Tattoo AI Privacy Policy

This Privacy Policy explains how Xeplin Yazılım Hizmetleri Anonim Şirketi (“Xeplin,” “we,” “our,” or “us”) collects, uses, and shares information when you use our mobile application “Tattoo AI – Design & Try On” (the “App”). This Policy is part of, and incorporated into, our Terms of Use & End-User License Agreement.

1. Data Controller

• Legal name: Xeplin Yazılım Hizmetleri Anonim Şirketi
• Address: Fulya Mah. Büyükdere Cad. Torun Center D Blok No: 74D, İç Kapı No: 43, 34394 Şişli/İstanbul, Türkiye
• Trade Registry No: 1058219 · MERSIS No: 0839126685400001
• Contact: [email protected]

2. Information We Do Not Collect

• No sign-up. The App does not ask you to register, and it does not ask for your name, email address, phone number, or other contact information. To use our design service, the App creates an anonymous account on our server automatically, identified only by a random identifier (see Section 3.2).
• Your try-on photos stay on your device. Photos you take or choose for try-on, the live camera image, and the try-on images you edit are processed and stored on your iOS device. Arm tracking in the live camera runs on your device using Apple’s on-device Vision framework; camera frames are not sent to us. The only exception is Make it realistic, described in Section 3.7.
• Your stencils and artist cards stay on your device until you choose to share them (for example, through Messages, Mail, WhatsApp, or AirPrint); they then go only where you send them.
• No location. The App does not request or collect your location.
• No advertising identifier, no cross-app tracking. The App does not show third-party ads, does not request Apple’s App Tracking Transparency permission, and does not collect the Identifier for Advertisers (IDFA).
• No payment information. All purchases and subscriptions are processed by Apple through the App Store. We do not receive your payment card or bank account details.

3. Information We Collect

To operate the App, prevent abuse, measure performance, and improve our Services, we and our third-party service providers collect the following limited categories of information:

3.1 Device and Technical Information

iOS version; device model; language and locale settings; time zone; App version and build; and general technical information necessary for the App to function properly.

3.2 Identifiers

A random, anonymous identifier that the App generates for your installation (also used as your anonymous account on our design server and with our subscription-management provider), a random password the App creates and keeps in your device’s Keychain, and the Identifier for Vendors (IDFV) provided by iOS. These identifiers do not contain your name, email address, or phone number, and they are not used to track you across other companies’ apps or websites.

3.3 Usage and Analytics Data

Information about how you interact with the App, such as features used, screens viewed, in-app events (for example, creating a design, opening try-on, or exporting a stencil, recorded without your photos), preferences you select in the App (such as your favorite tattoo style), session duration, frequency of use, paywall views, and similar product-analytics events. This data is associated with the anonymous identifier described above, not with your name or contact details.

3.4 Diagnostic and Crash Data

If the App crashes or encounters an error, we collect crash reports, error logs, stack traces, device state at the time of the crash, and performance metrics. This information helps us diagnose and fix problems and improve stability.

3.5 Subscription and Purchase Events

When you start a trial, subscribe, renew, cancel, or have a subscription expire, we and our subscription-management provider receive event-level information from Apple (such as the product purchased, transaction identifier, currency, country, trial start and end events, renewal and cancellation events). We do not receive your payment card details.

3.6 Tattoo Designs You Create

When you create a design, the App sends your text idea, the style, and (if you choose them) the body placement and size to our server. Our server checks the text against a list of prohibited content and with OpenAI’s moderation service, then sends a text prompt to our AI image provider, Replicate, which generates the design. Each generated design is also checked by OpenAI’s moderation service for sexual content before it is shown to you; designs that fail the check are discarded. The generated design images are stored on our server so the App can download them, and a record of each request is kept (anonymous account, time, style, your text, the AI model used, estimated cost, and result) to provide the service, enforce usage limits, prevent abuse, and handle reports. Do not include personal information about yourself or others in your design ideas. If you report a design (in the App or by email), we keep the report, the reason you choose, and the design reference to review it.

3.7 Make it realistic (optional)

If you choose Make it realistic, the App asks for your consent first and then sends the single try-on image you prepared (your photo with the design placed on it, resized and without location metadata) to our server. Before anything else, the image is checked by OpenAI’s moderation service for sexual content; images that fail the check are not processed. Our server then forwards it to Replicate to create a realistic version, and checks the result with OpenAI’s moderation service again before returning it. Our server processes this image in memory only: it is not written to disk, not stored in our database, and excluded from our request logs. The realistic image is returned to the App and is not stored by us. Replicate deletes the inputs and outputs of these requests within one hour, under its own privacy policy. We keep only a usage record without the image (anonymous account, time, model, cost, result). Only use photos of yourself or of people who have agreed, and only if you are 18 or older.

3.8 IP Address

Our server and our service providers may automatically collect your IP address when the App communicates with them, for security, fraud prevention, and approximate-region inference (country/region level).

3.9 Information You Send Us

If you contact us (for example, by email), we receive the information you choose to provide, such as your email address, your name, and the content of your message. We use it to respond to you and to keep a record of our correspondence.

3.10 Advertising Attribution (Apple Ads)

We may promote the App through Apple Ads. If you install the App after interacting with an Apple Ads advertisement, we and our subscription-management provider may receive campaign attribution information from Apple (such as the campaign or keyword associated with the install) through Apple’s AdServices framework. This information does not include the IDFA and is not used to track you across other companies’ apps or websites.

4. iOS Permissions We Request

When you choose a photo for try-on, the iOS photo picker gives the App only the photo you select, and it stays on your device (except for Make it realistic, Section 3.7). You can change these permissions at any time in iOS Settings.

5. How We Use Information

We use the information we collect for the following purposes:

• to provide, operate, maintain, and secure the App and our design service;
• to generate the tattoo designs and realistic try-on images you request;
• to check design requests, photos, and generated images for prohibited content and to review reported images;
• to apply usage limits and protect the service from abuse;
• to process and manage subscriptions, trials, renewals, and entitlements;
• to diagnose and fix bugs, crashes, and performance issues;
• to understand how the App is used and to improve features, design, and user experience;
• to measure the performance of our own advertising (such as Apple Ads campaigns);
• to comply with legal obligations, enforce our Terms, and protect our rights and the rights of others.

6. Third-Party Service Providers (SDKs)

We rely on the following third-party service providers, who act as our processors or as independent controllers for the limited purposes described. Our design server is operated by us. These providers may collect information automatically through their software development kits (SDKs) integrated in the App. Their use of information is governed by their own privacy policies.

From time to time, we may add additional service providers (for example, additional analytics, advertising, or attribution tools such as Mixpanel) to support our business operations. We will update this Policy and the list above when we do so. Where required by law, we will obtain your consent before integrating new tracking technologies.

7. Sharing and Disclosure

We do not sell your personal information. We share information only:

• With service providers listed in Section 6, who process information on our behalf or as independent controllers for the limited purposes described;
• With our affiliates, meaning companies under common ownership or control with Xeplin, for the purposes described in this Policy;
• With Apple, in connection with App distribution and in-app purchases;
• To comply with law, when required by applicable law, court order, or governmental request, or to protect the rights, property, or safety of Xeplin, our users, or others;
• In connection with a corporate transaction, such as a merger, acquisition, financing, reorganization, or sale of assets, in which case information may be transferred to the successor entity, subject to commitments consistent with this Policy.

Refunds and fraud prevention. If a refund request is submitted for an in-app purchase, we may share limited purchase-related information with Apple to help prevent fraud and support refund decision processes. This information may include anonymized account identifiers, app usage activity, subscription status, trial usage, purchase consumption status, total spend amount, and refund history.

We may use and share aggregated or de-identified information that cannot reasonably be used to identify you for any lawful purpose and without restriction.

8. International Data Transfers

Xeplin is based in the Republic of Türkiye. Some of our service providers are located outside Türkiye and outside the European Economic Area (EEA), including in the United States. Where personal data is transferred internationally, we rely on appropriate legal mechanisms, including, where applicable, Standard Contractual Clauses approved by the European Commission, adequacy decisions, and equivalent safeguards under Turkish Personal Data Protection Law No. 6698 (“KVKK”). By using the App, you understand that your information may be processed in countries whose data-protection laws may differ from those in your country of residence.

9. Data Retention

We retain information only for as long as reasonably necessary to fulfill the purposes described in this Policy, to operate and secure the App, to comply with our legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. In particular: realistic try-on photos are not stored by us (Section 3.7); generated design images and design request records are kept while your anonymous account is in use and may be deleted after a period of inactivity, or on your request; designs saved in the App stay on your device until you delete them or delete the App. Retention periods of our service providers depend on their own settings and practices. When information is no longer needed, it is deleted or anonymized.

10. Security

We use commercially reasonable technical and organizational measures designed to protect the limited information we collect against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS), restricted access to data, and routine security reviews. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your device secure (for example, by using a strong device passcode and keeping iOS up to date).

11. Your Rights

11.1 Rights Under GDPR (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights, subject to applicable conditions and exceptions: the right to access your personal data; the right to rectify inaccurate data; the right to erasure (“right to be forgotten”); the right to restrict or object to processing; the right to data portability; the right to withdraw consent at any time (where processing is based on consent); and the right to lodge a complaint with your local supervisory authority.

The legal bases on which we rely are: (a) legitimate interests for operating, securing, and improving the App, for analytics, advertising measurement, and fraud prevention; (b) performance of a contract for providing the design service you request and for processing subscriptions and entitlements; (c) consent for access to your camera, which you give through iOS permissions, and for sending a try-on image for Make it realistic, which you give in the App; and (d) legal obligation where we are required to retain certain information.

11.2 Rights Under CCPA/CPRA (California)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of “sale” or “sharing” of personal information as defined by California law. We do not sell or share personal information as those terms are defined under California law. We do not knowingly collect the personal information of minors under 16 without legally required consent. You may exercise your rights by contacting us at [email protected]. We will not discriminate against you for exercising these rights.

11.3 Other U.S. States

Residents of certain other U.S. states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, and Texas) may have the right to confirm whether we process their personal data, to access, correct, or delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data and we do not use it for targeted advertising. To exercise these rights, or to appeal a decision we have made about your request, contact us at [email protected]. The scope of these rights varies by state and is subject to exceptions.

11.4 Rights Under KVKK (Türkiye)

If you are located in Türkiye, you have the rights provided under the Personal Data Protection Law No. 6698 (KVKK), including the right to learn whether your personal data is processed, to request information about processing, to request correction or deletion, and to lodge a complaint with the Personal Data Protection Authority (KVKK).

11.5 Exercising Your Rights

To exercise any of the above rights, please contact us at [email protected]. We will respond within the timeframes required by applicable law. Because the App does not ask for your name or email, identifying the data associated with you may require additional information (such as the anonymous identifier assigned to your installation of the App). If we cannot verify your identity or locate the data, we may not be able to fulfill your request.

12. Children’s Privacy

The App is not directed to children under 13 years of age (or the equivalent minimum age in the relevant jurisdiction, such as 16 in some EEA countries), and Make it realistic is available only to users who are 18 or older. We do not knowingly collect personal information from children under that age. If you are a parent or legal guardian and believe that your child has provided us with information without your consent, please contact us at [email protected], and we will take reasonable steps to delete such information.

13. Do Not Track

The App does not respond to browser-based “Do Not Track” signals because such signals are not standardized for mobile applications. The App does not track you across apps or websites owned by other companies and does not request permission to do so.

14. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated Policy at xeplin.ai/apps/tattoo-ai/privacy-policy and updating the “Effective date” above, and, where appropriate, by in-app notice. Your continued use of the App after the effective date of the revised Policy constitutes your acceptance of the changes.

15. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

• Email: [email protected]
• Postal address: Xeplin Yazılım Hizmetleri Anonim Şirketi, Fulya Mah. Büyükdere Cad. Torun Center D Blok No: 74D, İç Kapı No: 43, 34394 Şişli/İstanbul, Türkiye