Privacy policy

This Privacy Policy explains how we process personal data in connection with our online shop at tattup.shop and our other activities: for what purposes, how and where. We also inform you about the rights of data subjects.

We are subject to Swiss data protection law (FADP) and, where applicable, the European Union's General Data Protection Regulation (GDPR). The European Commission recognises that Swiss data protection law ensures an adequate level of protection (decision of 26 July 2000, confirmed on 15 January 2024).

Last updated: 18 October 2026

Table of Contents

1. Contact Details

The controller responsible for processing personal data is:

7Cloud AG (trade name "Tattup")
Bahnhofstrasse 19
9100 Herisau
Switzerland
UID CHE-468.091.118
E-mail: help@tattup.shop

In individual cases, third parties may be responsible for processing, or there may be joint responsibility with third parties. We are happy to provide information on request.

1.1 Data Protection Contact

For all data protection enquiries, including from authorities, you can reach us at the address above or by e-mail to help@tattup.shop.

Personal data is any information relating to an identified or identifiable natural person. Processing means any handling of personal data, for example collecting, storing, using, disclosing or deleting it. Sensitive personal data includes, for example, data concerning health or biometric data.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO). Where the GDPR applies, we rely in particular on the following legal bases:

  • Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures, for example orders.
  • Art. 6(1)(a) GDPR: your consent, for example for analytics and marketing cookies or the newsletter.
  • Art. 6(1)(f) GDPR: legitimate interests, in particular a secure and user-friendly shop, protection against abuse and the enforcement of our own claims, unless your interests prevail.
  • Art. 6(1)(c) GDPR: compliance with legal obligations, for example retention obligations.
  • Art. 9(2) GDPR: for special categories of personal data, in particular with your explicit consent.

3. Nature, Scope and Purpose of Processing

We process the personal data required to operate our shop, handle orders, communicate with you and improve our offering. This includes in particular master and contact data, order and payment data, content you send us (for example images in the Custom Studio) and browser, device and usage data.

We process personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (generally 10 years for accounting records). After that, we delete or anonymise it.

4. Automation and Artificial Intelligence

We use artificial intelligence (AI) in particular in the Custom Studio (section 18), in the AI Tattoo Generator (section 19) and in the chat on our website (section 15.4). For this we use external AI service providers, also outside Switzerland and the EU (for example in the USA), with appropriate safeguards in accordance with section 9. Motifs and answers generated by AI may be inaccurate.

We do not make decisions based solely on automated processing that have legal effects for you or significantly affect you. Should this change, we will inform you in each case.

5. Disclosure of Personal Data

We disclose personal data to third parties or have it processed by third parties where necessary for the purposes described. These include in particular IT and hosting providers, providers of shop apps, payment service providers, logistics and shipping companies, marketing and analytics services, advisers and authorities where we are legally obliged. We name the most important services in this Privacy Policy.

6. Communication

When you contact us, for example by e-mail, contact form, social media or chat, we process the information you provide in order to answer your request. The legal basis is the performance of a contract or our legitimate interest in answering your request. For the chat on our website, see section 15.4.

7. Job Applications

We process personal data of applicants to the extent necessary to assess their suitability and to carry out an employment relationship (Art. 6(1)(b) and Art. 9(2)(b) GDPR). We delete application documents of unsuccessful applicants after the process has ended, unless you have consented to longer retention.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data, for example access restrictions and transport encryption (HTTPS). However, no digital communication can guarantee absolute security.

9. Personal Data Abroad

We generally process personal data in Switzerland and the European Economic Area (EEA). Some service providers also process personal data in other countries, in particular in the USA, for example Shopify, Google, Meta, Microsoft, Vercel, Klaviyo, Swym, Triple Whale and our AI service providers. Providers of individual shop apps may also be based outside Switzerland and the EU.

We transfer personal data to countries without adequate data protection only with appropriate safeguards. For the USA we rely, where the provider is certified, on the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, and otherwise on standard contractual clauses. In exceptional cases, a transfer may also take place with your explicit consent or for the performance of a contract. We will provide information on the safeguards on request.

