Privacy Policy

Vandalsyn — Software as a Service Platform for Tattoo Artists and Clients
Last updated: August 6, 2026

This Privacy Policy explains how Vandalsyn, LLC (“Vandalsyn,” “we,” “us”) collects, uses, shares, and protects information in connection with the Vandalsyn platform (the “Service”). This Policy is part of, and should be read together with, our Terms of Service.

1. Scope

This Policy applies to information we collect through the Service, including from Artists, Clients, and Studio accounts. It does not apply to third-party websites or services we link to, or to information you share directly with an Artist or Client outside the Service (for example, over text message or Instagram DM).

2. Information We Collect

2.1 Information you provide directly

• Account information: name, email address, phone number (optional), password, and account role (Artist, Client, or Studio Owner).
• Artist profile information: bio, Instagram handle, portfolio content, default deposit amount, studio affiliation, and Stripe Connect onboarding status.
• Client profile information: contact details and, if provided, waiver-related fields reserved for future use.
• Design content: uploaded or in-app-created design drafts, layers, and edits.
• Placement and annotation data: transform data (position, scale, rotation) for a design placed on a body outline, plus any lightweight notes or annotations you add.
• Reference photographs of your body: optional photos a Client uploads of the body area being considered for a tattoo, used to replace the generic body outline in the placement visualization tool.
• Messages: text and image content you send to an Artist or Client through the Service's messaging feature.
• Booking and policy information: appointment details, booking policy terms an Artist sets, and the record of a Client's agreement to those terms.
• Payment-related information: Vandalsyn does not store full payment card numbers. Card details are collected and stored directly by our payment processor, Stripe. We retain limited payment metadata such as transaction status, amount, and payment identifiers.
• Support requests: information you submit through the Support Hub, including your message and account role.

2.2 Information collected automatically

• Usage data: pages and features accessed, timestamps, and general interaction data with the Service.
• Device and log data: IP address, browser type, and device identifiers, collected for security, fraud prevention, and diagnostic purposes.
• Cookies and similar technologies: used to keep you logged in, remember preferences, and understand how the Service is used. See Section 9.

3. How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Service, including the design canvas, placement editor, booking, messaging, and payment features;
• Process subscription billing and facilitate deposit/final payment transactions between Artists and Clients;
• Communicate with you about your account, bookings, messages, and Service updates;
• Maintain the security and integrity of the Service, including detecting and preventing fraud or abuse;
• Comply with legal obligations; and
• Improve and develop the Service.

We do not use your design content, reference photographs, or messages to train third-party artificial intelligence models, and we do not sell your personal information to data brokers or other third parties for their own marketing purposes.

4. Reference Photos and Design Images — Special Handling

4.1 Restricted visibility. A design draft, placement reference photo, or annotation is visible only to the Artist and Client who are participants on the specific project it belongs to — not to other users of the Service, and not published publicly, unless and until you separately opt in to a future public portfolio feature.

4.2 Private storage. Images are stored in a private cloud storage bucket rather than at a permanent public URL. The Service generates short-lived, signed access links only after confirming the requester is an authorized participant on that project.

4.3 Your control. You may delete a reference photo you uploaded at any time. Deleting your account triggers deletion of your associated images subject to the retention terms in Section 6.

4.4 Sensitivity acknowledgment. We recognize that photographs of your body, even non-medical in nature, are sensitive to many people. We treat this category of content with elevated access controls as described above, and we do not require a reference photo to use the Service — the placement tool defaults to a generic body outline if you choose not to upload one.

5. How We Share Information

5.1 With other project participants, by design. The Artist and Client on a given project can see the design content, placement data, messages, and booking information associated with that project — this sharing is the core function of the Service and is expected as part of using it.

5.2 Service providers. We share information with third-party vendors who help us operate the Service, including Stripe (payment processing), Cloudflare (file storage and content delivery), Liveblocks (real-time collaboration), our email delivery provider, and our error-monitoring provider. These vendors are contractually restricted from using your information for any purpose other than providing services to us.

5.3 Legal disclosures. We may disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Vandalsyn, our users, or the public.

5.4 Business transfers. If Vandalsyn is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a policy providing at least equivalent protection.

5.5 We do not sell your personal information. We do not sell or share your personal information with third parties for cross-context behavioral advertising, as those terms are defined under applicable state privacy law.

6. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. If you delete your account, we will delete or de-identify your personal information within a commercially reasonable period, except where we are required to retain certain records (such as payment or tax records) for longer periods to comply with legal obligations, or where content remains part of another user's active project record (for example, an Artist's copy of a shared design history) and cannot be unilaterally deleted by one participant alone.

7. Data Security

We use technical and organizational safeguards designed to protect your information, including encryption of stored files, private (non-public) storage buckets with short-lived signed access links, and access controls limiting data visibility to authorized project participants. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

8. Your Privacy Rights

8.1 General rights. Depending on your state of residence, you may have the right to: know what personal information we have collected about you; request a copy of that information; request correction of inaccurate information; request deletion of your information; and opt out of the sale or sharing of personal information (noting we do not sell or share information as described in Section 5.5).

8.2 California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the rights described in Section 8.1, plus the right to limit use of sensitive personal information and the right to non-discrimination for exercising these rights.

8.3 Other states. Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights under their respective state laws. We will honor valid requests consistent with applicable law regardless of the specific state framework that applies to you.

8.4 How to exercise your rights. Submit a request to Vandalsyn@gmail.com. We will verify your identity before processing a request and will respond within the time period required by applicable law.

9. Cookies and Tracking Technologies

We use cookies and similar technologies necessary to keep you logged in and to remember basic preferences. We do not currently use third-party advertising cookies. If this changes, we will update this Policy and provide any consent mechanisms required by applicable law. We do not respond to browser “Do Not Track” signals at this time, as there is no common industry standard for how to interpret them.

10. Children's Privacy

The Service is not directed to, and is not intended for use by, anyone under 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it promptly. If you believe a minor has provided us information, contact us at Vandalsyn@gmail.com.

11. International Users

The Service is intended for use by individuals located in the United States and is operated from the United States. We do not currently direct the Service to, or design it for compliance with the laws of, the European Union, United Kingdom, or other jurisdictions outside the United States. If you access the Service from outside the United States, you do so at your own risk and are responsible for compliance with local law.

12. Data Breach Notification

In the event of a security incident involving your personal information, we will notify affected individuals and, where required, regulators and other authorities in accordance with applicable state and federal breach notification laws.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice through the Service or by email before the changes take effect.

14. Contact Us

Questions about this Policy, or requests regarding your personal information, can be directed to Vandalsyn@gmail.com.