Privacy policy

TattTester holds personal data about two groups of people who are in very different positions. Sections 1 to 3 cover people who signed up, and section 5 covers texting with SketchBot. Section 4 covers artist records collected from the public internet with no identified opt-in evidence. If you are an artist who found your name or your work on this site and did not put it there, section 4 is the one you want.

1. Information we collect from you

If you create an account or use the design tools, here is what we hold:

• Account details. Your email address and a password. Sign-in is handled by Firebase Authentication.
• Design prompts and conversations. What you type when describing a design, including the full back-and-forth with SketchBot. We keep the whole transcript.
• Reference images you upload, stored so we can use them in your designs.
• Generated designs — the designs we make for you, and the working layers behind them.
• Taste signals. Which of the designs you pick and which you say are least you. We log these from day one so the product can learn your taste; nothing personalizes across sessions yet.
• Booking details. When you book an artist: your name and email, the artist, date and time, placement, size and budget.

Payments are processed by Stripe, on Stripe’s own checkout page. Your card number goes to Stripe directly and never touches our servers — we see whether the payment succeeded, not the card. Texting with SketchBot is covered in section 5.

2. How we use it

To operate the service, generate and store your designs, match you with artists, take and settle bookings, and meet legal and tax obligations. We do not sell personal data.

3. Your rights as a user

You can see and update your profile in Settings. For everything else — a copy of what we hold about you, a correction you cannot make yourself, or deleting your account — contact us (section 9) and we will do it. Deleting your account removes your designs and your generation history. Booking and payment records are retained where we are required to keep them.

4. Artists collected from public sources

4.1 — What we collected, and from where

As of July 30, 2026, our production directory contained roughly 18,000 artist records collected from publicly accessible sources: studio and shop websites, public artist directories, and public Instagram profiles. A record may include some combination of name, Instagram handle, studio or shop name, city and state, approximate location, tattoo styles, public ratings and review counts, and a link to the page where we found it.

About 7,500 records have portfolio-image links attached, totaling roughly 68,500 URLs. Most point to the website where the image was published. A small subset has been copied to TattTester storage: on the same date, our production data contained 26 TattTester-hosted image URLs across 6 artist records. Whether unclaimed artists’ portfolio images appear in the product is controlled by a server-side safety switch. We may also store mathematical representations (“embeddings”) used by our matching system.

We did this so the directory would be useful on day one rather than empty. That was our commercial interest, not the artists’, and we are naming it as such rather than describing it as a benefit to them.

4.2 — Your right to have it removed, and how to use it

You can ask us to remove you. You do not need a TattTester account, a lawyer, or a reason.

• Use the removal link on your profile page, which goes to a form at /takedown.
• Or email us. Either way, tell us which profile is yours and how to reach you.
• You can ask us to remove your photographs only and leave the basic listing, or to remove everything. If you do not say, we remove everything.

Submitting the form does not delete anything by itself, and we will not tell you that it has. A person reviews every request. We do this deliberately: if a form submission could erase an artist, anyone could use it to erase a competitor. We will confirm to you when removal has actually happened.

4.3 — What removal deletes, and what it does not

You are entitled to the exact answer rather than a reassuring one.

Permanently deleted:

• Every portfolio photograph of yours that we re-hosted. Deleted from our storage, not hidden.
• The style embedding derived from your work, so it no longer influences matching.
• Your name, biography, Instagram handle, studio name, location, ratings, review counts and portfolio links, which are erased from our database record.
• Your profile page, and your presence in search, browsing, recommendations and the homepage.

Retained, and why:

• An emptied database record. We keep a stripped record identified only by an internal ID, with the date of your removal. It holds no personal details. It exists because deleting the record outright would break links to any payment held in your name, and would destroy our own proof that we honoured your request.
• Any payment recordcreated by a client leaving a deposit for you. Where a client’s money is involved we cannot simply delete the record; we resolve the payment first, and our removal tool refuses to run while one is outstanding.
• A record of the removal itself. See 4.4 — this one deserves its own explanation.

What we cannot promise:

• Copies held elsewhere. Search engines, caches and content delivery networks may serve old copies of images for a period after we delete them. We cannot reach into those, but we can tell you what the URLs were so you can ask them directly.
• Backups. Our infrastructure keeps operational backups on a rolling schedule, so deleted content may persist in those for a period before ageing out.

