Privacy Policy

The Bunnieverse Limited, a company registered in Ireland (CRO 820921), trading as The Bunnieverse, operates the tattoo studio at 7 Meath Place, The Liberties, Dublin 8, D08 T628, Ireland. We are the data controller for the information described here when you enquire, book or receive a tattoo with us.

For anything to do with your personal information (questions, requests, or complaints), write to letsmakeart@thebunnieverse.com and put "Data protection" in the subject line. We answer within one month.

The information below helps us answer your enquiry, prepare the project and provide the tattoo appointment safely.

Enquiry details

Your name and contact details, city and country, plus an Instagram handle if you choose to include one.

Your brief

Your tattoo idea, placement, approximate dimensions, colour preference, design flexibility, preferred artist and suitable dates.

Reference and placement photographs

References and placement photographs you send. Images of the placement may show your body and are treated as private by default.

Skin tone

The form’s optional skin-tone selection informs the colour and contrast discussion. You can leave it unanswered and discuss it at the studio instead.

Health information

Relevant conditions, medicines, allergies, pregnancy or breastfeeding, and other information affecting whether tattooing can proceed safely. The enquiry form, on this website and in the app, asks whether you have any allergies and what they are. Everything else is collected on the consent form before tattooing, in the app, in your account on this website or at the studio.

Consent and session records

The signed consent form and proof of age, with records of the tattooing, aftercare instructions and any touch-up appointments.

Payment information

Deposit and payment records. The payment provider handles card payments; we do not receive or store complete card details.

Technical information

The host’s server logs record visitor IP addresses, browsers and devices to help keep the website secure and available.

Enquiry source

An enquiry includes the visit’s starting page, submission page, referring website and any campaign tags in the link. This helps us understand where enquiries come from. It is not used to track your browsing through the site or create an advertising profile.

We do not buy personal information about you from anyone, and we do not build profiles of you from your activity elsewhere on the internet. See our Cookie Policy for what happens in your browser.

Article 9 of the GDPR gives health information additional protection. Skin information and body photographs can also be sensitive in some circumstances, and receive particular care.

We ask separately for your explicit consent to collect and use sensitive information. You may refuse. The skin-tone choice can be left blank and discussed in person. If you prefer not to put a health detail in writing, let us know so it can be discussed privately before your appointment.

Sensitive information is available only to those who need it to provide tattooing safely. We do not use it for marketing or automated decisions.

To answer your enquiry and design your piece

Performance of a contract with you, or steps taken at your request before entering one (Article 6(1)(b)).

To tattoo you safely

Your explicit consent for health and skin information (Article 9(2)(a)), alongside our contract with you.

To hold client records, including your enquiry, consent, aftercare and the work carried out

Compliance with the legal and regulatory obligations that apply to a tattoo studio (Article 6(1)(c)), together with our legitimate interest in being able to evidence that we practised safely and lawfully, and in defending a claim if one is ever made (Article 6(1)(f)).

To take deposits and payments, and keep accounts

Performance of our contract with you, and compliance with our legal obligations, including tax and accounting law (Article 6(1)(c)).

To send you studio news and guest artist announcements

Your consent, given by ticking the box on the enquiry form (Article 6(1)(a)). You can withdraw it at any time.

To publish photographs of your healed tattoo

Your consent, given separately and specifically (Article 6(1)(a)).

To keep the website secure and working

Our legitimate interest in protecting the site and the people who use it (Article 6(1)(f)).

Images let people see the artists’ work, but sharing them is your choice. Permission to photograph your tattoo and permission to publish the images are separate decisions.

We ask for permission before taking photographs and separately before publishing them. You may agree to either, both or neither. You can also request a crop or the exclusion of your face, scars, surgical marks and other identifying details.

If you change your mind, email letsmakeart@thebunnieverse.com and we’ll remove the image from our own channels. We cannot remove copies that other people have already saved, shared or screenshotted.

The Bunnieverse app, on the App Store and Google Play, lets you create an account, follow your enquiry and appointments, pay session deposits, complete your consent form, send photos and message the studio. The same account works in the account area of this website. Everything else in this notice applies to the app too; this section explains what the app adds.

Your account

Your email address and the password you choose. Passwords are handled by our sign-in provider and stored only in hashed (scrambled) form, so the studio cannot see them.

Your profile

Your name, contact details and the notification choices you make in the app.

Bookings and deposits

Your enquiry, the times offered and agreed, your appointments and the record of each session deposit. Stripe processes deposit payments; we do not receive or store complete card details.

Consent and medical forms

The answers you give on your consent form, including health information, your signature, and any allergies you mention when you enquire. These are protected as described under Sensitive information.

Photos you choose to send

Reference, placement and healing photos you add to an enquiry or a message. They are stored privately and seen only by our team and your artist.

Messages

The messages between you and our team or your artist.

Notifications and your device

If you allow notifications, a notification token for your phone and whether it is an iPhone or an Android phone, so your notifications reach it. Signing out removes that phone’s token.

The app has no advertising and no third-party analytics or tracking. We do not sell your information or use it to build advertising profiles.

