Privacy Policy
Protecting your data matters to us. Here we explain which personal data we process when you visit this website and use our features, on what legal basis, and which rights you have.
Controller
The controller for data processing is Gerd Hawelka (Tattoo-Werk), Wagramer Straße 115, 1220 Vienna, Austria. Contact: office@tattoo-werk.at, +43 664 51 51 195.
Hosting
This website is hosted by a provider within the EU. On every request, the server processes technically necessary data in order to deliver the page. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).
Server log files
When the site is accessed, information such as IP address, date and time, the page requested, browser type and operating system is automatically stored in server log files. This data serves technical security and error analysis and is deleted after a short period. Legal basis: Art. 6(1)(f) GDPR.
Contact & applications
If you contact us by email or via a form (e.g. a job application), we process the data you provide solely to handle your request. Application documents are deleted once the application process is complete, unless you consent to longer storage. Legal basis: Art. 6(1)(b) and (f) GDPR.
Cookies
We only use technically necessary cookies, e.g. for login sessions or to limit the free use of the Ink Lab. Tracking or marketing cookies are not set without your consent. Essential cookies are permitted without consent (Art. 6(1)(f) GDPR).
Web analytics with Google Analytics
Only with your explicit consent (Art. 6(1)(a) GDPR) do we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It lets us analyse, in pseudonymised form, how our website is used (e.g. pages visited, approximate region, device type) in order to improve our offering. This sets cookies and processes usage data; data may be transferred to Google LLC in the USA on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Google Analytics is not loaded and no related cookies are set before you consent. You can withdraw your consent at any time with future effect via the cookie settings. For more information see Google's privacy policy at policies.google.com/privacy.
Account & sign-in (Clerk Inc., USA)
For sign-in and account features we use Clerk Inc. (350 Mission Street, San Francisco, CA 94105, USA) as a processor. Sign-in involves processing of email, hashed password, IP address, browser info, and optionally OAuth provider IDs. Transfer to the US is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can delete your account anytime under Profile → Delete account.
Profile data
If you provide them voluntarily, we store your birthday, preferred language, and whether you want marketing/birthday emails. Legal basis: Art. 6(1)(a) GDPR (consent). You can change or clear these anytime.
Ink Lab — AI tattoo preview
If you use Ink Lab as a guest, we set a technically necessary cookie (tw_inklab_used, 1 year) and store a pseudonymised hash of your IP (sha256+salt) for 1 year, to enforce the free-tier limit. Legal basis: Art. 6(1)(f) GDPR (cost control and abuse prevention). Guest generations are NOT stored. Logged-in users get their previews and stencils saved in their account under "My images"; you can delete them individually or via account deletion. For generation, your photo and motif are briefly transmitted to OpenAI (USA).
Token system
If you later purchase tokens for additional Ink Lab previews, we keep your balance and transaction history until account deletion. Payment providers will be listed once the feature is live.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing at any time. You can withdraw any consent given at any time with effect for the future. To do so, contact office@tattoo-werk.at.
Right to complain
If you believe that the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at).
Last updated: June 2026. This policy is continuously adapted to legal and technical developments.
