Privacy Policy

CREATIVE // ENGINE is operated by CREATIVE // ENGINE LLC.

Privacy Contact: admin@creativetattooengine.com

A. Account Information

• Name, email address, and username.
• Authentication information, handled through our login provider.
• Account settings and preferences.
• Subscription plan, billing status, and credit balance.
• Records of the Terms and Privacy versions you accepted, and when.
• Support conversations.

B. Payment Information

Payments to CREATIVE // ENGINE are processed by Stripe. We receive limited payment information such as billing name and email, payment and subscription status, transaction identifiers, and refund or chargeback information. We do not receive or store full card numbers. Do not send card details through prompts, uploads, or support messages.

C. Design Inputs and Outputs

Prompts, tattoo ideas, reference images, sketches, photos, style and placement selections, generation settings, generated images, edits, gallery items, and related history. These may include personal information if you choose to include it.

D. Client Records and Client Messages

If you use the client tools, we store the client information you or your clients enter, such as names, contact details, notes, appointments, reference and body photos, payments you record, and designs shared with the client.

When you email a client from the Service and the client replies, we receive the reply. We keep the text of the reply, without the quoted earlier thread, in that client’s record, and we file image attachments into that client’s references. The complete original email is kept for 30 days and then deleted automatically. The same applies to replies sent to our no-reply address. Messages flagged as spam or as coming from an unverified booking lead are kept in the record but their photos are not filed. Messages flagged as containing a virus are discarded.

When a client replies, we email you a notification that quotes up to about 1,500 characters of the client’s message, so you can read and answer it from your own inbox.

Clients can also submit information and photos through your public booking form.

E. Email Delivery Records

For emails the Service sends, including emails to your clients, we record whether each email was sent, delivered, or bounced. We do not track whether an email is opened. These records store the recipient’s email domain and a coded form of the address, not the full address, and are deleted after 90 days. If an address permanently bounces, we mark it as undeliverable on the client record.

F. Connected Accounts

If you connect Google Calendar or Square, we store the connection and the information described in Section 17 (Google) and Section 18 (Square).

G. Device and Usage Information

Page views, referring pages, device, browser, operating system, and approximate country, collected through Vercel Web Analytics and Speed Insights. Error reports, the page where an error happened, and security logs. IP addresses as received by our hosting and security systems.

H. Cookies

We use cookies to keep you signed in, keep client portal sessions, remember interface preferences, and group error reports from the same browser. We do not use advertising cookies or third-party advertising pixels. Our public booking form uses Cloudflare Turnstile to block automated abuse.

I. File Metadata

Photos can contain embedded metadata, including location, device, and time. We remove this metadata from images uploaded through the app and from reference images before they are sent to an AI provider. Photos a client sends through your booking form or by email may keep their original metadata in storage. Remove unnecessary metadata before sharing files where you can.

We use information to:

• Provide the Service, generate designs, and store your gallery and client records.
• Create and manage accounts and process subscriptions and payments.
• Send the emails you ask the Service to send, and service, billing, and security notices.
• Provide customer support.
• Keep the Service reliable, fix errors, and detect abuse, fraud, and security threats.
• Enforce our Terms and comply with legal obligations.
• Send marketing communications where permitted.

We do not use your client photos, prompts, private designs, or client messages to train general-purpose AI models, and we do not sell personal information.

CREATIVE // ENGINE uses OpenAI as its AI provider for artist features. When you generate or edit a design, we send OpenAI the text of your request and the instructions we build from it, and any reference images, source images, or masks used for that design, including client photos you choose to use as references. Requests are also checked by OpenAI’s moderation service.

Our support assistant also uses OpenAI. It receives your chat messages and, to answer your question, information about your account such as recent generations, gallery item details, email delivery status, subscription, and credits.

We do not send client messages to an AI provider. Before adding a feature that would, we will explain the use and ask for any permission required.

A private account or gallery does not mean processing stays only within CREATIVE // ENGINE. OpenAI processes this content under its own terms for API customers, which include its own retention and abuse-monitoring practices. We do not promise zero retention by providers. Contact admin@creativetattooengine.com before submitting confidential material.

Our staff may use AI-assisted quality review on generated designs to improve the Service.

Service Providers

We share information with providers that operate the Service for us, including:

• Amazon Web Services (hosting, storage, databases, and email delivery).
• Vercel (web hosting and analytics).
• Wix (account login).
• Stripe (payments).
• OpenAI (AI generation, moderation, and support assistant).
• Cloudflare (abuse protection on booking forms).
• Google and Square, only if you connect them.