10. Rights of Data Subjects

Within the scope of applicable law, you have in particular the following rights:

  • Access to information on whether and which personal data we process about you.
  • Rectification of inaccurate and completion of incomplete data, and restriction of processing.
  • Erasure of your data and objection to processing with effect for the future.
  • Withdrawal of consent given, with effect for the future.
  • Data release and portability to you or to another controller.
  • Stating your own position and human review in the case of automated individual decisions.

To exercise these rights, contact help@tattup.shop. We may ask for proof of identity. We may restrict the exercise of rights to the extent permitted by law, for example due to statutory retention obligations.

You may also lodge a complaint with a data protection supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), in the EEA the supervisory authority of your country of residence (overview).

11. Use of the Website, Cookies and Consent

11.1 Cookies

We and the services we integrate use cookies. These are data stored in the browser, either only for the session or for a certain period. We need technically necessary cookies to operate the shop, for example for the cart and checkout. We use analytics and marketing cookies only as described in section 11.3.

You can delete or block cookies in your browser settings at any time. Without cookies, the shop may not work fully. For many advertising services, a general opt-out is possible via Your Online Choices or NAI.

11.2 Storage in Your Browser

In addition to cookies, we and integrated services store data in your browser's local storage (localStorage, sessionStorage and IndexedDB). Examples are cart and language settings, your cookie choice, the wishlist, drafts from the Custom Studio and identifiers of analytics and marketing services. This data remains on your device until you delete it in your browser settings (clear site data).

We obtain your consent to cookies and similar technologies via a cookie banner. For this we use the consent management app "Pandectes". Your choice, its time and a pseudonymous identifier are stored.

We act in accordance with the FADP and the GDPR. Analytics and marketing services are only activated with your consent where the law requires consent (Art. 6(1)(a) GDPR). Where consent is not required, we rely on our legitimate interest; you can object at any time. You can change or withdraw your choice at any time with effect for the future via the cookie settings, or by e-mail to help@tattup.shop.

11.4 Logging

Each time our website is accessed, technical information is recorded, for example date and time, IP address, browser, operating system, page accessed and referrer. We need this information to provide the website securely and reliably (legitimate interest).

11.5 Tracking Pixels

We and integrated services may use tracking pixels (web beacons), i.e. small images or scripts loaded when a page or e-mail is opened. At least the same information as in logging may be recorded.

12. Customer Account and Orders

For orders we process in particular your name, delivery and billing address, e-mail address, telephone number (if provided), ordered products, payment method and order history. We need this data to perform the contract, for shipping, customer service and statutory retention obligations.

You can open a customer account. Sign-in uses Shopify's customer account feature, usually with a code sent by e-mail. In your account you can see your orders, subscriptions and your credit balance for the AI Tattoo Generator. You can have your account deleted at any time by e-mail to help@tattup.shop. We continue to retain order data in accordance with statutory periods.

13. Newsletter and Notifications

We send newsletters and marketing messages by e-mail or SMS only with your consent or where permitted by law. For sign-up we may use the double opt-in procedure and record your consent with time and IP address. Messages may contain tracking pixels and links that record whether a message was opened and which link was clicked. You can unsubscribe at any time via the unsubscribe link.

  • Klaviyo: E-mail and SMS marketing, including sign-up forms in the shop and tracking of shop behaviour (for example viewed products and cart) for personalised messages; Provider: Klaviyo Inc. (USA); Privacy Policy.

We send order and shipping confirmations and review requests after purchase (section 15.3) via Shopify or the services named there, as part of contract performance or based on our legitimate interest.

14. Social Media

We are present on social media platforms such as Instagram, Facebook, TikTok and Pinterest. The terms and privacy policies of the respective platform also apply. Personal data may also be processed outside Switzerland and the EEA.

For our Facebook page, including Page Insights, we are jointly responsible with Meta Platforms Ireland Limited (Ireland) where the GDPR applies. Under the "Controller Addendum", Meta is responsible for fulfilling data subject rights. Further information can be found in Meta's Privacy Policy.

15. Third-Party Services

We use services of specialised third parties to operate our shop securely, reliably and in a user-friendly way. For embedded services, providers record at least your IP address for technical reasons. Providers may also process data in aggregated, anonymised or pseudonymised form for their own purposes such as security and statistics. The privacy policies of the respective providers also apply.

