Tattoo CRMBack to the app

Privacy policy

Last updated: October 3, 2026

1. Controller

Joel Meyer
15 rue Charles Landelle
53000 Laval
France

Email: mail@joelmeyertattoo.com

2. Who this privacy policy is for

It applies to the users of Tattoo CRM: tattoo and piercing studios, their owners, and the artists and staff who have an account.

Data about a studio's own clients (e.g. contact details, appointments, consent forms, messages) is processed on behalf of that studio (Art. 28 GDPR). The studio is the controller for it; clients find the details in the studio's own privacy notice.

3. What we process and why

Account and studio. Name, email address, profile picture, role in the studio, settings and the studio's details. Purpose: providing Tattoo CRM. Legal basis: contract (Art. 6(1)(b) GDPR).

Sign-in and security. Email address, password (stored only in hashed form), session data, IP address to prevent abuse (e.g. limiting sign-in attempts). New passwords are checked against known data breaches (Have I Been Pwned); only a short part of a hash is sent, never the password itself. Legal basis: contract and our legitimate interest in a secure service (Art. 6(1)(b) and (f) GDPR).

Billing. The studio's billing details, subscription status and payment events. Card data is processed by Stripe only, never by us. Legal basis: contract and statutory retention duties (Art. 6(1)(b) and (c) GDPR).

Emails. We send sign-up, password-reset and notification emails via Resend. Legal basis: contract (Art. 6(1)(b) GDPR).

Push notifications. If you turn them on, we store the address your browser provides for them. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.

Studio search during setup. If you search for your studio on Google during setup, we pass the name you type and your country to Google (Places API) through our server and take over the public details of the listing you pick (address, phone, website, opening hours) and its Google identifier. Legal basis: contract (Art. 6(1)(b) GDPR). You can enter the details yourself instead.

Connected services. Only if the studio connects them itself: Google Calendar, Google Drive, Mailchimp, Meta (ads, WhatsApp). We store the access keys and identifiers needed. Legal basis: contract (Art. 6(1)(b) GDPR). Disconnecting deletes them.

AI features. For reply suggestions, translations and summaries we send text to OpenAI. Names and contact details are replaced by placeholders first (pseudonymisation); the studio is only identified by an encrypted identifier. OpenAI does not store the requests and does not use them for training. Health information from consent forms and photos are never sent to OpenAI. The AI features are optional and can be turned off in the studio settings.

Feedback. If you write to us through the feedback feature, we store your message and any screenshots to handle it (Art. 6(1)(b) and (f) GDPR).

Technical logs and performance measurement. When the app is used, our hosting provider processes technically necessary data (IP address, time, page requested) for operation and troubleshooting. We measure loading times with Vercel Speed Insights, which sets no cookies and builds no user profiles. Legal basis: legitimate interest in a stable, fast service (Art. 6(1)(f) GDPR).

4. Cookies

We only use cookies that are strictly necessary: for signing in, the last selected studio and the language. They are required to use the service, so no consent is needed for them. We do not use tracking or advertising cookies.

5. Recipients and processors

We use the following providers, each under a data processing agreement:

  • Supabase – database, authentication, file storage (server location: [to be confirmed])
  • Vercel – application hosting (USA)
  • Resend – email delivery (USA)
  • Stripe – payment processing (Ireland/USA)
  • OpenAI – AI features (USA)
  • Google – studio search during setup; Calendar and Drive only if the studio connects them
  • Meta, Mailchimp – only for services the studio connects

6. Transfers outside the EU

Some providers are based in the USA. Transfers rely on the EU-US Data Privacy Framework where the provider is certified and/or the EU Standard Contractual Clauses (Art. 46 GDPR).

7. How long we keep data

  • Account: until it is deleted. Deleting your account removes your personal data; your name stays on the studio's records (e.g. appointments) so the studio can tell who did a tattoo.
  • Studio: deleting a studio freezes it for 30 days, during which it can be restored; after that all of the studio's data is deleted for good.
  • Our own billing records: 10 years (statutory retention).
  • Security logs: at most 12 months.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Contact mail@joelmeyertattoo.com.

You may also lodge a complaint with a data protection supervisory authority, in particular in the member state where you live.

9. Required data, no automated decisions

To use Tattoo CRM we need at least your email address and a password. We do not make automated decisions within the meaning of Art. 22 GDPR.

10. Changes

We update this privacy policy when the service changes. The version published here applies.