Privacy Policy

Introduction

This Privacy Policy explains how 3D Tattoo ("3D Tattoo," "we," "us") handles information when you use our AI tattoo concept service. It applies to our website, account area, generator, and support channels.

Information We Collect

We collect the following types of information to provide and improve our service:

1. Account data — name, email address, authentication identifiers, preferences, and account status.
2. Creative content — prompts, style and placement choices, images you upload, generated concepts, and related task metadata.
3. Transaction data — plan, credits, order status, and billing contact details. Card numbers are processed by our payment provider and are not stored by 3D Tattoo.
4. Technical and usage data — IP address, browser and device information, logs, approximate location derived from IP, pages viewed, and feature interactions.
5. Support data — messages and files you choose to send when requesting help.
6. Cookies and similar technologies — used for sign-in, security, preferences, analytics, and—only when enabled—customer support tools.

How We Use Your Information

For registration security we use Cloudflare Turnstile to assess browser and network signals and validate a short-lived challenge token. Registration rate-limit identifiers are stored as keyed hashes rather than raw IP addresses. See Cloudflare's privacy policy for its processing practices.

We use the data we collect to:

• Authenticate accounts and keep the service secure.
• Generate, store, and deliver tattoo concepts you request.
• Manage credits, subscriptions, transactions, and confirmations.
• Send technical notices, security alerts, and support messages.
• Respond to your questions, feedback, and support requests.
• Detect fraud, abuse, security incidents, and violations of our terms.
• Analyze aggregated service performance and improve product quality.

Data Sharing

We do not sell personal information or use private designs for public galleries without permission. We disclose information only as needed to operate the service, including to:

• Cloudflare Workers AI, our current AI image-generation provider, which receives the prompts and generation parameters needed to produce the requested image.
• Hosting, database, and storage providers such as Cloudflare and Supabase.
• Authentication, email, analytics, customer support, and payment providers when those features are configured.
• Professional advisers, a successor in a business transaction, or authorities when required by law or necessary to protect rights and safety.

These providers process data under their own terms and privacy commitments. Avoid putting sensitive personal information in prompts or uploaded images.

Actual AI Model Used for Generation

As verified on October 4, 2026, we use FLUX.1 schnell, developed by Black Forest Labs, via Cloudflare Workers AI, with the exact model identifier @cf/black-forest-labs/flux-1-schnell. This is the underlying third-party model for AI tattoo generation and AI image-generation actions in our cover-up, gap-filler and AI lettering concept tools; “3D Tattoo” is the service brand, not a model name.

Generation prompts and parameters are sent to Cloudflare Workers AI when you request an AI image. Local font previews and photo placement/editing controls do not themselves call this model. This disclosure does not mean that all uploaded photos are sent to the model. The generation interface displays the current model and provider, and we will update our disclosures if we change them. Provider-side processing and retention are governed by the provider's applicable terms and privacy commitments.

Content Safety Checks

When content moderation is enabled, generation prompts and generated artwork are sent to SeeAPI for automated safety checks. These checks may produce false positives or false negatives; contact support to question a rejection. Moderation is separate from the image-generation model disclosed above.

When image moderation is enabled, generated artwork awaiting review is placed in a separate private Supabase Storage bucket. SeeAPI receives a download link valid for up to 10 minutes. We attempt to delete the temporary object after the check, including rejected or failed checks; cleanup failures block delivery and require operational follow-up. An interruption may leave a temporary object requiring cleanup. Expiration of a download link does not delete the object itself. SeeAPI's processing and retention follow its privacy policy.

Browser-local photo try-on does not send body photos to SeeAPI or this temporary bucket. Do not include sensitive personal information in generation prompts. Unreviewed images are not published in our public gallery by this workflow.

The download token is configured to expire after 10 minutes, but a previously fetched response can remain available through intermediary caches after token expiration or source-file deletion. Source deletion is not a guarantee of immediate revocation of cached copies. Signed links are not returned to users or placed in the public gallery.

Retention

We retain account and transaction records for as long as needed to provide the service, meet legal obligations, resolve disputes, and prevent fraud. Prompts and generated designs remain in your private library until deleted or until the account is closed, subject to backup and legal retention periods. Provider-side temporary copies may follow the provider's retention rules.

Data Security

We use reasonable administrative, technical, and organizational safeguards, including encrypted transport and access controls. No internet service can guarantee absolute security.

Your Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information and to appeal a privacy decision. California residents may also request information about collection and disclosure and may not be discriminated against for exercising applicable rights. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined by California law.

Submit a request through the support channel listed on our website. We may verify your identity before completing it. Authorized agents may submit requests where permitted by law.

Children

3D Tattoo is not directed to children under 13, and paid or image-generation features are intended for adults. We do not knowingly collect personal information from children under 13. Contact us if you believe a child provided information to us.

International Processing

Our providers may process information in the United States and other countries. Those locations may have privacy laws different from your country.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, sending a notice through the service.

Contact Us

For privacy questions, access/deletion requests or complaints, email support@3dtattoo.app, or see Support and content reports. Email does not require an account. Incoming support email is forwarded to the operator's support inbox; replies may currently originate from the operator's QQ mailbox. Do not include passwords, full payment card details or sensitive identity documents in an initial email.