Legal and Safety Purposes

We may disclose information where reasonably necessary to comply with law or legal process, protect rights, safety, or property, prevent fraud or abuse, enforce our Terms, investigate security incidents, or respond to infringement claims.

Business Transfers

If CREATIVE // ENGINE is involved in a merger, acquisition, financing, sale, restructuring, or transfer of assets, information may be transferred as part of that transaction, subject to this Policy.

With Your Permission

We share or display content when you authorize it, as described in Section 17 of the Terms. Public posting or tagging alone is not permission for us to use content in marketing.

Designs you publish to the public gallery are visible to anyone, with the public name you choose.

Design shares, appointment links, and client portal sign-in links you send to clients let anyone holding the link see what it shows until it expires or you revoke it. Do not treat a link as confidential merely because it is hard to guess.

Do not publicly share client materials unless you have permission.

We may send launch updates, feature announcements, and promotional messages. You may unsubscribe using the link in the email or by contacting us. We will still send service messages such as billing notices, security alerts, account notices, and legal updates.

We keep information for as long as needed for the purpose it was collected, and for legal, billing, security, and dispute purposes. Specific periods today:

• Your designs and gallery: kept while your account exists, including after a subscription ends. Items you delete are permanently removed within about 14 days.
• Reference images uploaded for a generation: deleted after 7 days.
• Original inbound emails: deleted after 30 days. The reply text and filed photos stay in the client record until you delete them.
• Email delivery records: deleted after 90 days.
• Client records and client messages: kept while your account exists. Deleting a client removes it from your account view; ask us if you need the record permanently erased.
• Payment and transaction records: kept as required for tax, accounting, and legal purposes.
• Support conversations: kept to provide continuing support.

If we introduce a cleanup schedule for accounts without an active subscription, we will give notice as described in Section 20 of the Terms.

Deletion is not always immediate across logs and backups. Retained information is restricted to the purpose that justifies keeping it and is deleted or de-identified when that purpose ends, subject to legal requirements.

We use reasonable administrative, technical, and organizational safeguards, including encryption of stored data and of connected-account credentials, and access controls on stored images. No system is completely secure, and we cannot guarantee that unauthorized access, data loss, or misuse will never occur. Protect your login credentials and use secure devices.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing or marketing, to withdraw consent, and to appeal a decision about your request.

Send requests to admin@creativetattooengine.com. We verify identity in proportion to the request, respond within the period applicable law requires, and explain any exception or extension. A privacy request is separate from cancelling a subscription. Before permanently deleting an account, we will warn you and ask you to confirm.

Some records may need to be kept even after a deletion request, such as billing records, records required by law, and records that an artist or studio must keep for their clients. We tell you what was deleted and what was kept, and why. We will not discriminate against you for exercising privacy rights.

This section applies to California residents where the California Consumer Privacy Act, as amended, applies. Eligible residents may have the right to know what personal information is collected, used, and disclosed; to request deletion and correction; to opt out of sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for exercising these rights.

Categories we collect: identifiers (such as name, email, IP address, and account ID); commercial information (subscription and transaction history); internet activity (usage and logs); approximate location derived from IP address; user-generated content (prompts, uploads, references, Outputs, client records); and sensitive personal information only if you choose to upload it.

Sources: you, your clients through the client tools, your device, our payment processor, and providers you connect. Purposes: those described in Section 3.

We do not sell personal information and do not share it for cross-context behavioral advertising. We use sensitive personal information only as reasonably necessary to provide the Service, protect security, and comply with law.

California residents may contact us at admin@creativetattooengine.com.

Residents of other U.S. states may have similar rights under state privacy laws, where those laws apply to CREATIVE // ENGINE, including rights to access, correct, delete, and obtain a copy of personal information, to opt out of targeted advertising, sale, or certain profiling, and to appeal a denied request. Submit requests to admin@creativetattooengine.com.

CREATIVE // ENGINE is operated from the United States, and information is processed and stored in the United States. If you use the Service from another country, your information will be transferred to the United States, where privacy laws may differ. Where required, we use appropriate safeguards for these transfers.

Where the GDPR or UK GDPR applies, CREATIVE // ENGINE LLC is the controller of personal information processed for accounts, billing, website operation, support, marketing, and business administration. For client records and client messages, the artist is the controller and we process that information on the artist’s behalf (see Section 16).

