Privacy Policy
This page explains what personal data this website collects, why, and what rights you have.
Data Controller
Olga Kotova, tattoo artist based in Berlin, Germany, is the controller responsible for the personal data collected through this website. You can reach me at kotovaolga.ink@gmail.com for any privacy-related question or request. See the Impressum for my full contact and legal details.
Our Data Minimization Principle
This site is built to collect the smallest amount of personal data needed to handle a tattoo request — nothing more. Only the booking form fields required to evaluate and respond to your request are mandatory; everything else is optional. We don't run tracking or profiling beyond what's described below, and we don't sell or share your data with third parties for their own marketing purposes.
What Data We Collect
When you submit the booking form, I collect: your name and email address (required, to respond to you), a description of your tattoo idea, its placement and approximate size, and whether it's a cover-up (required, to assess the request). Your Instagram handle, preferred date, and reference images are entirely optional — leave them out if you'd rather not share them. If you accept cookies, this site also collects standard analytics data (such as pages visited, device/browser type, and approximate location) via Google Analytics, Google Ads, and/or Meta Pixel.
Reference Photos Are Kept Private
Any reference images you upload are stored in a private, access-controlled file storage bucket. They are never publicly reachable — they can only be viewed by Olga, after logging into the password-protected admin panel. Uploaded files are deleted together with the rest of your submission once it's no longer needed (see retention periods below).
Why We Collect It
Booking form data is used exclusively to respond to your tattoo request, provide a quote, and schedule your appointment. Analytics data, only collected after you accept cookies, is used to understand how visitors use this site and to measure the effectiveness of advertising campaigns.
Legal Basis
Processing is based on your consent (Art. 6(1)(a) GDPR): by submitting the booking form you consent to being contacted about your request, and by accepting the cookie banner you consent to analytics and advertising cookies. You can withdraw consent at any time. Brief, non-persistent security checks (see below) rely on our legitimate interest (Art. 6(1)(f) GDPR) in keeping the form free of spam and abuse.
Security & Abuse Prevention
To limit spam and automated abuse, the server briefly checks the IP address a request comes from against a short-term rate limit. This check happens in memory only, is never written to our database, and is automatically cleared within minutes.
Where Your Data Is Stored
Booking form submissions are stored in a PostgreSQL database hosted by Neon (US-based infrastructure provider). Email notifications about new requests are sent via Resend. Reference images, if you upload any, are stored privately via Vercel Blob (see above). This website itself is hosted on Vercel. These are all sub-processors acting strictly on my instructions — none of them may use your data for their own purposes. Where data is transferred outside the European Economic Area, these providers rely on their own GDPR-compliant safeguards, such as Standard Contractual Clauses.
Cookies & Analytics
This site only loads Google Analytics, Google Ads, and/or Meta Pixel scripts after you actively accept the cookie banner. If you decline or take no action, none of these scripts run and no advertising or analytics cookies are set.
How Long We Keep Your Data
We keep booking requests only as long as they serve a purpose, on a fixed schedule: requests that never receive a reply are deleted automatically after 90 days; requests that were discussed but didn't lead to a booking are deleted after 180 days; requests that were closed out without booking are deleted after 30 days. If your request becomes a booked appointment, your data is kept for as long as our working relationship is active (for scheduling and aftercare follow-up) and is deleted once it's no longer needed. You can ask for deletion at any time, sooner than these schedules — see Your Rights below.
Your Rights
Under GDPR, you have the right to access, correct, or delete your personal data, to restrict or object to its processing, to receive a copy of it in a portable format, and to lodge a complaint with your local data protection authority (in Germany: your state's Datenschutzaufsichtsbehörde). To exercise any of these rights, contact me at kotovaolga.ink@gmail.com.