Privacy Policy
Tattoo Pack Privacy Policy
Version 2.1 — September 17, 2026. Replaces version 2.0 dated September 16, 2026.
1. Controller.
Alex Vasilevko, a sole proprietor registered in Poland's CEIDG; ul. Orzechowa 4, 55-093 Brzezia Łąka, Poland; NIP 7972058054. Contact for all privacy matters: help@alex666cold.com. No Data Protection Officer has been appointed because Art. 37 GDPR does not require one here.
- Legal name
- Alex Vasilevko (sole proprietorship, CEIDG, Poland)
- Address
- ul. Orzechowa 4, 55-093 Brzezia Łąka, Poland
- NIP
- 7972058054
- help@alex666cold.com
2. What we process, why we process it, our legal basis, and how long we keep it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Image you upload | Build the package or stencil you requested | Art. 6(1)(b) — steps taken at your request | Processed in memory and never stored on our servers. Passes through Google Cloud Run and, for stencils, Google's Gemini API |
| Generated result files (PNG) | Let you download the package | Art. 6(1)(b) | 24 hours, then deleted automatically |
| Package record: job ID, brand, mode, filenames, sizes, timing, and your email if signed in | Show your recent packages; provide support; investigate abuse | Art. 6(1)(b); Art. 6(1)(f) | 12 months, then deleted automatically |
| Email address | Sign you in, list your packages, enforce the limit of two stencils per UTC day, and send service notices (new features, plan launches, changes to the terms, stencil availability) | Art. 6(1)(b) | As long as your account exists; you can delete it at any time |
| Six-digit sign-in code (stored only as a salted hash) | Authentication | Art. 6(1)(b) | 15 minutes |
| Session token (stored only as a hash) | Keep you signed in | Art. 6(1)(b) | 30 days |
| Rate-limit counters keyed to your IP address | Prevent abuse and keep the free service available | Art. 6(1)(f) — our legitimate interest in service integrity | Up to 1 hour |
| Gallery submission: derived sheets, package ID, email, brand, mode, moderation status | Publish your work as a public example | Art. 6(1)(a) — your consent | Until you withdraw consent; a minimal removal record is kept for 3 years |
| Consent record: text version, locale, timestamp, hashed IP, hashed user-agent | Demonstrate consent as required by Art. 7(1) | Art. 6(1)(c) with Art. 7(1); Art. 6(1)(f) | Consent record: 3 years after withdrawal. Hashed IP and user-agent: 30 days |
| Review or idea: public display name, text, type, locale; private email; hashed IP | Publish artist feedback | Art. 6(1)(a) — your consent | Until you delete it. Hashed IP: 30 days |
| Abuse reports and moderation log | Comply with the Digital Services Act and handle complaints | Art. 6(1)(c); Art. 6(1)(f) | 6 months after the decision |
| Stencil allowlist: email, date added, administrator email, optional note | Waive the daily stencil limit for selected artists | Art. 6(1)(b) | Until removed from the list or account deletion |
| Stencil usage per account: month, number of stencils, estimated cost | Track generation costs and keep the free tier sustainable | Art. 6(1)(f) — our legitimate interest in cost control | As long as your account exists; deleted with the account |
| Public counters (users, stencils, ink breakdowns) | Show aggregate usage | Aggregate totals only — not personal data | Indefinitely |
| Security and error logs at our hosting providers (IP, user-agent, request metadata) | Security, abuse prevention, debugging | Art. 6(1)(f) | Up to 30 days |
Providing your email address is not a statutory requirement. Without it, you can still build a package, but you cannot sign in, view past packages, generate stencils, submit to the gallery, or leave feedback. Every account receives service notices about how the service works: new features, plan launches, changes to the terms, and stencil availability. Promotions and partner offers are sent only if you opt in, and you can withdraw that consent at any time on your Account page. We do not use automated decision-making that produces legal or similarly significant effects, and we do not profile you (Art. 22 GDPR). We do not collect personal data about you from third parties, so Art. 14 GDPR does not apply.
3. Recipients, processors and international transfers.
- Cloudflare, Inc. — hosting (Workers), database (D1), sessions (KV) and file storage (R2). Acts as our processor under Cloudflare's Data Processing Addendum. Content is served from a global edge network, so processing may occur outside the EEA; transfers rely on the Standard Contractual Clauses incorporated into that Addendum.
