Privacy notice · 01
Privacy Policy
What we collect, why we need it, who receives it, and how long it is kept.
Effective August 24, 2026
Scope and operator
Cold Blood Tattoo operates coldbloodtattoo.com. This notice covers information collected through this site, its booking and consent forms, and related studio email. Third-party sites you choose to visit have their own policies.
Information collected
Booking details. Name, email, optional phone number, tattoo description, size, placement, selected public design reference, requested appointment, and booking status.
Payment details. A booking identifier, Stripe Checkout session identifier, deposit amount, and payment status. Stripe collects and processes card or wallet details on its hosted checkout. Cold Blood Tattoo does not receive full card numbers.
Consent and health details. Legal name, signature, address, city, state, ZIP code, age confirmation, and answers about allergies, medications, healing, and listed health conditions, plus signing time and IP address. This information is sensitive and is used for body-art safety and consent records.
Technical and fraud-prevention records. Vercel and its BotID service may process IP address, browser or device signals, requested pages, timestamps, diagnostics, and security logs to serve the site and reject automated booking or consent submissions.
The website does not accept personal image uploads. A selected design reference is an identifier for artwork already published on the site.
Why we use it
We use information to review tattoo requests, schedule and perform services, collect deposits, prevent double-booking, communicate about appointments, document informed consent, protect clients and the studio, troubleshoot and secure the site, meet accounting or legal obligations, and respond to privacy requests. We do not use consent or health information for advertising.
Who receives it
The studio and service providers receive only the information needed for their role: Vercel hosts and serves the site; Upstash stores booking, availability, and consent records; Stripe processes deposits; Resend delivers transactional email; and Google Workspace receives studio booking email. Information may also be disclosed when required by law, to protect rights or safety, or in connection with a business transfer. We do not sell personal information or share it for cross-context behavioral advertising.
Cookies, storage, and tracking
The site does not use advertising cookies, analytics tags, pixels, or cross-site tracking. After you dismiss the privacy notice, the site stores one value in your browser's local storage so it does not show the same notice on every visit. No name, email, or advertising identifier is stored in that value. Because the site does not sell, share, or use personal information for targeted advertising, there is no tracking preference to disable and Global Privacy Control does not change site behavior.
Retention
Abandoned or cancelled website checkout records are kept for up to 30 days. Paid booking and signed consent records are kept for up to four years after the appointment so the studio can maintain consent, accounting, safety, and dispute records. Webhook replay-protection records are kept for 30 days.
Stripe, Vercel, Resend, Google Workspace, and other providers may retain transaction, delivery, security, backup, or legal records under their own schedules. We delete or de-identify information when the applicable period ends unless a longer period is required for law, tax, fraud prevention, a dispute, or a valid legal hold.
California requests
California residents may ask what personal information we hold about them, request correction or deletion, or ask how it was used or disclosed. Applicable law may allow or require us to keep some records, including transaction, safety, consent, fraud-prevention, and legal records. We will verify that a requester is the person the records concern before releasing or changing information. We will not discriminate against anyone for making a privacy request.
Security
We use HTTPS, restricted service access, hosted payment processing, security headers, limited data collection, and access-controlled service providers. Sensitive consent pages are excluded from search indexing and browser caching. No internet service is perfectly secure, so please do not send passwords, full payment-card details, or unrelated medical records through the booking description.
Children
Online booking is for adults 18 and older. We do not knowingly collect website booking or consent information from children.
Contact and changes
For privacy questions or requests, email will@coldbloodtattoo.com. Include the email address used to book and enough appointment detail for us to locate the record. Do not send a government ID unless we ask for one through a secure method. We may update this notice when practices or law change; the effective date above identifies the current version.