4.4 — We keep one permanent record so you are not re-added

Our directory was built by automated collection, and we may run that again. If we kept no record of your removal, the next run would find your public Instagram profile and add you back — and you would have to ask us again, forever.

So when we remove you, we permanently record your Instagram handle (and internal identifiers) on a suppression list that every collection process checks before adding anyone. Your handle is the only identifier that stays stable between runs, which is why we keep that specifically.

If you would rather we did not keep even that, tell us and we will delete it. We will also tell you honestly that we can then no longer guarantee a future collection run will not re-add you.

4.5 — Coming back, if you ever want to

Removal is not a ban. The suppression list stops us adding you; it does not stop you joining. If you later decide you want a TattTester profile, you can create an account and claim one deliberately.

Two things are worth knowing before you do:

• Nothing comes back. Your photographs and details were genuinely destroyed. You would start from an empty profile and fill it in yourself. We cannot undo the deletion, and we would not want to be able to.
• Our automated collection stays blocked permanently, even after you join. Your profile is yours; a later collection run must never overwrite what you wrote with scraped data.

4.6 — Proving it is you

We have to be careful in both directions: a removal request must not be usable to erase a rival, and a request to take ownership of a profile must not be usable to take someone else’s.

To have yourself removed, we normally ask you to show control of the Instagram account shown on the profile — usually by posting a short code we send you, or messaging us from that account. If you no longer have that account, or never had one, tell us and we will find another way. We would rather remove someone on imperfect evidence than leave a real artist listed against their wishes.

To claim or reinstate a profile, the bar is higher, because a claimed profile can receive client deposits. We require an account, proof of control of the Instagram handle, and review by a person before any profile is bound to you.

We are not able to establish who owns the copyright in a photograph. If an artist and a studio disagree about whose work a portfolio is, we cannot adjudicate that, and we will say so rather than pick a side.

4.7 — How long we take

We aim to acknowledge a removal request within a few days and to action it promptly after that. If you tell us your request is made under a specific legal right, say so and we will treat the applicable statutory deadline as binding.

5. Texting with SketchBot (SMS)

You can run a design conversation over text message by texting SketchBot at the number published on this site. If you do, we collect your phone number, the content of your messages, and the design requests you make in them. We use that information to provide the design conversation service: understanding your idea, replying, generating the designs you asked for, and delivering them to you. Photos you text to SketchBot are part of that message content: we keep them with the conversation and use them only as design references — to understand the style and subjects you are pointing at. We do not use your number for anything else.

Message and data rates may apply, and message frequency varies with the conversation. Text STOP at any time to opt out of further messages, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

6. Who else sees this data

We use a small set of providers to run the service. They process data on our instructions, and we do not sell personal data to anyone.

• Stripe — payments, deposits and payouts to artists. Card details go to Stripe directly.
• Google Cloud, Firebase and Vertex AI — image and file storage, sign-in, our databases, and AI models used to generate designs.
• Replicate — AI image generation models. Your design prompt is sent there to produce your designs.
• OpenRouter — routes some design-conversation prompts to language models.
• Twilio— carries SketchBot’s text messages.
• Vercel — hosts the website.
• Resend — delivers transactional email, such as booking notifications.
• Supabase and Neo4j — the databases behind artist records and matching.
• Instagram (Meta)— artist portfolio posts embedded on profile pages are served by Instagram itself. When a page shows one, your browser talks to Instagram directly and Instagram’s own privacy policy applies.

7. How long we keep things

We have not invented retention windows to sound official. Where a period is not fixed by law or by the mechanics described in this policy, the rule is: we keep it until you delete it or ask us to.

• Your designs, prompts, conversations and taste signals — until you delete them or ask us to.
• Your account — until you delete it.
• Booking and payment records — for as long as tax and payment rules require, even after your account is gone.
• SketchBot texting — your phone number and message history, kept to run the conversation. Text STOP to end it, or ask us to delete the history.
• The suppression list in section 4.4 — indefinitely, on purpose, for the single reason given there.
• Operational backups age out on a rolling schedule, so deleted content can persist in them for a period first.

8. Who this service is for

TattTester is for adults. Tattoos are an 18-and-over decision, and so is this service. We do not knowingly collect personal data from anyone under 18; if you believe we have, contact us and we will delete it.

9. Contact

For anything in this policy — removal requests, questions about what we hold, corrections, deletion — email support@tatttester.com or reach us via the about page. If you are an artist asking to be removed, you do not need an account and you do not need to explain yourself.