Tattoo Pack Privacy Policy

1. Controller.

HYPER13 sp. z o.o.; ul. Republikańska 23B, 04-404 Warszawa, Poland; NIP 9522280575. Contact for all privacy matters: help@tattoopack.app. No Data Protection Officer has been appointed because Art. 37 GDPR does not require one here.

Legal name: HYPER13 sp. z o.o.
Address: ul. Republikańska 23B, 04-404 Warszawa, Poland
NIP: 9522280575
Email: help@tattoopack.app

2. What we process, why we process it, our legal basis, and how long we keep it.

Data	Purpose	Legal basis	Retention
Image you upload	Build the prep pack or stencil you requested	Art. 6(1)(b) - steps taken at your request	Processed in memory and never stored on our servers. Passes through Google Cloud Run and, for stencils, Google's Gemini API
Generated result files (PNG)	Let you download the prep pack	Art. 6(1)(b)	24 hours, then deleted automatically
Package record: job ID, brand, mode, filenames, sizes, and your email if signed in	Show your recent packages; provide support; investigate abuse	Art. 6(1)(b); Art. 6(1)(f)	12 months, then deleted automatically
Email address	Sign you in, list your packages, enforce the limit of two stencils per UTC day, and send service notices (new features, changes to the terms, stencil availability)	Art. 6(1)(b)	As long as your account exists; you can delete it at any time
Six-digit sign-in code (stored only as a salted hash)	Authentication	Art. 6(1)(b)	15 minutes
Session token (stored only as a hash)	Keep you signed in	Art. 6(1)(b)	30 days
Rate-limit counters keyed to your IP address	Prevent abuse and keep the free service available	Art. 6(1)(f) - our legitimate interest in service integrity	Up to 1 hour
Gallery submission: derived guides, package ID, email, brand, mode, moderation status	Publish your work as a public example	Art. 6(1)(a) - your consent	Until you withdraw consent; a minimal removal record is kept for 3 years
Consent record: text version, locale, timestamp, hashed IP, hashed user-agent	Demonstrate consent as required by Art. 7(1)	Art. 6(1)(c) with Art. 7(1); Art. 6(1)(f)	Consent record: 3 years after withdrawal. Hashed IP and user-agent: 30 days
Review or idea: public display name, text, type, locale; private email; hashed IP	Publish artist feedback	Art. 6(1)(a) - your consent	Until you delete it. Hashed IP: 30 days
Abuse reports and moderation log	Comply with the Digital Services Act and handle complaints	Art. 6(1)(c); Art. 6(1)(f)	6 months after the decision
Stencil allowlist: email, date added, administrator email, optional note	Waive the daily stencil limit and include 2K resolution for selected artists	Art. 6(1)(b)	Until removal from the list or account deletion
Stencil usage per account: month, number of stencils, estimated cost	Track generation costs and keep the free tier sustainable	Art. 6(1)(f) - our legitimate interest in cost control	As long as your account exists; deleted with the account
Credit balance and credit history: promo code redemptions, credits spent, refunds	Operate credits for high-resolution stencils, prevent repeat use of a promo code, and show your balance	Art. 6(1)(b)	As long as your account exists; the balance and history are deleted with the account, but a record of each promo code redemption is kept with the email stored only as a hash (no readable email address) so that the same code cannot be redeemed again
Public counters (users, stencils, ink breakdowns)	Show aggregate usage	Aggregate totals only - not personal data	Indefinitely
Security and error logs at our hosting providers (IP, user-agent, request metadata)	Security, abuse prevention, debugging	Art. 6(1)(f)	Up to 30 days

Providing your email address is not a statutory requirement. Without it, you can still build a package, but you cannot sign in, view past packages, generate stencils, redeem promo codes, submit to the gallery, or leave feedback. Every account receives service notices about how the service works: new features, changes to the terms, and stencil availability. Promotions and partner offers are sent only if you opt in, and you can withdraw that consent at any time on your My packages page. We do not use automated decision-making that produces legal or similarly significant effects, and we do not profile you (Art. 22 GDPR). We do not collect personal data about you from third parties, so Art. 14 GDPR does not apply.

3. Recipients, processors and international transfers.

Cloudflare, Inc. - hosting (Workers), database (D1), sessions (KV) and file storage (R2). Acts as our processor under Cloudflare's Data Processing Addendum. Content is served from a global edge network, so processing may occur outside the EEA; transfers rely on the Standard Contractual Clauses incorporated into that Addendum.
Google Cloud (Google Cloud EMEA Ltd.) - our package-processing service runs on Cloud Run in the europe-west1 region. Google Cloud acts as a processor under its Data Processing Addendum; transfers outside the EEA rely on the Standard Contractual Clauses.
Google - Gemini API (stencil generation). If you request a stencil, your image is sent to Google's Gemini service and the generated stencil is returned. Google processes this content as our processor under the paid-tier Gemini API terms, does not use it to train its models, and retains it only transiently for abuse detection. Processing may take place outside the EEA under the Standard Contractual Clauses.
Resend (email delivery, EU region) - receives your email address and sign-in code and delivers our emails to you. Resend acts as a processor under its DPA.
Stripe - donations run through an external Stripe Payment Link. Stripe is an independent controller for that payment, not our processor, and its own privacy policy applies. The donation recipient, Alex Vasilevko, a sole proprietor (NIP 7972058054), is a separate controller for the donation records Stripe makes available to him: the amount, date and email address provided to Stripe. HYPER13 sp. z o.o. receives none of those donation records and does not process donor personal data or card details.
We do not sell or rent personal data, serve ads, or use analytics or tracking services. You may request a copy of the transfer safeguards listed above by writing to help@tattoopack.app.

