Privacy Policy

1. Who controls your information

The data controller for the Service is the operator of AI Tattoos, an online service at aitattoos.art. For privacy questions, access requests, deletion requests, or complaints, contact support@aitattoos.art. We do not appoint a separate data protection officer for this small service at this time.

2. Information you provide

Depending on how you use the Service, we may collect:

• Account information such as your email address, display name if provided, password hash, authentication status, and account recovery information. We do not store your password in plain text.
• Guest workspace information such as a session identifier, recovery-key hash if you create one, prompts, settings, favorites, generated designs, and credit activity.
• Creative Inputs such as prompts, text, reference images, body photos, masks, and other files you upload for a requested tattoo task.
• Orders and billing information such as plan, billing interval, amount, currency, order reference, payment status, billing email, and subscription dates. Complete card numbers are handled by Waffo Pancake and are not stored on our server.
• Messages you send to support, including the email address and information needed to investigate your question.

3. Information collected automatically

When you use the Service, our server may record an IP address, browser and device characteristics, request times, error details, rate-limit events, and security events. An essential HttpOnly session cookie identifies the current workspace. Browser storage may keep interface preferences and draft form data on your device. We currently do not run advertising pixels or third-party analytics trackers on the public site.

4. How we use information

We use information for the following purposes:

We may use aggregated or de-identified information for reliability and product decisions when it cannot reasonably identify you. We do not sell personal information.

5. AI generation, email, and payment providers

When you request live image generation, we send the prompt and the reference images required for that task to the LinoRoute gateway and the selected model. The provider must receive enough information to return the requested result. We also use Resend to deliver account verification, sign-in, and password-reset emails; Resend receives the recipient email, message content, and delivery metadata. When paid checkout is live, Waffo Pancake processes payment and may receive checkout, billing, and order details. These providers may process data in countries different from yours.

6. Sharing and disclosure

We share information only as needed to operate the Service or when permitted by law:

• Service providers that host the application, store media, send email, provide AI generation, or process payment. They may process information only for the services they provide to us and under their own privacy terms.
• Authorities, courts, or advisers when disclosure is required by law, needed to protect rights and safety, or necessary to investigate fraud or abuse.
• A successor or buyer if the Service is reorganised, merged, or transferred, provided that the recipient assumes the applicable privacy obligations.
• Other recipients only with your direction or consent.

We do not sell your personal information or share it for cross-context behavioural advertising.

7. Cookies and local storage

The essential session cookie is used to keep you signed in or keep a guest workspace available. It is HttpOnly, uses the Secure flag on the live HTTPS site, and uses SameSite protection. It cannot be disabled while using the core workspace. Local storage can remember interface preferences and drafts. Waffo may set its own cookies on its hosted checkout; review Waffo's policy when you leave AI Tattoos to pay.

8. Security

We use HTTPS/TLS in transit, hash passwords and recovery keys, limit access to production data, rate-limit sensitive actions, and keep payment card details off our server. No online system is completely secure. If we confirm a breach that legally requires notice, we will notify affected people and regulators without undue delay and target notice within 72 hours where that timeframe is required or appropriate.

9. Retention and deletion

We keep account and workspace information while it is needed to provide the Service. You can delete an account from the account controls after canceling active renewals. Account deletion removes the account identity, sessions, recovery key, and saved media from active storage; cleanup of backups may take up to 90 days. We retain transaction and tax records for the period required by law, generally up to seven years, and may retain a minimal record of a refund, dispute, or security event. Support records are normally kept for up to two years and security logs for up to twelve months. Email verification challenges are usable for ten minutes and are cleaned up after they expire.

10. Your privacy rights

Subject to the law where you live, you may ask us to confirm whether we process your information, provide a copy, correct inaccurate data, delete it, restrict or object to processing, or provide a portable copy. You may withdraw consent for optional marketing at any time. To make a request, email support@aitattoos.art from the account email and describe what you need. We may verify identity before completing a request and normally respond within 30 calendar days, or tell you why more time is needed. You may also complain to your local data protection authority.

11. International processing

AI Tattoos is operated from a server in the United States, and our providers may operate in the United States or other countries. When information crosses a border, we use contractual, technical, and organisational safeguards appropriate to the transfer and applicable law. By using the Service, you understand that processing may occur outside your country.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact support@aitattoos.art and we will take reasonable steps to delete it.

13. Policy changes and contact

We may update this policy when our data practices, providers, or legal obligations change. We will update the date above and, for a material change, provide reasonable notice through the Service or to a registered email address. Questions and requests can be sent to support@aitattoos.art.