We rely on contract (to provide the Service), consent (where required, such as certain marketing), legitimate interests (such as security, fraud prevention, and improving the Service), and legal obligation (such as tax and accounting).

You may have rights of access, rectification, erasure, restriction, portability, and objection, to withdraw consent, and to complain to a supervisory authority. Contact admin@creativetattooengine.com.

The Service is only for users aged 18 or older. Persons under 18 may not register for or use the Service. If we learn that an underage person has created an account, we will disable the account and delete its information, subject to legal requirements.

This is separate from lawful reference material an adult user submits that depicts another person. Material depicting a minor must be nonsexual and lawful, requires appropriate authority and parent or guardian permission where required, and must comply with Section 12 of the Terms and provider policies. Report suspected underage use or improper material to admin@creativetattooengine.com.

For client records, client messages, client photos, and other information about your clients, you, the artist, decide what is collected and why, and we process it on your behalf to provide the Service. You are responsible for having a lawful basis and the permissions needed to upload and process it, including telling clients about AI-assisted processing where required.

Provide only what the task needs. Do not upload government IDs, payment details, medical records, or unrelated confidential information into design tools.

If your information was submitted by an artist, you may contact that artist, or admin@creativetattooengine.com. We may need information to locate the material and verify the request. The artist’s responsibilities do not remove our own obligations under applicable law.

If you choose to connect your Google account, CREATIVE // ENGINE uses Google’s sign-in (OAuth) to link it. The connection is optional and only turns on calendar sync.

What We Access

When you connect, we ask Google only for permission to:

• Create a secondary calendar in your Google account named “CREATIVE // ENGINE - Appointments”, and create, change, and delete events on that calendar only.
• See whether you are free or busy at a given time across your calendars (start and end of busy periods only; no event titles, descriptions, attendees, or locations).
• See the list of calendars in your account, so the free/busy check can include them.

We do not request access to read, edit, share, or delete events on any calendar we did not create. Google enforces this at the permission level, not just our software.

How We Use It

• To add, update, and remove your CREATIVE // ENGINE appointments on the calendar we created, so they appear in Google Calendar.
• To warn you when a booking overlaps a busy time on your other calendars.
• To read changes you make to those events in Google Calendar, so moving one there moves the booking here, and to notice when you delete one, so we can ask what you meant rather than guess.

We do not use information received from Google to build advertising profiles, to train or improve AI or machine-learning models, or for any purpose other than providing and improving the calendar sync feature you turned on. Humans do not read this data except with your consent, for security or abuse investigation, or where required by law.

Storage and Sharing

We store the Google credential that lets us keep your calendar in sync. It is encrypted at rest and used only for the purposes above. We do not sell it, share it, or transfer it to third parties except to Google itself, to the providers that host our infrastructure, or where required by law.

Disconnecting

You can disconnect at any time from your Account page. Disconnecting revokes our credential at Google and deletes it from our systems. If Google ends the connection instead, sync stops, and the stored credential, which no longer works, remains until you disconnect from your Account page. The calendar and its events remain in your Google account under your control. You can also remove our access at myaccount.google.com/permissions.

Google Policy

CREATIVE // ENGINE’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where available, you may connect your Square seller account. We store your merchant name and identifier, the permissions you granted, and the Square access credentials, which are encrypted at rest.

We use the connection to record payments taken in Square against your client records and to create payment links you request. Payment records we store include amount, tip, payment method, date, card brand and last four digits, and receipt details. If you choose to link a client to Square, we send that client’s name, email, and phone number to Square to find or create the matching Square customer.

Disconnecting revokes our access at Square and deletes the stored credentials. Payment records already filed against your clients remain part of your client records until you delete them.

Because there is no consistent standard, we may not respond to all Do Not Track signals. Where legally required, we honor recognized opt-out preference signals, such as Global Privacy Control.

The Service may link to third-party websites, platforms, or tools. Their privacy practices are their own. Review their policies before providing information.

The published Policy shows its version, effective date, and last-updated date. For material changes, we give at least 30 days’ notice by email and in the app, with a plain-language summary, except where a faster change is needed for security or legal reasons.

Where a change requires fresh consent, we obtain it before the affected processing, and we do not silently expand how we use information collected earlier.

CREATIVE // ENGINE · Privacy Contact: admin@creativetattooengine.com