- Google Cloud (Google Cloud EMEA Ltd.) — our package-processing service runs on Cloud Run in the europe-west1 region. Google Cloud acts as a processor under its Data Processing Addendum; transfers outside the EEA rely on the Standard Contractual Clauses.
- Google — Gemini API (stencil generation). If you request a stencil, your image and a fixed text prompt are sent to Google's Gemini image model and the generated stencil is returned. Google processes this content as our processor under the paid-tier Gemini API terms, does not use it to train its models, and retains it only transiently for abuse detection. Processing may take place outside the EEA under the Standard Contractual Clauses.
- Resend (email delivery, EU region) — receives your email address and sign-in code and delivers our emails to you. Resend acts as a processor under its DPA.
- Stripe — donations run through an external Stripe Payment Link. Stripe is an independent controller for that payment, not our processor, and its own privacy policy applies. We never receive or see your card details; we can see the amount, the date and the email address you gave Stripe.
- We do not sell or rent personal data, serve ads, or use analytics or tracking services. You may request a copy of the transfer safeguards listed above by writing to help@alex666cold.com.
4. Cookies and browser storage.
We use only strictly necessary cookies and storage set at your request. Under Art. 396 of the Polish Electronic Communications Law (PKE) and Art. 5(3) of the ePrivacy Directive, these do not require consent, so we inform you instead of asking for it.
- tp_session — cookie, HttpOnly, Secure, SameSite=Lax, 30 days. Keeps you signed in.
- tp_locale — cookie, 1 year. Stores the language you selected; set only when you choose a language.
- IndexedDB database tattoo-pack, store originals — keeps your uploaded image inside your browser only so a stencil can be generated in one click without re-uploading. It is never stored on our servers. It is removed automatically once the stencil is generated or after 24 hours, and you can erase it at any time through your browser's site-data settings.
- There are no analytics, advertising, social or third-party tracking cookies of any kind.
5. Gallery.
Publication is optional and requires a separate, versioned opt-in for each package. Only derived sheets (stencil, palette sheet, ink breakdown, ink map, and tone maps) can be shown; your original upload is never published. We review every submission before it appears. You may withdraw consent at any time from your Account page; we will unpublish the example and remove the stored file. Withdrawal does not affect processing carried out before it (Art. 7(3) GDPR). Do not submit recognizable faces, photorealistic portraits, or anything else that identifies a client—you are responsible for holding the necessary rights and permissions.
6. Reviews and ideas.
Published publicly: your chosen display name, the type, the text, the date, and any reply from the owner. Never published: your email address, hashed IP address, or package IDs. You can post one entry per account and edit or delete it at any time, which removes it from the database. We hide content only when it is unlawful, spam, abusive, or off-topic—never merely because it is critical.
7. Counters.
The public counters show aggregate totals only. They do not track visitors, set identifiers, or allow any individual artist or session to be identified.
8. Donations.
Donations are made through an external Stripe Payment Link and are entirely voluntary. They unlock no features, higher resolution, additional stencils, or priority. A donation is not a purchase of a service or a charitable donation under Polish law; it provides no tax deduction or contractual entitlement.
9. Your rights.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and the right to object at any time to processing based on our legitimate interests (Art. 21), including abuse prevention and moderation. Where processing is based on consent — gallery publication and feedback — you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3)). You can delete your account and export your data from your Account page. For anything else, write to help@alex666cold.com from the address registered on your account; we reply within one month, extendable by two months for complex requests (Art. 12(3)). You may also lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl.
10. Children.
The service is intended for people aged 16 or over, in line with Art. 8 GDPR as implemented in Poland (16 years). We do not knowingly process data of anyone under 16. If you believe a child has used the service, write to help@alex666cold.com and we will delete the data.
11. Security.
All traffic uses TLS. Sign-in codes and session tokens are stored only as hashes; IP addresses and user-agents used for consent proof and anti-abuse are stored only as salted hashes. Access to the database is limited to the controller.
12. Changes.
We publish changes on this page with a new version number and date. Where a change materially affects you, we will state it here before it takes effect. Previous versions are available on request.