Why the app uses this information, and our lawful basis:

To run your account, bookings and messages, take session deposits and notify you about your appointments

Performance of our contract with you, or steps taken at your request before entering one (Article 6(1)(b)), and compliance with our legal obligations for payment records (Article 6(1)(c)).

To collect the health answers on your consent form

Your explicit consent (Article 9(2)(a)), alongside our contract with you.

To send you studio news and guest artist notifications

Your consent (Article 6(1)(a)). You can switch these off at any time in the app under Me, then Notifications.

To keep accounts secure and the app working

Our legitimate interest in protecting your account, the studio’s records and the people who use the app (Article 6(1)(f)).

The app asks for your camera or photo library only when you choose to take or add a photo, and it only uses the photos you pick. It asks before sending you notifications. You can choose which notifications you get in the app under Me, and you can turn notifications, camera or photo access off at any time in your phone’s settings.

The providers that run the app are listed under Who we share it with. Like the website, the app is not directed at children; we do not tattoo anyone under eighteen.

In the app you can ask for a copy of your data or a correction under Me, then Privacy. You can delete your app account there too, or by emailing letsmakeart@thebunnieverse.com. Deleting your app account removes your login and the details you added in the app straight away; some records connected to your bookings, such as signed consent forms and deposit and payment records, are kept for as long as the law requires. Deletion has to wait while you have an appointment coming up or your records are on hold for a legal reason. See Delete your account for the details. App Terms of Use and App Support cover using the app.

We do not sell personal information or exchange it for advertising. The service providers below process it on our instructions and have contractual duties to protect it.

• Supabase, which provides our database, account sign-in and private file storage for the website, the app and the studio’s records. Our database is hosted in the EU.
• Vercel, which hosts our website.
• Google, which provides the studio’s email (Google Workspace) and the calendar where appointments are kept, including your name and appointment details.
• Brevo, which sends and receives some of the studio’s email, including studio news.
• Stripe, which processes deposits and payments.
• Expo, with Apple’s and Google’s notification services, which deliver app notifications to your phone.
• Cloudflare Turnstile, which checks that enquiry forms on this website are sent by a person rather than an automated program.
• Anthropic and OpenRouter, AI services that help our team draft replies to messages and sort new enquiries. Names, email addresses, phone numbers and links are replaced before anything is sent, text that mentions health is never sent, and a person checks every reply before it reaches you.
• Google, which serves the map on our contact section. When that map loads, Google receives your IP address and may set its own cookies. We only load it after you accept on our cookie banner, or choose to load it yourself.
• Our accountant, and if it ever became necessary, our insurer or legal advisers.

Information may also be disclosed where the law requires it, including to a public health authority, the Revenue Commissioners or a court.

Your artist has access to the project brief and details required for the appointment. Health information is restricted to people who need it to provide tattooing safely.

We prefer providers who host data inside the European Economic Area. Where a provider processes information outside the EEA, we rely on a European Commission adequacy decision for that country, or on the Commission’s standard contractual clauses together with any additional safeguards the transfer requires.

You can ask us which providers we currently use, and where, by writing to letsmakeart@thebunnieverse.com.

We retain information only for as long as its purpose requires. The categories below explain how this applies.

Enquiries and client records

Retained for the regulatory, safety and legal purposes described above and reviewed periodically. You can ask what information we currently hold about you.

Reference and placement photographs

Removed when the piece is complete, unless you have requested that we retain them for planned work.

Consent forms, health declarations and session records

Retained for six years from your last appointment, plus a short margin. This reflects the usual period for bringing a civil claim in Ireland and allows us to evidence the work and decisions made.

Payment and accounting records

Retained for the period required by tax and company law.

Marketing consent

Kept until consent is withdrawn, followed by a record of your opt-out.

Published photographs

Kept until you request their removal.

The website uses an encrypted connection. Enquiries are held in a database with restricted access, and paper consent forms are locked in the studio. Only people who need the records can access them; client work is not discussed outside the studio.

If a breach is likely to put your rights at risk, we will notify you and the Data Protection Commission without undue delay. No system can offer absolute security.

Under the GDPR you have the right to:

• Ask what personal information we hold about you, and get a copy of it.
• Have inaccurate information corrected.
• Have information erased, where we no longer have a good reason to keep it.
• Ask us to restrict how we use it while a question about it is resolved.
• Receive information you gave us in a portable, machine-readable format.
• Object to processing we carry out on the basis of legitimate interests.
• Withdraw consent at any time, including consent for marketing, for photographs, or for us to hold health and skin information. Withdrawing consent does not undo processing that was lawful at the time.
• Not be subject to a decision based solely on automated processing. We do not make any.

To exercise any of these, email letsmakeart@thebunnieverse.com. We may ask you to confirm your identity so we do not hand your information to someone else. This is free, and we respond within one month.

If you are unhappy with how we have handled your information, we would like the chance to put it right. You also have the right to complain directly to the Data Protection Commission at dataprotection.ie.

We do not tattoo anyone under the age of eighteen, with or without a parent’s permission, and we ask for photo identification when there is any doubt. This website is not directed at children and we do not knowingly collect their information. If you believe a child has sent us personal information, tell us and we will delete it.

If we change how we handle personal information, we will update this page and the date at the top of it. Where a change materially affects you, we will tell you directly. This version was published on 30 October 2026.