Google services: Providers: Google Ireland Limited (Ireland) / Google LLC (USA); Privacy Policy, personalised advertising settings. We name the individual Google services in the following sections.

15.1 Shop and Infrastructure

  • Shopify: E-commerce platform for our online shop, checkout and customer account; Providers: Shopify International Limited (Ireland) and other Shopify companies; Privacy Policy.
  • Vercel: Hosting of our own applications (in particular the Custom Studio, AI features and production dashboard) and storage of design files in the Vercel Blob service (storage region Frankfurt, Germany; processing may also take place in the USA); Provider: Vercel Inc. (USA); Privacy Policy.

15.2 Payments

We use specialised payment service providers. Their terms and privacy policies also apply.

  • Shopify Payments: Card payments (for example Visa, Mastercard, American Express, UnionPay) and other payment methods; Provider: Shopify International Limited (Ireland) in cooperation with Stripe.
  • PayPal: Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
  • Klarna: Provider: Klarna Bank AB (Sweden).
  • TWINT: Payments in Switzerland; Provider: TWINT AG (Switzerland).
  • Apple Pay: Providers: Apple Distribution International Limited (Ireland) / Apple Inc. (USA).
  • Google Pay: Provider: Google.
  • iDEAL | Wero: Payments in particular in the Netherlands, processed via Shopify Payments.

15.3 Shop Features

For additional features in the shop we use apps from third-party providers. These providers may be based outside Switzerland and the EU (see section 9).

  • Judge.me: Product reviews and review requests by e-mail after purchase.
  • Swym Wishlist Plus: Wishlist; Provider: Swym Corporation (USA).
  • Estimated Delivery Days: Display of estimated delivery dates.
  • Lookfy: "Shop the Look" galleries.

The legal basis is the performance of a contract or our legitimate interest in a user-friendly shop; where these services process data for marketing, your consent.

15.4 Chat with Artificial Intelligence

On our website we offer a chat in which an AI answers questions about products, orders and shipping. We use the app "Zipchat" for this. We process your messages, any contact details or order numbers you provide and usage data in the shop. The messages are processed by the app provider and its AI service providers, also outside Switzerland and the EU. Please do not enter sensitive personal data in the chat. The legal basis is our legitimate interest in efficient customer service or the performance of a contract.

15.5 Social Media Content, Videos and Fonts

  • Instagram: Embedding of Instagram content; Provider: Meta Platforms Ireland Limited (Ireland).
  • Pinterest: Embedding of pins and sharing features; Providers: Pinterest Europe Ltd. (Ireland) / Pinterest Inc. (USA).
  • TikTok: Embedding of content and sharing features; Providers: TikTok Technology Limited (Ireland) / TikTok Information Technologies UK Limited (United Kingdom).
  • YouTube: Embedding of videos; Provider: Google.
  • Google Fonts: Fonts; Provider: Google.

15.6 Advertising

We advertise with third parties, in particular on social networks and search engines. We want to reach people who are interested in our products (targeting and remarketing) and measure whether our advertising leads to visits and purchases (conversion tracking). For this we may transmit information, possibly also personal data, to these third parties. Platforms where you are logged in may associate your use of our shop with your profile. We use these services as described in section 11.3.

  • Google Ads: Search and shopping advertising; Provider: Google.
  • Meta Ads: Advertising on Facebook and Instagram with the Meta Pixel, server-side transmission of events such as purchases via the Conversions API (where applicable with hashed contact data) and Custom and Lookalike Audiences; Provider: Meta Platforms Ireland Limited (Ireland) and other Meta companies (including in the USA).
  • Pinterest Ads: with the Pinterest Tag; Providers: Pinterest Europe Ltd. (Ireland) / Pinterest Inc. (USA).
  • Snapchat Ads: with the Snap Pixel; Provider: Snap Inc. (USA).
  • TikTok Ads: with the TikTok Pixel; Providers: TikTok Technology Limited (Ireland) / TikTok Information Technologies UK Limited (United Kingdom).

