Privacy policy
What The Stencil Room collects, why, who else sees it, how long we keep it, and how to have it corrected or deleted.
Who is responsible
The Stencil Room (thestencilroom.com) is run by The Stencil Room, , Calle Carabelos 28, 28041, Madrid, Spain. They are the controller of the personal data described here. For anything about your data, email hello@thestencilroom.com.
The short version
- No analytics, no advertising trackers, and we never sell or rent personal data.
- Listings describe studios and the artists who work there. They come from public information and from the studios themselves, and anyone listed can have their details corrected or removed.
- We collect only what each feature needs, and delete it on the schedule below.
What we collect and why
| What | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Studio listings: name, address, website, phone, Instagram handle, styles, services, published prices | Public sources (OpenStreetMap, the studio's website, its public Instagram and Google Maps profiles) and the studio itself | To run the directory and check that each studio is real and open | Legitimate interests: helping people find studios, and studios being found (art. 6(1)(f)) |
| Artists: name, Instagram handle, styles, booking status, short bio, portfolio photos | The studio or the artist | To show who works where, and their work | Legitimate interests (art. 6(1)(f)). The women-artists filter only includes artists who chose to be listed that way (consent, art. 6(1)(a)) |
| Claim requests: email, Instagram handle, your role, your note | You | To check you run the studio before giving you control of its listing | Steps you asked for before an agreement (art. 6(1)(b)) |
| Studio accounts: email, sign-in sessions | You | To let you manage your listing | Contract (art. 6(1)(b)) |
| Guest-spot posts: name, Instagram handle, city, dates, terms, email | You | To publish your post and contact you about it. Everything except the email is public | Contract (art. 6(1)(b)) |
| Booking requests to Pro studios: name, email, tattoo idea, placement, size | You | To pass your request to the studio you chose | Your request (art. 6(1)(b)) |
| Payments: name, email, billing address, tax ID, what you bought | You, through Stripe. Card details go to Stripe only; we never see them | To take payment, issue invoices and keep tax records | Contract and legal obligation (art. 6(1)(b) and (c)) |
| Reports: your reason, and a one-way salted code made from your IP address | You | To count separate reporters and stop abuse. The code can't be turned back into your IP address | Legitimate interests: keeping listings accurate and safe (art. 6(1)(f)) |
| Bot check: browser and device signals | Your browser, checked by Cloudflare Turnstile when you send a form | To block spam and automated abuse | Legitimate interests: security (art. 6(1)(f)) |
| Technical logs: IP address, page requested, time, browser | Your browser | Security and fixing errors | Legitimate interests (art. 6(1)(f)) |
Cookies
We only use cookies the site needs to work, so there is no cookie banner.
sr_sessionkeeps a studio owner signed in for up to 30 days. It is set only after you sign in from an emailed link.- Our hosting provider, Cloudflare, may set security cookies that tell people from bots. See Cloudflare's cookie policy.
Who else handles your data
- Cloudflare, Inc. hosts the site, its database and photo storage, sends our emails and runs the bot check, on our behalf.
- Stripe Payments Europe, Ltd. (Ireland) handles payments, invoices and VAT. For some purposes, such as fraud prevention, Stripe decides how it uses data itself; see Stripe's privacy policy.
- The studio you contact receives your booking request. From then on, the studio is responsible for how it uses your details.
- Google Maps and Instagram: when we check that a studio is real, we look up its public business details there. We send only the studio's name, city or handle, never anything about visitors.
- Authorities, only when the law requires it.
Transfers outside Europe
Cloudflare and Stripe may process data outside the EU, the EEA and the UK, including in the United States. These transfers are covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, with the UK addendum where UK law applies.
How long we keep it
| Data | Kept for |
|---|---|
| Listings | While the studio is listed. Removed within 30 days of a valid removal request |
| Studio account and verified claim | While you manage a studio on the site, or until you ask us to close the account |
| Sign-in links | 30 minutes. Deleted within a day of expiring |
| Sign-in sessions | Up to 30 days, or until you sign out |
| Guest-spot posts | Shown until their end date, then deleted 12 months later |
| Booking requests | 12 months |
| Unpaid checkouts, rejected claims and reports | 12 months |
| Payments and invoices | As long as Spanish tax and accounting law requires (generally up to six years), held in Stripe |
| Technical logs | Up to 7 days |
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or give it to you in a portable format. You can also object to how we use it, including to being listed. Where we rely on your consent, you can withdraw it at any time.
Email hello@thestencilroom.com and we will reply within one month. Studio owners can correct most details themselves after signing in.
If you're unhappy with our answer, you can complain to the Spanish data protection authority, theAEPD, or to the authority where you live, such as the ICO in the UK.
Age
The Stencil Room is meant for adults. We don't knowingly collect data from anyone under 18.
Changes
When this policy changes, we update the date at the top. If a change affects studio accounts in a meaningful way, we email account owners before it applies. The terms of use cover the rest of how the site works.