Privacy Policy

1. Who We Are

RC Tattoo Fresh ("we", "us", "our") operates this website and provides tattoo studio services. We are the data controller responsible for personal information collected via this site and at our physical studio.

2. Information We Collect

• Contact information: name, email, phone, postal address.
• Booking information: appointment dates, artist preferences, service type, design references, deposit amounts.
• Health intake: medical conditions, allergies, medications, prior tattoo history (collected with your explicit consent, used only for procedure safety).
• Identity verification: government ID (required by state law for tattoo services). We record presence of ID but do not retain photocopies unless required by law.
• Payment information: last 4 digits of card and transaction IDs. Full card numbers are processed by PCI-compliant processors (Stripe) and never stored on our servers.
• Photographs: consent-based reference and result photos of tattoo work.
• SMS consent records: date, channel, exact consent text, IP address (web only).
• Technical data: IP address, browser type, pages visited, referrer.

3. How We Use Your Information

• Schedule, confirm, and remind you of appointments.
• Send appointment confirmations, reminders, follow-ups, and cancellation notices via SMS, WhatsApp, or email (only with your consent).
• Process deposits and final payments.
• Ensure procedure safety based on health intake (artist review only).
• Maintain legal records required by state health department for tattoo studios.
• Improve our services, prevent fraud, and comply with legal obligations.

5. Data Sharing & Processors

We share data only with the processors needed to operate the studio. Each is bound by a data processing agreement:

• Supabase — database and authentication.
• Vercel — application hosting.
• Twilio — SMS, MMS, voice, WhatsApp messaging.
• Stripe — payment processing.
• Meta (WhatsApp Business API) — WhatsApp messaging.
• Resend — transactional email delivery.

We never sell your personal data. We do not share data with third-party advertisers or marketing networks.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all of the above — that information is never shared with any third party, including the processors listed here.

6. Data Retention

• Booking and contact data: 7 years after last interaction (warranty, disputes, legal).
• Health intake: 7 years per health department requirements.
• SMS consent records: at least 2 years after opt-out (FCC requirement — proof of original consent).
• SMS message content: 12 months for service quality and dispute purposes.
• Photographs: retained indefinitely unless you request deletion (Section 8).
• Payment data: 7 years (last 4 digits + transaction IDs only).

7. Security

We protect your information using industry-standard measures: TLS encryption in transit, encryption at rest, row-level security at the database, MFA for staff access, and access logging. No internet transmission is 100% secure; we cannot guarantee absolute security but will notify you of any breach affecting your data per applicable law.

8. Your Rights

• Access — request a copy of your personal data.
• Correct — request correction of inaccurate data.
• Delete — request deletion (subject to legal retention requirements).
• Restrict / object — limit or stop processing for specific purposes.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — revoke SMS/email/photo consent at any time without affecting prior lawful processing.

9. Children

Tattoo clients must be 18 or older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly.

10. Contact

RC Tattoo Fresh