4. Cookies and browser storage.

We use only strictly necessary cookies and storage set at your request. Under Art. 396 of the Polish Electronic Communications Law (PKE) and Art. 5(3) of the ePrivacy Directive, these do not require consent, so we inform you instead of asking for it.

tp_session - cookie, HttpOnly, Secure, SameSite=Lax, 30 days. Keeps you signed in.
tp_package_<package ID> - cookie, HttpOnly, Secure, SameSite=Lax, 24 hours. Lets the browser that created an anonymous package open and download it without exposing its access secret to JavaScript.
tp_locale - cookie, 1 year. Stores the language you selected; set only when you choose a language.
IndexedDB database tattoo-pack, store originals - keeps your uploaded image inside your browser only so a stencil can be generated in one click without re-uploading. It is never stored on our servers. It is removed automatically once the stencil is generated or after 24 hours, and you can erase it at any time through your browser's site-data settings.
There are no analytics, advertising, social or third-party tracking cookies of any kind.

5. Gallery.

Publication is optional and requires a separate, versioned opt-in for each package. Only derived guides (stencil, palette guide, ink breakdown, ink map, and tone maps) can be shown; your original upload is never published. We review every submission before it appears. You may withdraw consent at any time from your My packages page; we will unpublish the example and remove the stored file. Withdrawal does not affect processing carried out before it (Art. 7(3) GDPR). Do not submit recognizable faces, photorealistic portraits, or anything else that identifies a client - you are responsible for holding the necessary rights and permissions.

6. Reviews and ideas.

Published publicly: your chosen display name, the type, the text, the date, and any reply from the owner. Never published: your email address, hashed IP address, or package IDs. You can post one entry per account and edit or delete it at any time, which removes it from the database. We hide content only when it is unlawful, spam, abusive, or off-topic - never merely because it is critical.

7. Counters.

The public counters show aggregate totals only. They do not track visitors, set identifiers, or allow any individual artist or session to be identified.

8. Donations.

Alex Vasilevko, a sole proprietor (NIP 7972058054), is the controller of donation records. He processes the amount, date, email address and payment reference made available by Stripe to accept and administer the donation, meet tax and accounting duties, handle refunds or disputes, and establish or defend legal claims. The legal bases are Art. 6(1)(b) GDPR for steps at your request and the donation contract, Art. 6(1)(c) for tax and accounting duties, and Art. 6(1)(f) for the legitimate interests of preventing fraud and handling claims. Tax and accounting records are kept for 5 years from the end of the calendar year in which the relevant tax-payment deadline falls; other records are kept until the applicable refund, chargeback or claims period expires. Recipients are Stripe and tax or public authorities where disclosure is legally required; he does not receive your card details. You may request access, rectification, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. To exercise these rights, write to help@tattoopack.app and address the request to Alex Vasilevko (donations). You may also complain to the President of the Personal Data Protection Office (UODO). Providing data is voluntary but necessary to make a donation through Stripe; no automated decision-making or profiling is used. Stripe is a separate controller and publishes its own notice in the Stripe Privacy Center. HYPER13 sp. z o.o. does not receive or process these donation records. Donations are entirely voluntary, unlock nothing, and provide no tax deduction or contractual entitlement.

Stripe Privacy Center

9. Your rights.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and the right to object at any time to processing based on our legitimate interests (Art. 21), including abuse prevention and moderation. Where processing is based on consent - gallery publication and feedback - you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal (Art. 7(3)). You can delete your account and export your data from your My packages page. The export also includes your credit balance, credit history, and promo code redemptions. For anything else, write to help@tattoopack.app from the address registered on your account; we reply within one month, extendable by two months for complex requests (Art. 12(3)). You may also lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland - uodo.gov.pl.

10. Children.

The service is intended for people aged 16 or over, in line with Art. 8 GDPR as implemented in Poland (16 years). We do not knowingly process data of anyone under 16. If you believe a child has used the service, write to help@tattoopack.app and we will delete the data.

11. Security.

All traffic uses TLS. Sign-in codes and session tokens are stored only as hashes; IP addresses and user-agents used for consent proof and anti-abuse are stored only as salted hashes. Access to the database is limited to the controller.

12. Changes.

We may update this policy. The current text is always the one published on this page; where a change materially affects you, we will state it here before it takes effect.