16. Partner Programmes

We remunerate partners who refer to our shop (affiliate and influencer marketing). In this context, it may be recorded via which link a purchase was made.

  • Upfluence: Influencer and affiliate programme (partner sign-up, attribution of referrals and commissions); Providers: Upfluence SAS (France) / Upfluence Inc. (USA).

17. Performance and Reach Measurement

We measure how our shop is used in order to fix errors and improve our offering, including with A/B tests. Cookies may be used and pseudonymous usage profiles created, for example pages visited, screen size and approximate location. IP addresses are shortened where possible. We use these services as described in section 11.3.

  • Google Analytics and Google Tag Manager: Reach measurement, including across devices, and integration and management of services; Provider: Google.
  • Google Merchant Center: Measurement of visits and purchases from Google Shopping and free product listings; Provider: Google.
  • Microsoft Clarity: Usage analysis with heatmaps and session recordings (for example clicks, mouse movements, scrolling; input in form fields is masked), including the "Brand Agents" feature; data may be linked with Microsoft Advertising (Bing); Providers: Microsoft Ireland Operations Limited (Ireland) / Microsoft Corporation (USA); Privacy Statement.
  • Triple Whale: Attribution of orders to marketing channels and campaign analysis; Provider: Triple Whale Inc. (USA).

18. Custom Studio (Your Own Tattoo Designs)

In the Custom Studio you can create your own tattoo designs and upload your own images, for example photos or drawings. We process the uploaded files, the design you create, the options you choose (for example size and quantity) and technical data such as IP address and time. The purpose is creating, previewing, ordering and producing your tattoo (Art. 6(1)(b) GDPR).

Storage: When you add a design to the cart, we store the design and uploads in our own application hosted by Vercel, in the Vercel Blob service in the Frankfurt region (Germany). The design is linked to your order in Shopify and used by our staff in a protected production dashboard to manufacture your order.

Deletion: Designs that are not ordered are deleted automatically after 14 days; ordered designs are deleted 90 days after upload. Data contained in the order itself is retained in accordance with statutory periods.

In your browser: So that you can continue editing designs from the cart, the Custom Studio stores drafts and images locally in your browser (IndexedDB or localStorage). A photo of your own body used for the preview stays in your browser only and is not transmitted to us.

AI design: Optionally, you can have an AI create a motif from a text description (limited number of free generations per day). We transmit your description to external AI service providers, also outside Switzerland and the EU (for example in the USA), with appropriate safeguards in accordance with section 9. Please do not enter personal data in the description. To limit generations, we use a pseudonymous session token (cookie "czs_fg" stored for 30 days, plus a copy in localStorage) and a non-reversible hash of your IP address, which we delete after a few days. Our server does not store the generated images.

Rights to uploads: Only upload images for which you hold the necessary rights. Identifiable people in photos must agree to their use.

19. AI Tattoo Generator

With the AI Tattoo Generator you can create tattoo motifs from a text description and a chosen style and order them as a custom tattoo. A customer account is required (section 12). You pay for generations with credits, which you buy as a one-time purchase or as a subscription via the Shopify checkout.

Data processed: account data (in particular e-mail address), your input (description and style), the generated motifs, your credit balance, purchases and subscriptions, and technical data. The purpose is providing the generator, managing your account, credits and subscriptions, ordering motifs (Art. 6(1)(b) GDPR) and protection against abuse (Art. 6(1)(f) GDPR).

External AI processing: To generate motifs, we transmit your input to external AI service providers, also outside Switzerland and the EU (for example in the USA), with appropriate safeguards in accordance with section 9. Please do not enter personal data of third parties or sensitive personal data in descriptions.

Storage: We store your generated motifs in your account so that you can view and order them later, for as long as your account exists or until you request deletion. Purchase and subscription data is retained in accordance with statutory periods.

Community: The "Community" area shows only motifs selected by Tattup. Private content from your account is not published there.

Subscriptions: You can cancel a subscription at any time in your customer account or by e-mail to help@tattup.shop.

20. Final Notes

We may amend this Privacy Policy at any time. The version published on our website applies. If you have any questions, contact us at help@tattup.shop.