Privacy policy

This page explains, in plain terms, what information Tattoolistik collects, why, where it is stored, for how long, and how to exercise your rights. It is written to comply with Quebec's Act respecting the protection of personal information in the private sector (Law 25).

In short: we collect the minimum needed to run the directory. We don't sell any information, we don't show ads and we don't use any tracking or analytics tools. Visitors without an account receive no cookies.

1. Who we are

Tattoolistik (tattoolistik.ca) is a directory of tattoo artists operated by KittoStudio.

2. Person in charge of the protection of personal information

Shawn Marchitto, KittoStudio
Email: confidentialite@tattoolistik.ca

This is the person to write to with any question about your information, to exercise your rights or to report a problem.

3. Information collected and why

If you visit the site without an account

We don't ask you for anything and don't set any cookies. Like any website, our servers automatically record technical logs: your IP address, the page requested, the date and the type of browser. They are used only to run the site, protect it against abuse (for example, limiting repeated attempts) and fix errors.

If you create an account

• Your email address: to log you in and send you verification or password reset codes. It is never displayed publicly.
• Your password: stored only in an irreversibly encrypted (hashed) form. We don't know it.
• The verification status of your email and the dates the account was created and last modified.
• 6-digit codes sent by email to confirm your address or change your password. We only keep an encrypted fingerprint of them, never the code itself.

If you publish a tattoo artist profile

The information on your profile is public once the profile is published: that's the purpose of the directory. It includes your artist name, your business name, your bio, your styles, your region and city, your photos (profile, banner, portfolio), your available flash (image and price of each design) and, only if you choose to add them, your address, your phone number, a contact email, your website, your social media and a booking link. Until the profile is published, only you can see it.

If you report a profile

Reports are anonymous: no account is needed. We record the reason you choose, any details you write (optional) and a fingerprint of your IP address, calculated with a secret key. This fingerprint is only used to check that reports come from different people; it cannot be used to recover your IP address. Please avoid writing personal information in the details.

If you like a profile

No account is needed. So that the same person can only like a profile once, we record afingerprint of your IP address, calculated with a secret key. This fingerprint is used for that purpose only and cannot be used to recover your IP address. It is deleted if you remove your like, or if the profile is deleted.

Automatic hiding of a profile

When a profile is reported by at least 3 different people, it is automatically hidden, with no human involvement. The tattoo artist concerned is informed in their dashboard. They may ask for this decision to be reviewed and submit their observations by writing toconfidentialite@tattoolistik.ca; a person will then review the profile.

4. On what basis we use your information

We use your information only for the purposes described here: providing the service you ask for (account, profile, search), securing the site and moderating the directory. By creating an account or publishing a profile, you consent to these uses. We don't use your information for any other purpose without asking for your consent, and you can withdraw it at any time by deleting your account (see section 9).

We don't sell, rent or trade any information. We do no advertising and no profiling.

5. Cookies and local storage

Visitors without an account: no cookies. The site uses no analytics tools, no advertising pixels and no third-party trackers. Fonts are hosted on our own server.

Once you're logged in, two strictly necessary items keep your session open:

• a pb_auth cookie, which contains your login token as well as your identifier and email. It is only sent securely (HTTPS), lasts 5 days and is renewed when you come back to the site;
• the same information in your browser's local storage (pocketbase_auth).

Both are erased when you log out. Because they are essential for your account to work, they don't require separate consent.

When you close the cookie notice, your browser simply remembers that you've seen it (tattoolistik_avis_cookies, in local storage). No personal data is stored there and nothing is sent to our servers. The notice shows up again once if this policy changes.

Links to Instagram, Facebook, Google Maps or other sites are simple links: those sites receive nothing until you click. Once you're on their site, their own policy applies.

6. How long we keep your information

Account (email, hashed password)

As long as the account exists, then deleted as soon as you delete it.

Account never confirmed by email

Automatically deleted 14 days after it was created.

Public profile, photos and flash

As long as the profile exists. Deleted (images and thumbnails included) when you delete your account. A flash design you delete yourself (for example once it has been tattooed) is erased immediately, along with its image.

6-digit codes

Valid for 15 minutes, automatically deleted after 24 hours.

Likes (fingerprint of the IP address)

As long as the profile exists, or until the like is removed. No automatic expiry.

Reports

12 months, then automatically deleted — unless the reported profile is hidden: they are then kept for as long as it stays hidden. Deleted along with the profile.

Application logs (IP address, page requested, browser)

7 days.

Web server logs (IP address, page requested, browser)

About 14 days.

Database backups

7 days. A deleted account may therefore remain in a backup for up to 7 days before automatically disappearing from it.

Emails sent (at Brevo)

According to Brevo's retention policy.

Automatic deletions run every day. Please note that search engines may keep a cached copy of a public profile for some time after it is deleted; this is beyond our control.

7. Where your data is

Your information is hosted mainly in the United States, and therefore outside Quebec, by the following providers:

• IONOS — United States: hosting of the site's server. It holds the entire database (accounts, profiles, reports, codes) and the technical logs.
• Cloudflare R2 — United States (US East region): storage of profile photos (and their thumbnails) and of the daily database backups. These storage spaces are private: they can't be accessed directly from the Internet, and photos are served only through the site.
• Brevo — France (European Union): sending emails. Brevo receives your email address, the subject and the content of the message (including the 6-digit code). Brevo keeps a history of sent emails according to its own policy.

Before entrusting your information to these providers, we assessed the risks to your privacy (privacy impact assessment). Outside Quebec, your information is subject to the laws of the country where it is located, which may allow that country's authorities to access it in certain circumstances.

8. Security

• The whole site runs over HTTPS (encrypted connection).
• Passwords are hashed; 6-digit codes and the IP addresses of reports and likes are only kept as fingerprints calculated with a secret key.
• Repeated attempts (logging in, sending codes, reports) are automatically limited.
• The database administration is not accessible from the Internet, and only the person in charge has access to it.
• Photo and backup storage is private.

9. Your rights

• Access: find out what information we hold about you and get a copy of it.
• Correction: have inaccurate information corrected. You can edit your profile yourself from your dashboard, and your email fromyour settings.
• Deletion: you can delete your account yourself fromyour settings. Everything is erased at the same time: the account, the profile, the photos, the flash designs, the reports about the profile and the codes.
• Withdrawal of consent: at any time, by deleting your account or by writing to us.
• Data portability: receive the information you have given us in a structured, commonly used technological format (for example a JSON file). Just ask by email; we prepare the export manually.
• Cessation of dissemination: ask that your profile no longer be disseminated (you can also delete your account yourself, which removes it).
• File a complaint with the Commission d'accès à l'information du Québec (Quebec's access to information commission):cai.gouv.qc.ca. We invite you to write to us first: we'll do our best to resolve the situation.

10. How to exercise your rights

Write to confidentialite@tattoolistik.ca, preferably from the email address of your account (this lets us verify your identity without asking you for other documents). We respond free of charge, within 30 days.

11. Confidentiality incidents

We keep a register of confidentiality incidents (unauthorized access, use or communication, loss of information). If an incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the persons concerned, and we take the necessary measures to limit the consequences.

12. Changes to this policy

We'll update this page if our practices change (new information collected, new provider, new retention period). The date of the last update is shown at the top of the page.