Privacy Policy

1. Who we are

The Service is operated by 18040184 Canada Inc., a corporation incorporated under the Canada Business Corporations Act, doing business as “TatBrief.” For privacy or data-protection inquiries, contact us at hello@tatbrief.com.

2. Scope and roles

TatBrief serves two kinds of users:

• Artists: tattoo professionals who create an account, manage submissions, and share a public consultation link with their clients.
• Clients: the end users (tattoo customers) who complete a consultation through an Artist’s public link.

For Artist account data, TatBrief acts as the data controller. For data Clients submit through an Artist’s consultation link, the Artist is the controller of the resulting brief and TatBrief acts as a processor on the Artist’s behalf to collect, transmit, and store it.

3. Information we collect

3.1 Artist account information

• Account credentials managed by our authentication provider (Supabase Auth): email address and a hashed password.
• Profile details you enter: display name, public profile slug, notification email, language preference, and profile image if you upload one.
• Operational metadata: account creation and update timestamps, account status.

3.2 Billing and subscription information

When you subscribe, we store the information we need to run your subscription:

• Identifiers issued by our payment processor (Stripe), such as a customer ID and a subscription ID, which let us link your account to your billing record.
• Subscription state: status (for example trialing, active, past due, or cancelled), the date your current billing period ends, and the date your free trial ends.
• Referral information: your referral code, the code you signed up with (if any), and a ledger of the referral credits applied to your account.

We never receive or store your full payment card number. Card details are entered directly with Stripe, which is a PCI-compliant payment processor, and are held by Stripe rather than by us.

3.3 Client information collected through consultations

When a Client completes a consultation through an Artist’s public link, we collect the following on the Artist’s behalf:

• Contact details: first name and email address (required to send the completed brief to the Artist).
• Consultation responses: free-text descriptions of the desired tattoo, placement, sizing, style preferences, intent, hard rules, budget, timeline, prior tattoo experience, artist familiarity, and concerns.
• Body and skin context: placement on the body, skin tone, scarring or coverup context, and a self-reported pain tolerance rating. This information is used to produce the brief and is general preference data, not medical records.
• Reference images: images you upload, including any photos of the area of your body you want tattooed, reference URLs you share (for example, links to public boards), and any annotations you make on those images.
• Conversation log: the back-and-forth exchange between you and our AI-assisted consultation flow, used to compile the final brief and to improve the experience.

3.4 Information collected automatically

• Authentication session storage: our authentication provider stores a session token in your browser’s local storage so you can stay signed in. This is required for the Service to function and is not used for advertising.
• Server logs: our servers may record basic operational events (request paths, error messages, and timestamps) for troubleshooting and security monitoring.

3.5 Signup and contact information

If you create an account or email us, we collect the email address you provide and the contents of your message so we can respond and provide the Service.

3.6 What we do not collect

We do not run third-party advertising, tracking pixels, or cross-site analytics on our website. We do not collect payment card numbers, as described in section 3.2.

4. How we use information

• To create and operate Artist accounts.
• To run consultations, generate structured briefs, and deliver those briefs to the Artist.
• To administer subscriptions: to start and end free trials, charge and renew subscriptions, apply referral credits, and keep your billing status accurate.
• To send service-related notifications (such as completed brief emails, trial and billing notices, password resets, and security alerts).
• To improve the Service, debug issues, and protect against fraud or abuse, including abuse of the referral program.
• To comply with legal obligations.

We do not sell personal information. We do not use Client consultation content to train AI models, and our AI provider does not train its models on the inputs we send it.

5. Legal bases (where applicable)

For users in jurisdictions that require a legal basis for processing, we rely on:

• Contract: to provide the Service you have requested and to bill for it.
• Legitimate interests: to secure, maintain, and improve the Service.
• Consent: where we ask for it explicitly (for example, to receive marketing emails).
• Legal obligation: to comply with applicable law, including tax and accounting requirements.

6. Service providers and subprocessors

We rely on a small number of trusted third parties to operate the Service. These providers process information only on our instructions and under contractual confidentiality and security obligations.

We may add, remove, or change subprocessors as the Service evolves and will update this list when we do.

7. International data transfers

The providers above operate in Canada, the United States, and other regions. By using the Service you understand that your information may be processed and stored outside of the country in which you reside, including in jurisdictions whose data protection laws differ from your own. Where required, we rely on contractual safeguards (such as standard contractual clauses) provided by our subprocessors.

8. Data retention

We retain personal information for as long as is necessary to provide the Service, satisfy the purposes described in this policy, comply with our legal obligations, and resolve disputes.

• Submissions. When an Artist deletes a brief, it moves to Trash and is retained for 30 days, during which the Artist can restore it. After 30 days it is permanently deleted, along with the associated images in our object storage.
• Lapsed accounts. If a subscription lapses, the account and its Submissions are retained rather than deleted, so that an Artist who reactivates returns to the same consultation link and their existing briefs.
• Billing records. Invoices and transaction records are retained for as long as required by applicable tax and accounting law, even after an account is closed.
• Account deletion. Artists may request deletion of their account and the associated Submissions at any time by contacting us. Clients may request that we work with the relevant Artist to delete a specific submission they made through that Artist’s consultation link.

When information is no longer required, we delete it or render it anonymous. Backups containing deleted information are overwritten as part of our normal backup rotation.

9. Security

We use industry-standard safeguards to protect personal information, including encrypted transport (HTTPS/TLS), encrypted storage at rest through our database and object storage providers, hashed passwords, database access rules that limit each Artist to their own records, time-limited signed URLs for image access, and access controls that limit who can see Client data to the relevant Artist and our authorized operators. No method of electronic transmission or storage is perfectly secure; we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify you as required by applicable law.

10. Your rights

Depending on where you live, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information.
• Object to or restrict certain processing, or withdraw consent where we rely on it.
• Receive a portable copy of information you provided to us.
• Lodge a complaint with your local data protection authority. In Canada, that is the Office of the Privacy Commissioner of Canada, and in Alberta, the Office of the Information and Privacy Commissioner of Alberta.

To exercise any of these rights, email us at hello@tatbrief.com. We may need to verify your identity before responding. If you are a Client and your request relates to a brief you submitted through an Artist’s link, we will coordinate the request with that Artist.

11. Children

The Service is intended for adults (18 years of age or older). We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, please contact us so we can delete it.

12. Cookies and similar technologies

We use a small number of strictly necessary storage mechanisms to keep Artists signed in (such as authentication tokens stored in your browser’s local storage). We do not use cookies or similar technologies for advertising, profiling, or cross-site tracking.

When you go through checkout or open the billing portal, those pages are hosted by Stripe, which sets its own cookies to process the payment and prevent fraud. That processing is governed by Stripe’s privacy policy.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or in-product notice. Your continued use of the Service after the changes take effect means you accept the updated policy.

14. Contact

Questions, requests, or complaints about privacy can be sent to hello@tatbrief.com.

See also our Terms of Service.