Privacy Policy

Effective October 16, 2026

Tatly is run by Rogue Salad Productions LLC ("we", "us"). Tatly helps tattoo shops publish flash designs and collect requests from their customers. This policy explains what personal information we handle, why, and the choices you have. We don't sell personal information. We use advertising and analytics tools on our own website and app to measure and improve our marketing, as described below.

Who this covers

Shop users: shop owners, artists and staff who sign in to Tatly.
Shop customers: people who choose designs on a shop's flash page. For this information, the shop decides what happens to it and is responsible for it; we store and process it on the shop's behalf. Questions about how a shop uses your details are best sent to that shop.

What we collect

From shop users

Account details: name, email address and sign-in information (handled by our sign-in provider, Clerk).
Shop details: shop name, subdomain, logo, team members and their roles.
Content you upload: flash designs, scanned sheets, artist names, prices and categories.
Billing: your subscription plan and status. Card details go directly to our payment processor, Stripe. We never see or store your full card number.
Feedback you send from the app: your message, any screenshots you attach, the name and email address on the form, your shop, the page you came from and your browser type.

From people who contact us

If you use our contact form: your name, email address, shop name (if you give one), the topic you choose and your message.

From shop customers

The name, email address and (optionally) phone number you enter, and the designs you choose.

Automatically

Technical information our hosting and security providers record when you use the site, such as IP address, browser type and request logs, used to keep the service running and secure.
Usage information on our website and in the Tatly app (not on shops' customer pages), such as pages visited, buttons clicked, how you arrived, approximate location, and device and browser type, collected with Google Analytics, Umami, HeyCatch and the Meta Pixel.

How we use it

To provide Tatly: sign you in, show a shop's designs, and pass customers' requests to the shop they chose.
To bill subscriptions and handle refunds.
To respond to support requests and send essential service messages (for example, about billing or security).
To keep Tatly secure, prevent abuse and fix problems.
To understand how people find and use Tatly, so we can improve it.
To measure the effectiveness of our own advertising and show Tatly ads to people who visited our site.
To meet legal obligations.

Where the law requires a legal basis (for example, in the EU or UK), we rely on performing our contract with you, our legitimate interest in running a secure service, and legal obligations. We don't send marketing email without your permission.

Cookies and similar storage

We use sign-in cookies set by Clerk to keep you logged in, and a setting in your browser's local storage that remembers whether you prefer the light or dark theme.

On our website and in the Tatly app we also use Google Analytics, which sets its own cookies (named _ga) to count visits and see which pages are used. We've turned off Google's advertising features, so this information isn't used to show you ads. You can opt out with Google's opt-out browser add-on or by blocking cookies in your browser.

We also use the Meta Pixel (from Meta Platforms, Inc., the company behind Facebook and Instagram) on our website and in the Tatly app. It sets cookies (such as _fbp) and sends Meta information about your visit, such as the pages you view, your IP address and browser details. We use it to measure our own advertising and to show Tatly ads on Facebook and Instagram to people who visited our site. Meta may also use this information as described in its privacy policy. You can control the ads you see in your Meta ad preferences, or block the pixel by blocking third-party cookies or using a tracker-blocking extension. We also honour the Global Privacy Control signal: if your browser sends it, the pixel is not loaded.

We also use Umami, a privacy-focused analytics tool we host ourselves, to count visits and page performance. On our public marketing pages it also records sessions and heatmaps (clicks and scrolling) so we can see how the page is used. We don't record sessions inside the Tatly app or on sign-in pages. Umami respects the same Global Privacy Control signal.

To measure revenue, Umami also records each subscription payment: the amount, currency and plan, linked to your shop's account ID. The first payment is recorded in your browser when you finish checkout. Later payments, such as renewals, are sent by our servers. So these can be recorded, we save your browser's user agent (its name, version and operating system) with your subscription at Stripe when you check out. Server-sent payments are recorded even if your browser sends the Global Privacy Control signal.

We also use HeyCatch, a product analytics service, on our website and in the Tatly app. It records the pages you visit and the buttons and links you click, along with technical details such as your browser, device and IP address, and stores a random identifier in your browser so your visits can be linked together. When you're signed in, we also tell HeyCatch your account ID, name and email address and when you signed up. Our servers send it account and billing events, such as finishing shop setup, starting a trial or canceling a subscription. We use this to understand how shops use Tatly and where they get stuck. If your browser sends the Global Privacy Control signal, HeyCatch isn't loaded in your browser, though our servers still send it the account and billing events above. HeyCatch handles this information as described in its privacy policy.

Shops' customer pages don't use Google Analytics, Umami, HeyCatch or the Meta Pixel.

Who we share it with

We share personal information only with service providers that help us run Tatly, under contracts that limit their use of it (with the exception of Meta, whose pixel is governed by Meta's own terms):

Clerk: accounts, sign-in and team invitations.
Stripe: subscription payments.
Vercel: website hosting and storage of uploaded images.
Neon: database hosting.
Google: website and app usage analytics (Google Analytics).
Umami: website and app usage analytics and subscription revenue, self-hosted.
HeyCatch: product analytics for the website and app, including signed-in users' name, email and account events.
Meta: advertising measurement and ad targeting (Meta Pixel).

Customers' details are shared with the shop they submitted them to. We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of the business (in which case this policy would continue to apply).

Our providers are based in the United States, so your information is stored and processed there.

How long we keep it

Account and shop information: while your account is open, then deleted on request.
Customer requests: until the shop deletes them or closes its account.
Billing records: as long as tax and accounting laws require.
Contact messages and feedback, including screenshots: as long as we need them to reply and improve Tatly, then deleted on request.

Your choices and rights

You can view and update most of your information in Tatly, and download a copy of everything your shop has stored at any time from Settings → Your Files. You can also ask us to give you a copy of your information, correct it, or delete it by emailing [email protected]. Depending on where you live (for example, California, the EU or the UK), you may have additional rights, including to object to or restrict certain processing and to complain to your local data protection authority. We won't treat you differently for using these rights.

If you're a shop customer, you can ask the shop directly, or contact us and we'll pass your request on.

Security

We use encrypted connections (HTTPS), access controls and reputable providers to protect information. No system is perfectly secure, but we'll tell affected users promptly if a breach affects their information, as the law requires.

Children

Tatly isn't intended for anyone under 18, and we don't knowingly collect information from children. Shops are responsible for following the age rules for tattooing where they operate.

Changes

If we make significant changes, we'll update the date above and let shop users know by email or in the app before they take effect.

Contact

Rogue Salad Productions LLC
3120 W Colorado Ave, Colorado Springs, CO 80904
[email protected]

See also our Terms of Service and Refund Policy.