under UK GDPR. If you're in the US, we rely on the same practical grounds (providing the service you asked for, meeting legal obligations, and legitimate business interests), consistent with applicable state privacy laws.

5. Payment information

Payments are processed by Stripe. Tattou does not store your full card details. Deposits for bookings are routed via Stripe Connect directly to the relevant artist's or studio's connected account. Stripe's own privacy policy applies to the information they process on our behalf.

6. Consent forms and health information

Where a booking requires a consent or health form, the information you provide (such as allergies or medical conditions relevant to the tattoo) is encrypted and stored securely, and is only accessible to the artist or studio you're booking with, and to Tattou where necessary for the operation or security of the Platform.

Retention: Consent form data linked to a completed booking is retained for 7 years from the date of the appointment (rather than the date of any later account deletion), to allow artists and studios to maintain adequate records in case of a future dispute or claim. After that retention period ends, we retain only a limited record (the form title and completion date) as proof that a consent form was completed, and the underlying answers are permanently deleted.

7. How we share your information

We share information with:

• Artists and studios you interact with — booking details, messages, and consent form responses relevant to your appointment

• Stripe — for payment processing and identity verification

• Service providers who help us operate the Platform (hosting, email delivery), under appropriate confidentiality and data protection terms

• Law enforcement or regulators, where required by law

We do not share your personal information with third parties for their own marketing purposes.

8. Your rights

If you're in the UK, UK GDPR gives you the right to:

• Access the personal information we hold about you

• Correct inaccurate information

• Request deletion of your information (see Section 9)

• Object to or restrict certain processing

• Request a copy of your data in a portable format

• Withdraw consent where processing is based on consent

You also have the right to complain to the UK's Information Commissioner's Office (ICO) if you believe we've mishandled your data.

If you're in the US, depending on your state of residence (including California under the CCPA/CPRA, and similar laws in other states), you have the right to:

• Know what personal information we've collected about you and why

• Access a copy of that information

• Correct inaccurate information

• Request deletion of your information (see Section 9)

• Opt out of the "sale" or "sharing" of personal information — we do not sell your personal information for money, and do not share it for cross-context behavioural advertising

• Not be discriminated against for exercising any of these rights

You may also designate an authorised agent to make a request on your behalf, and you have the right to appeal if we decline a request.

To exercise any of these rights, email hello@tattou.co. We'll verify your request and respond within the timeframe required by the law that applies to you.

9. Account deletion

You can request deletion of your account at any time.

• Deletion requests are subject to a 30-day grace period, during which you can cancel the request.

• After the grace period, your account is anonymised: your name and contact details are removed or replaced, your password is cleared, and your account is deactivated.

• Messages, notifications, favourites, and internal notes about you are permanently deleted.

• Booking and payment records are retained but anonymised, keeping only what's required for legal, tax, and accounting purposes (amounts and dates, with personal details removed).

• Reviews you've written are retained, with your name removed and replaced with "Deleted user."

• Consent form data is handled per the retention rules in Section 6 above, regardless of when your account is deleted.

Business accounts (artists/studios) with an active subscription or upcoming confirmed bookings may need to resolve these before a deletion request can be completed.

10. Data security

We take reasonable technical and organisational steps to protect your information, including encrypting sensitive data such as consent form responses. No system is completely secure, and we can't guarantee absolute security, but we work to keep your information protected and to respond quickly if something goes wrong.

11. International transfers

Tattou operates across the UK and US, so personal data may be transferred between these countries and to service providers based elsewhere. Where we use service providers based outside the UK, we ensure appropriate safeguards are in place in line with UK GDPR requirements, regardless of which country your account is based in.

12. Children's data

Tattou is not intended for use by anyone under 18. We don't knowingly collect information from children.

13. Changes to this policy

We may update this policy from time to time. We'll let you know of material changes, and the "last updated" date at the top will always reflect the current version.

14. Contact us

Questions, requests, or complaints about how we handle your data: hello@tattou.co.

Tattou LTD, registered in England and Wales (Company No. 16564819). Registered office: Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE.