Privacy Policy

Privacy Policy of Hapink.com

Version: 2.2 of 23 September 2026 In force from: 26 October 2026

1. Who is responsible for your data and how to contact us

The controller of your data is YOUPROMO spółka z ograniczoną odpowiedzialnością, Kozielice 26, 74-204 Kozielice, Poland, KRS 0000521338, NIP 8531518627, REGON 321568172. Hapink.com is the English-language version of the Dziarownia.pl service run by the same controller. In privacy matters you can write to us via the contact form or by post to the address above. You do not need an Account to submit a privacy request.

This Policy explains how we process data in connection with the Account, publications, contact with artists and studios, search, recommendations and the development of AI models. Terms such as Content, Free design and Training are explained in the Terms of Service. The Policy is informative; it does not require "consent to the policy". The licence to a work and the legal basis for processing personal data are separate matters.

2. What data we receive and where from

• Account and profile: e-mail address, username, secured authentication data, avatar, Account type, registration date, information about the artist or studio and contact details provided in the profile.
• Publications: tattoo photos, designs, descriptions, categories, comments and reviews, as well as data of persons appearing in these materials. A tattoo photo may allow a person to be recognised even without a visible face.
• Rights to materials: information about the author, source and authorisation; when the INK-AI features are enabled, the date of acceptance, the full text of the accepted Terms and of the declaration concerning Free designs, the description of the button used, the identifiers of the designs shown and covered by the licence, the IP address and information about the browser; Account and publication identifiers, the history of withdrawals, restorations, holds and terminations and of transfers of materials to training datasets, submitted reservations concerning text and data mining, and data needed to handle reports.
• Use of the Service: queries, views and saved works, interactions with recommendations, device and browser data, IP address, logs and privacy settings. Access to information on your device through optional technologies requires prior consent.
• Analysis results: visual features, categories, similarity results and numerical descriptions of the features of photos, i.e. Vector representations.
• Contact: messages, complaints, reports and appeals. If you use a paid service, also the data necessary to order and settle it.

We receive data from you, from your activity and device, and from persons publishing materials or sending us reports. Some data is generated by our tools. If you choose to log in with Facebook or Google, we receive the account identifier, e-mail address, name and — if made available — the profile picture. For an import you request, we receive materials from the indicated external profile. If we use material from a lawfully accessible external source on the basis of a licence or the provisions on text and data mining, we record its source.

We do not ask for data on health, religion, views, origin, sexual orientation or other special categories of data. Please do not include unnecessary data about yourself or others in photos and descriptions.

3. Why we process data and on what legal basis

• Running the Account, publication and features you use: performance of a contract — Article 6(1)(b) GDPR. For data of studio representatives and third parties, the basis may be our legitimate interest in handling cooperation and lawful publication — Article 6(1)(f) GDPR, taking into account the rights of those persons.
• Analysis of tattoos and designs and AI training: legitimate interest in developing and improving search, classification, matching clients with artists, studios, designs and appointment slots, and detecting duplicates and abuse — Article 6(1)(f) GDPR. Providing a specific feature you ordered may be based on Article 6(1)(b) GDPR if the processing is objectively necessary to provide it.
• Personalisation: legitimate interest in presenting relevant results and recommendations — Article 6(1)(f) GDPR, respecting your right to object. Consents required for tracking technologies are collected separately.
• Security, operating statistics and evidence of licences: legitimate interest in protecting the Service, assessing its operation and establishing, exercising and defending claims — Article 6(1)(f) GDPR. Statistics using optional cookies require consent to those technologies.
• Complaints, moderation, reports and official obligations: Article 6(1)(c) GDPR for obligations arising, among others, from consumer law, the Digital Services Act and tax law; Article 6(1)(b) GDPR for performance of the contract; Article 6(1)(f) GDPR for other correspondence and the protection of rights.
• Newsletter and optional cookies: consent — Article 6(1)(a) GDPR and consents required by the applicable electronic communications law. You may withdraw them without affecting the lawfulness of earlier processing.

Before relying on legitimate interest, we assess the purpose, the necessity of processing, people's expectations and the impact on their rights. We prepare and keep a written balancing test and, before processing starts, document our assessment of whether a data protection impact assessment is required; where the risk is likely to be high we carry out such an assessment, and where it is not, we keep a documented justification. Neither the size of our company nor the use of AI tools exempts us from these obligations. If we cannot justify processing or apply adequate safeguards, we do not carry it out on this basis.

