Privacy Policy

Francisco Costa Ink, a tattoo studio run by Francisco Costa at Rua Borges Carneiro 59A, Lapa, Lisbon, Portugal, is the controller of your personal data for this website. You can reach us through the booking form, Instagram or WhatsApp (see Contact below).

When you send an inquiry through the booking form

• Your name
• Your Instagram handle or WhatsApp number (at least one, so we can reply)
• The style, body placement and size you choose
• Your description of the idea
• The design you chose to claim, if any

Please do not put health information, ID numbers or other sensitive details in the form. If we ever need something like that, we will ask in person at the studio.

When you message us on Instagram or WhatsApp

Those conversations take place in the Instagram or WhatsApp apps, not on this site. We see what you send us, including your profile name or phone number, and use it only to arrange your session. Meta's own privacy policies apply to how those apps handle your messages.

When you simply visit the site

Like any website, the platform that hosts it receives technical data when your browser connects: your IP address, the type of browser and device, the pages you open, the page you came from and the time. We do not run analytics: the site does not count visits, use tracking IDs or build profiles. We use this technical data only to keep the site running and secure, and we do not use it to identify you.

What we do not collect

• Customer accounts, logins or passwords
• Payments: deposits and payments are arranged directly with Francisco and are never processed through this website
• Visit analytics, tracking IDs, advertising or marketing cookies, or any tracking across other sites
• Your location: the “open now” indicator only compares Lisbon opening hours with the time on your own device

• To reply to your inquiry and arrange your session. Legal basis: steps taken at your request before an agreement (GDPR, Art. 6(1)(b)).
• To keep the site secure and working. Legal basis: our legitimate interest (Art. 6(1)(f)).
• To remember your language choice. This stays on your own device.
• To meet any legal obligation that applies to us (Art. 6(1)(c)).

We do not make decisions about you by automated means.

We share data only with the service providers needed to run the site and handle your request. Francisco is the only person who reads inquiries.

• Base44 hosts the website and the database that stores your inquiry.
• Instagram and WhatsApp (Meta) handle your messages if you contact us there. If this site shows an Instagram post, it loads from Instagram only after you click “Show post”. Instagram may then collect data about your visit under its own policy.
• Google Maps is used only if you click the address link. Nothing is loaded from Maps before that.

We do not sell personal data. Nothing else is loaded from other companies: the fonts, images and code all come from this site.

This site does not use advertising or marketing cookies. It stores only the following on your device:

• Your language choice (kept until you clear your browser data)
• A flag so the opening animation plays once per visit (cleared when you close the tab)
• A sign-in token, only on the studio owner's own device, when they log in to manage the site. Visitors never log in.

Instagram posts, if you choose to show one, are loaded from Instagram and may set their own cookies. You can clear stored data at any time in your browser settings.

We keep an inquiry for as long as needed to answer you and arrange your session, and then for up to 12 months so we can follow up on touch-ups or a new booking, unless you ask us to delete it sooner.

Some of our providers (Base44, Meta) may process data outside the European Economic Area, including in the United States. Where they do, this is covered by safeguards recognised under EU data protection law, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Have it corrected if it is wrong
• Have it deleted
• Restrict or object to how we use it
• Receive it in a portable format
• Withdraw consent at any time, where we rely on it

To use any of these rights, message us on Instagram or WhatsApp, or send a new inquiry through the booking form, and tell us what you need. We may ask you to confirm who you are before sharing or deleting data. We reply within one month.

You also have the right to complain to the Portuguese data protection authority, the CNPD (cnpd.pt), or to the authority in your own country.

The site is served over HTTPS. Inquiries are stored in a database that only the studio owner can read. No system is perfectly secure; if a breach affecting you ever occurs, we will tell you and the authorities as the law requires.

Our tattoo services are for people aged 18 and over, and we do not knowingly collect data from anyone younger. If you think a minor has sent us data, tell us and we will delete it.

We may update this policy from time to time. The date at the top shows the latest version.