Privacy policy

This English translation is provided for convenience. The French version is the legally binding one.

This privacy policy explains how TattooAI Studio collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

By using our website, you accept the practices described in this policy.

1. Data controller

Controller: ASPHERE (SASU)

Address:
2 B RUE GEORGES WODLI
57250 MOYEUVRE-GRANDE, France

SIRET: 907 876 957 00016

Email: saas@asphere.fr

2. Data we collect

We collect the following data:

  • Identification data: last name, first name, email address
  • Login data: login credentials (through Google OAuth where applicable)
  • Billing data: payment information (handled by Stripe; we have no access to card numbers)
  • Usage data: credits, subscriptions, tattoo creations
  • Technical data: IP address, browser type, pages visited
  • Connection fingerprint: when you sign up and each time you log in, an encrypted fingerprint of your IP address (not the address itself), from which the address cannot be recovered

3. Purposes of processing

Your data is used to:

  • Manage your user account
  • Provide the services you request (tattoo generation)
  • Process your payments and manage your subscriptions
  • Contact you about your account or our services
  • Improve our services and your user experience
  • Prevent one person from opening several accounts to collect the sign-up credits more than once (by comparing the email address and connection fingerprint of new accounts)
  • Emailing you about services similar to those you have bought (legitimate interest), and our news if you ticked the box when signing up (consent). Every email has a one-click unsubscribe link; you can also write to us to unsubscribe.
  • Comply with our legal and regulatory obligations

4. Legal basis for processing

The processing of your personal data is based on:

  • Performance of the contract: to provide the services requested
  • Consent: for the use of non-essential cookies
  • Legal obligation: to keep billing data
  • Legitimate interest: to improve our services and prevent abuse of the sign-up credits

5. Recipients of the data

Your data may be shared with:

  • Stripe: for payment processing (billing data)
  • Scaleway (France): for hosting the website, servers and database (user and technical data)
  • Google OAuth: for authentication (if you sign in with Google)

We do not sell or rent your personal data to third parties for commercial purposes.

6. Retention period

Your data is kept for as long as your account exists, then for the applicable legal periods:

  • Account data: until the account is deleted
  • Billing data: 10 years (legal obligation)
  • Login data: 3 years maximum
  • Connection fingerprint: 12 months

7. Your rights

Under the GDPR, you have the following rights:

  • Right of access: you can get a copy of your personal data
  • Right to rectification: you can correct inaccurate data
  • Right to erasure: you can ask for your data to be deleted
  • Right to restriction: you can ask for processing to be restricted
  • Right to data portability: you can get your data in a structured format
  • Right to object: you can object to the processing of your data
  • Right to withdraw consent: you can withdraw your consent at any time

To exercise these rights, contact us at: saas@asphere.fr

You also have the right to lodge a complaint with the CNIL, the French data protection authority, if you believe your rights are not being respected.

8. Data security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration. However, no system is completely secure and we cannot guarantee absolute security.

9. Cookies

Our website uses cookies to improve your experience. For more information, see our cookie policy.

Audience measurement

To understand how the site is used, we use OpenPanel, an audience measurement tool hosted by ASphere on its own servers in France: this data stays with us and is neither sold nor shared. OpenPanel sets no cookie, does not follow you on other websites and is not used for advertising. It records the pages viewed, the external links clicked, where your visit came from (referring site, campaign, remembered in your browser's local storage) and the type of device. When you are logged in, these measurements are linked to your account's internal identifier (never to your email address), together with the key steps of your use: sign-up, credit purchases (offer and amount) and creations started. Legal basis: our legitimate interest in measuring and improving the service. You can object by writing to saas@asphere.fr or by blocking the analytics-api.asphere-lab.fr domain.

10. Changes

We reserve the right to change this privacy policy at any time. Changes will be published on this page with the date of the update.

11. Contact

For any question about this privacy policy, you can contact us at: saas@asphere.fr

Last updated: 16 October 2026