4. Photos, designs and AI models

1. For the purposes described above we analyse tattoo photos, Free designs, descriptions and tags and use them to prepare data and to build, fine-tune and evaluate models. The copyright rules are set out in §§ 3–5 of the Terms: the licence arises when a specific material is published by the rightholder. We do not collect a separate GDPR consent for each training based on legitimate interest.
2. Older publications may be used on the basis of a valid earlier licence or a licence granted now. The licence to previously published materials covers only the items shown to the user before acceptance; before granting it, the list can be reviewed and chosen materials unselected. Using other people's inspirations from the Internet requires its own legal basis; the publisher's declaration does not create rights they do not have.
3. A copyright licence, the text and data mining exception or the public availability of a photo do not exempt us from GDPR obligations. We also record the source and basis of use for historical materials and materials from outside the Service. We verify materials of uncertain origin to an extent proportionate to the information available about the material and to the level of risk; we document the method and result of verification. We do not use for analysis or training materials that we know were posted without authorisation.
4. We do not include private messages, passwords, identity documents or billing data in training datasets. Under these rules we do not train models that create new tattoo designs or imitate a particular artist.
5. Before training we remove unnecessary metadata, including location, mask faces and other direct identifiers and limit links to the Account. We also check the risk of a person being recognised from a tattoo, description, silhouette, background or the link between the photo and the Account. We verify and document the effectiveness of the anonymisation applied; where the assessment requires it, we apply additional measures such as cropping to the tattoo area or removing the background. Materials revealing special categories of data of an identifiable person are excluded from training. We do not create profiles of health, religion, views or sexual orientation, or a system for identifying people on the basis of tattoos.
6. Only persons who need access to materials for their work have it. We conclude data processing agreements with cloud infrastructure providers and with contractors tagging materials. Providers and contractors acting on our behalf may not use materials for their own training. We do not sell datasets of photos or personal data.
7. Removing a name or replacing an identifier does not in itself amount to anonymisation. We continue to protect such data in accordance with the GDPR. We also assess whether a Model or a Vector representation allows a person to be identified or data to be extracted; if so, they are also subject to data protection rules and the exercise of data subject rights.
8. You may object to the processing of your data for training. Independently of that, the rightholder of a material may terminate the licence for further training on the terms of the Terms, and a rightholder may submit a reservation concerning text and data mining. We register submitted reservations and take them into account when preparing subsequent training datasets. You can also withdraw a Free design from INK-AI at any time in "My designs". After the licence is terminated or a material is withdrawn or deleted, we stop using it in new training and remove it from active datasets without undue delay.
9. A request concerning data present in a trained model is also examined in relation to that model. Depending on the situation we apply deletion, restriction of processing, modification or retraining. Deleting the source photo alone is not always sufficient. A model may continue to operate if its further use is lawful, it does not reproduce the material and it does not allow a person to be recognised.
10. We keep a record of events that allows us to establish which materials were used in the project, on what basis and when they were added to, withdrawn from or removed from a dataset. This record serves accountability and security only and is not used to assess individuals.

5. How long we keep data

• Account and public publications: for as long as the Account or publication exists; after deletion we keep only the data needed to comply with a legal obligation, settle matters or defend claims.
• Personalisation data: for as long as needed for recommendations, until the Account or the relevant history is deleted or an objection is taken into account. We periodically review whether it is still needed.
• Technical logs: as a rule up to 12 months; data relating to an incident longer if needed to investigate it or protect claims.
• Correspondence, complaints and reports: for the time the matter is handled and then, as a rule, 3 years; longer if required by proceedings or the relevant limitation period.
• Training datasets and models: for the period actually needed for the described purposes of training, validation and maintaining features. For each dataset we record the purpose and expected storage period and periodically review whether it is still needed; we delete unnecessary data and retired models. Copies used solely on the basis of the text and data mining exception are kept only as long as necessary for that mining; the need to ensure reproducibility of results may justify further storage if it is specifically described and documented, but it does not provide a basis for an indefinite archive. Licensed materials may be kept after the end of research and development work to the extent and for the period necessary for reproducibility of results and the project's documentation obligations. Materials are excluded in accordance with point 4.
• Vector representations: for as long as needed for the feature for which they were created; after a material is withdrawn, we remove unnecessary entries from active indexes without undue delay.
• Evidence of licences and dataset documentation: for as long as the material or model is used, to the extent needed to demonstrate lawfulness, and then for the relevant limitation period for claims or the required archiving period of the project. This does not mean keeping full photos where identifiers and documentation are sufficient.
• Backups: until overwritten or deleted in the disaster recovery cycle, for the time necessary to ensure continuity and security. We do not use them as an active training dataset. After a backup is restored, we re-apply the recorded deletions and exclusions.
• Newsletter: until consent is withdrawn; evidence of giving and withdrawing consent is kept for as long as needed to defend claims. Tax and accounting data are kept for the period required by law, usually 5 years from the end of the year from which the relevant provisions require the period to be counted.

Anonymous data that cannot be linked to a person using means reasonably likely to be used may be kept longer. The obligation to archive project documentation does not in itself provide a basis for keeping personal data indefinitely.

To demonstrate compliance, we keep a record of processing activities covering purposes, categories of persons and data, recipients, planned erasure periods and the safeguards applied. We update the record whenever there is a significant change in how data is used, including when a new training dataset is launched.

6. Who has access to data and where we process it

Public profiles, photos, designs, descriptions and reviews may be visible to other users, people who are not logged in and search engines. Data sent via the contact feature is received by the chosen artist or studio, which is responsible for its further use in providing its service.

To the extent necessary we use providers of hosting, data storage, computing infrastructure, e-mail, security and analytics tools, as well as contractors tagging photos and developing models. Entities processing data on our behalf are bound by a data processing agreement and a duty of confidentiality. Data may also be received by advisers, accountants, auditors, institutions funding the project and competent authorities — to the extent necessary for a specific matter and on an appropriate legal basis.

If using a provider involves transferring data outside the European Economic Area, we rely on a European Commission adequacy decision or appropriate safeguards, in particular standard contractual clauses and, where necessary, supplementary measures. You can obtain information about the recipients, the country of transfer and the safeguards applied, and a copy of them, via the contact form.

7. Your rights

Under the GDPR you may request access to your data and a copy of it, rectification, erasure or restriction of processing. You may request data portability where processing is based on a contract or consent and carried out by automated means. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

You may object to processing based on legitimate interest, including AI training and personalisation, on grounds relating to your particular situation. After an objection we stop such processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or grounds for establishing, exercising or defending claims. You may request restriction of processing while those grounds are being verified. An objection to direct marketing requires no justification and is unconditional.

Write to us via the contact form or by post. For a photo, provide its address or details allowing it to be found. If we have reasonable doubts about your identity, we ask only for the necessary additional information. We reply without undue delay, usually within one month; in justified cases the period may be extended by two months, of which we inform you within the first month together with the reason. If we refuse, we explain the basis and the possibility of lodging a complaint and seeking judicial remedy.

You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland — current contact details: uodo.gov.pl — or with the supervisory authority in the EU Member State of your habitual residence or place of work.

8. Recommendations and automated decisions

For recommendations we take into account visual similarity, matching categories and queries, availability of appointment slots and works viewed and saved. This may constitute profiling: it affects the selection and order of suggestions. In search and recommendations we do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect a person within the meaning of Article 22 GDPR. We do not use special categories of personal data or data used to identify a person on the basis of a tattoo or biometric features for recommendations. Automated tools may flag materials for moderation; significant restrictions of Content or an Account are subject to human review. You may object in accordance with point 7.

9. When someone else published your data

We may receive your photo, professional data, description and information about a completed tattoo from the publisher. For external materials, the source is the relevant publication or licensor. The purposes, legal bases, recipients and retention periods are described above. You may exercise all applicable rights even if you do not have an Account.

We assess whether the publication and any analysis have a legal basis, taking into account your rights and the source of the material. Where there is none, we restrict processing, anonymise or delete the data. Making this Policy available does not automatically replace the obligation to inform you individually. We meet it within the periods set out in Article 14 GDPR, as a rule within one month at the latest, and where we communicate with you or disclose the data earlier — at the latest at that time. Exceptions under Article 14(5) are assessed and documented individually.

10. Voluntary data, cookies and logging in with Facebook or Google

Data marked in a form as required is needed to conclude the contract or provide the chosen feature; without it we cannot provide it. Publishing works and completing other information is voluntary. Publication involves the declaration of rights and the licence under the Terms, which also covers the AI uses described. Not granting the licence does not block the Account; it means no access to features based on analysis and training, on the terms set out in the Terms. This does not replace the right to object to the processing of personal data.

Strictly necessary cookies are used, among other things, for logging in, security and remembering privacy settings. We activate optional cookies and similar technologies only after consent; you may refuse or withdraw it. Details of the tools, purposes and periods of operation are set out in the Cookie Policy and the cookie settings available in the Service.

You can remove the connection with Facebook or Google in the settings of those services. Removing the connection does not in itself delete your Hapink.com Account; you can request deletion of the Account and related data via the contact form.

11. Security and changes to the Policy

We apply safeguards appropriate to the risk, including access control, protection of transmission, backups and permission management. We review whether data is still needed and handle incidents in accordance with our obligations under the GDPR.

We keep earlier versions of the Policy with their dates of validity. We inform you of significant changes to the purposes, legal bases and ways of using data before they are introduced. New information does not legitimise earlier processing or replace consent where it is required. Changes to the licence to materials are made in accordance with the rules for changing the Terms.