Privacy Policy

Who is responsible for your data

GAR Tattoo is the tattoo practice of Giselle, working from Mexico City (Condesa, CDMX) with guest dates in San Francisco, California. GAR Tattoo is operated by REELxpozure LLC, which handles bookings, payments, and the personal data described here. REELxpozure LLC is the data controller responsible for that data; Giselle is the artist who provides the tattoo services.

Data controller: REELxpozure LLC, operator of GAR Tattoo.
Registered address: 490 Post St, San Francisco, CA 94102, USA.
Contact for any privacy question or request: hello@gartattoo.com.

What we collect

We keep data collection to the minimum needed to design your tattoo, book it, and stay in touch. Depending on how you interact with us, this can include:

• Identity and contact details - your name, phone number, email, and WhatsApp profile.
• Booking conversation - the messages, reference images, placement, and ideas you send (usually over WhatsApp), so we can quote and design your piece.
• Health information you choose to share - if you tell us about allergies, skin conditions, pregnancy, medication, or anything relevant to tattooing safely. This is sensitive data and is used only to keep you safe during your session.
• Deposit and payment information - handled by our payment processor, not stored by us. We see a confirmation that a deposit was paid, not your full card details.
• Consent records - your signed consent and intake form before a session, and your choice on portfolio photography.
• Basic site and server logs - when you visit gartattoo.com, our hosting provider records standard technical data such as IP address, browser type, and pages requested, to serve the site and keep it secure.

Why we use it and our legal basis

• To answer your enquiry, quote, and design your tattoo - because you asked us to and to take steps toward a service agreement.
• To take a deposit and complete your booking - to perform our agreement with you.
• To tattoo you safely - your explicit consent for any health information, and our duty of care.
• To keep records we are legally required to keep, such as consent and intake forms - to comply with our legal obligations.
• To run and secure the website - our legitimate interest in a working, safe site.
• To send you optional updates about SF dates, openings, or flash drops - only with your consent, which you can withdraw at any time.

The San Francisco dates waitlist

Because San Francisco is limited guest dates rather than open booking, the SF page lets you join a waitlist so we can tell you when dates open. This is optional, and separate from making a booking.

• What we collect - your first name (optional) and a phone number and/or email so we can reach you. You choose which you give us.
• Your consent - if you tick the consent box, you are giving express permission for Giselle to message you about San Francisco dates by WhatsApp, SMS, or email. We record the date and time you opted in as proof of consent. We only send proactive messages to people who opted in.
• How often - rarely and only when there is something real to tell you, such as newly opened SF dates or a flash drop. This is not a regular newsletter.
• How to opt out - reply STOP to any WhatsApp or SMS message, use the unsubscribe link in any email, or email hello@gartattoo.com. Opting out removes you from proactive messages; you can still contact us any time.
• Updating your details - you can rejoin from the SF page at any time to correct or update your name, phone, or email; we match you by phone or email and update your existing entry rather than creating a duplicate.

The waitlist entry is stored in our booking records (see "How long we keep it" below) and is handled with the same providers and protections as the rest of your data. We never sell it.

Cookies and tracking

Who we share it with

We never sell your personal data. We share it only with the service providers that make the studio run, and only as much as each one needs:

• WhatsApp / Meta - because booking happens over WhatsApp, your messages are processed through Meta's platform under Meta's own privacy terms.
• Stripe - our payment processor, used to take and confirm your deposit. Stripe handles your card details directly under its own privacy terms and the PCI security standard; we never see or store your full card number.
• Hosting and email provider - IONOS, which hosts the website and our email so we can receive and reply to your messages.
• Authorities - only if we are legally required to disclose information.

International transfers

Because Giselle works in both Mexico and California, and because some providers above are based in the United States, your data may be processed in Mexico and the United States. Wherever it is processed, the protections in this policy still apply, and we only use providers that commit to appropriate safeguards.

How long we keep it

We keep your data only as long as needed for the purpose we collected it, plus any period the law requires. In practice:

• Booking and contact information (name, WhatsApp, email) - while you are an active client and for up to 24 months after our last contact, unless you ask us to delete it sooner.
• Payment and tax records (deposits and invoices via Stripe) - 5 years, as required by Mexican tax law and comparable US rules.
• Health and consent intake records - 5 years after your appointment, to cover the health, safety, and liability window in Mexico and California.

When data is no longer needed, we delete or anonymise it.

Your rights in Mexico (LFPDPPP - ARCO rights)

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), you have the ARCO rights over your data:

• Acceso (Access) - to know what data we hold about you.
• Rectificacion (Rectification) - to correct data that is wrong or out of date.
• Cancelacion (Cancellation) - to have your data deleted when it is no longer needed.
• Oposicion (Opposition) - to object to us using your data for a specific purpose.

You may also withdraw a consent you previously gave. To exercise any ARCO right, email hello@gartattoo.com with your request and enough detail for us to identify your records. We will respond within the timeframe set by Mexican law.

Your rights in California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect about you and how we use it.
• Access a copy of the personal information we hold about you.
• Request deletion of your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Not be discriminated against for exercising any of these rights.

We do not sell or share your personal information for cross-context behavioural advertising, so there is nothing to opt out of in that sense. To make any other request, email hello@gartattoo.com. We will verify your request before acting on it.

How we protect your data

We use reputable providers, limit who can see your information to Giselle herself, and keep physical and digital records secure. No method of transmission is perfectly secure, but we take reasonable steps to protect your data and to act quickly if anything goes wrong.

Children

Tattoo services are for adults aged 18 or over only. We do not knowingly collect data from anyone under 18. See our Terms and Conditions for the age policy.

Changes to this policy

We may update this policy as the studio or the law changes. The "last updated" date above always shows the current version. Material changes will be reflected here before they take effect.

Contact

For any privacy question, or to exercise a right described above, contact Giselle at hello@gartattoo.com. If you are in Mexico and are not satisfied with our response, you may contact the INAI (Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales).

This page is a plain-language summary written for clarity, not certified legal advice. For the formal position, or to exercise any right described here, contact hello@gartattoo.com.