Privacy policy

Space Tattoo is a platform for tattoo artists: artists create a link page and a booking page with us and manage their appointments and clients. This policy covers our website and the use of Space Tattoo by artists.

On an artist's public link and booking pages, that artist is the controller of your data. We only process this data on the artist's behalf (Art. 28 GDPR). See the section “Artists' link and booking pages” for details.

Space Tattoo is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. All application data, i.e. the database, uploaded images and logs, is stored on a server in a data centre in Germany.

Hetzner processes the data solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR) and, if you use Space Tattoo as an artist, the performance of our contract with you (Art. 6(1)(b) GDPR). More information: hetzner.com/legal/privacy-policy

To deliver a page, our server necessarily processes your IP address, the date and time, the requested address and details about your browser and operating system. We do not keep access logs containing IP addresses.

To prevent abuse, such as mass login attempts, we limit the number of requests per IP address. For this, the IP address is cached as a hash for a few minutes.

If a technical error occurs, the application logs it so we can fix it. We delete these error logs after eight weeks at the latest.

The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR).

The connection to Space Tattoo is encrypted via TLS (HTTPS), so third parties cannot read the data you send us.

We only use cookies that are technically necessary, never for analytics, tracking or advertising. That's why there is no cookie banner. The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR or, when you are logged in, Art. 6(1)(b) GDPR.

• Session (space-tattoo-session): keeps your session, login and language; expires after two hours of inactivity.
• Form protection (XSRF-TOKEN): protects forms against forged requests; same lifetime as the session.
• Remember me (remember_web_…): only if you choose it when logging in; keeps you logged in for up to 400 days.
• Appearance (appearance): remembers the light or dark theme if you change it; one year. Also kept in your browser’s local storage.
• View (sidebar_state, appointments_calendar_view): only in the logged-in area; remembers the sidebar and calendar view; one year.

For each session we also store your IP address and browser identifier on the server to secure the session. This information is deleted when the session expires.

We do not use any analytics, tracking or advertising services and do not embed third-party content such as videos, maps or social media plugins. Fonts and icons are served from our own server, so visiting our pages never connects you to Google Fonts or any other provider.

When you register as an artist, we process your name, your email address and your password, which we only store as a hash. If you enable two-factor authentication, we store the required secret and your recovery codes in encrypted form.

On top of that comes the content you create in Space Tattoo, such as your artist name, links, booking form, availability, design, images, appointments and clients. We process this data to provide Space Tattoo to you (Art. 6(1)(b) GDPR). You are the controller of your clients' data; we process it on your behalf.

When you accept our terms of service, we store their version together with the time, IP address and browser identifier so that we can prove the contract was concluded (Art. 6(1)(b) and (f) GDPR).

We keep your data for as long as your account exists. You can delete your account at any time in the settings. The associated data is then deleted unless statutory retention obligations apply.

If you join our waitlist, we store your email address and the language you used our site in. We only use the address to let you know when your access is ready. The legal basis is your request to be informed (Art. 6(1)(b) GDPR).

So that nobody can sign up someone else, we first send you an email with a confirmation link (double opt-in). You are only on the list once you click it. We store when you confirmed, so we can prove that you asked to be notified (Art. 6(1)(f) GDPR). If you do not confirm your address within 7 days, we delete the entry automatically.

You can ask us by email to remove you at any time. We delete your entry at the latest once we have told you about your access.

If you write to us via the contact form or by email, we process your name, your email address and your message to answer your request (Art. 6(1)(b) or (f) GDPR).

We don't store messages from the contact form in our database but forward them to our inbox by email (sent via Resend, see “Sending emails”). We delete this information once your request has been dealt with, unless statutory retention obligations apply.

Space Tattoo sends emails through the service Resend (Resend, Inc., USA). These include, for example, confirming your email address, resetting your password, and appointment confirmations and reminders that artists send to their clients. The recipient’s address, the content of the message and technical delivery data are processed.

We have concluded a data processing agreement with Resend. Transfers to the USA are covered by the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is the performance of the respective contract (Art. 6(1)(b) GDPR) and our legitimate interest in reliable email delivery (Art. 6(1)(f) GDPR). More information: resend.com/legal/privacy-policy

As an artist, you can optionally connect your Google Calendar so busy times are taken into account for bookings and shown in your calendar. To do so, you sign in with Google and grant us read-only access to your calendars. We store the access tokens issued by Google and your calendar selection. We don't store events from your Google Calendar permanently, only cache them for up to 30 minutes.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). You can disconnect at any time in the settings or revoke access in your Google account. More information: policies.google.com/privacy

Space Tattoo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you visit an artist's link or booking page or send a booking request there, that artist is the controller under the GDPR. We provide the technology and only process the data on the artist's behalf and instructions (Art. 28 GDPR).

A booking request processes whatever the artist's form asks for, such as your name, email address, phone number, your answers, your preferred date and uploaded reference images. If you accept a consent text of the artist, we store the text together with the time, your IP address and browser identifier as proof.

We count clicks on the links of a link page pseudonymously per session so artists can see how often a link is used. No profile of you is created.

Questions about this data and requests to exercise your rights are best sent directly to the artist. If you contact us, we will forward your request.

We do not sell your data or pass it on for advertising. The only recipients are the service providers named above (Hetzner, Resend and, if connected, Google) and, for booking requests, the respective artist. Beyond that, we only disclose data where we are legally required to.

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• have inaccurate data rectified (Art. 16 GDPR)
• have your data erased (Art. 17 GDPR)
• restrict processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)

Just send us an email. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You are not obliged to provide us with any data. For a user account, however, we need your name, email address and password; without them we can't create an account for you. We do not use automated decision-making, including profiling (Art. 22 GDPR).

We update this privacy policy when Space Tattoo or the legal situation changes. The version published here always applies.