Privacy policy

Effective date: 12 October 2026

I'm Alex Fernandes, and I run Alex Fernandes Tattoo, a solo tattoo studio in Brisbane, Queensland. This policy explains what personal information I collect, why I need it, who helps me handle it, and the choices you have. I handle your information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What I collect

• Contact details: your name (and the name you go by), mobile number, email, date of birth, address and postcode, and Instagram handle.
• Your tattoo idea: what you'd like and what it means to you, placement, size, style, budget, timing, how you found me, and any photos you send (references and photos of the area).
• Consent form, signed before your session: your answers to health questions, a photo of your government-issued ID, your signature, and the time and IP address when you signed.
• Photos of your tattoo: in progress, finished and healed.
• Messages: emails, text messages (SMS), Instagram direct messages and client portal messages, including attachments.
• Bookings and payments: appointments, quotes, deposits, payments, vouchers and gift cards, plus my notes about your project.
• Your marketing choice: whether you said yes to offers, the exact wording you agreed to, and when.
• Referrals: if a friend referred you, who it was.
• Sign-in and security details: one-time sign-in codes, and technical details such as your IP address when you use my sign-up form or client portal.

Some details are optional. The consent form, including a photo ID, is required before I can tattoo you.

Why I use it

• To reply to your enquiry, quote and design your tattoo.
• To book your appointments and send confirmations and reminders.
• To check that you're 18 or older (the law in Queensland) and that it's safe to tattoo you.
• To take deposits and payments, and keep business and tax records.
• To look after your tattoo while it heals, including touch-ups.
• To send you offers, as explained under Offers and news.
• To share photos of my work, as explained under Photos.

I never sell your information. I may share it if the law requires me to.

Health information and ID

Your health answers and your ID are sensitive information. I collect them with your consent and use them only to decide whether it's safe to tattoo you, to look after your healing, and to confirm who you are and that you're 18 or older.

• Every time your consent form or ID photo is opened, it's recorded.
• I keep the signed form and the ID photo for 7 years after your last session. After that, I delete them.

Photos

• Reference images and photos of the area are private. I use them only to design your tattoo, and I never post them.
• Photos of your tattoo may be posted on my social media (such as Instagram) and on this website, at my discretion. Your consent form explains this before your session. If you gave me your Instagram handle, I may tag you.
• If there's a specific reason you'd prefer your tattoo not to be posted, let me know. There's a space for it on your consent form, or you can tell me at any time. I'll note it on your record and won't post photos of your tattoo. If you want a post taken down, tell me and I'll remove it.
• I remove hidden location data (GPS) from ID photos and from photos you send through my website or Instagram.

Messages and AI help

I keep our emails, texts, Instagram messages and client portal messages together, so I can see the whole history of your project in one place. Messages you send to my Instagram account reach my system through Meta's official Instagram tools, including any photos.

I use OpenAI to help with messages: to polish replies I write, to spot new tattoo requests, to pull the key details out of an enquiry, and to suggest follow-ups on older quotes. It also reads replies to my appointment reminders to tell whether you're confirming, moving or cancelling. If you confirm, your booking is marked as confirmed automatically. Anything AI drafts is reviewed by me before it's sent.

Payments

Deposits and payments are processed by Stripe. Stripe handles your card details on its own systems. I never see or store your full card number. I keep a record of what you paid, when and how.

Offers and news

I only send offers and news (by email or text message) to people who have said yes. You can say yes with the box on my sign-up form, on your consent form or in my client portal. The box is never ticked for you, and I keep a record of the exact wording you agreed to and when. If you haven't said yes, you won't get offers from me.

You can stop marketing messages at any time:

• use the unsubscribe link in any marketing email, or
• reply STOP to any marketing text message.

You'll still get messages about bookings you've made, such as reminders and receipts.

Client portal and sign-in codes

In my client portal you can see your bookings, message me and see photos I share with you. To sign in, I send you a 6-digit code by email or text message. The code expires after 10 minutes and is stored in scrambled (hashed) form. A cookie keeps you signed in on that device for up to 30 days.

My sign-up form also emails you a 6-digit code to confirm your email address.

Who helps me

These services handle some of your information for me:

• Google: email (Gmail, Google Workspace), my appointment calendar (Google Calendar shows your name and the booked service), address suggestions on the consent form (Google Maps receives what you type in the address field), encrypted backups (Google Drive), and the fonts on this website (Google Fonts).
• DigitalOcean: hosts my client system and stores files such as photos and ID photos, in Sydney, Australia.
• Twilio: sends and receives text messages, including sign-in codes.
• Stripe: payments.
• Meta (Instagram): Instagram direct messages, and posting photos of my work.
• OpenAI: AI help with messages, as explained above.
• Telegram: private alerts to my phone about new messages, enquiries and my daily schedule. An alert can include your name and part or all of your message.

Information stored outside Australia

My client system and file storage are hosted in Sydney, Australia. Some of the services above (Google, Twilio, Stripe, Meta, OpenAI and Telegram) may store or process your information outside Australia, for example in the United States.

How I keep it safe

• Only I, and anyone I authorise to help run the studio, can access client records.
• Opening a consent form or ID photo is logged.
• Backups are encrypted.
• Card numbers never reach my systems.

How long I keep it

• Consent forms and ID photos: 7 years after your last session, then deleted.
• Sign-up requests I don't approve: deleted after 30 days if I decline them, or after 90 days if they're never reviewed.
• Your client record, our messages and payment records: 7 years after your last appointment.

Seeing, correcting or deleting your information

You can ask for a copy of the information I hold about you, ask me to correct it, or ask me to delete it. Email me at bookings@alexfernandes.ink. I may need to confirm who you are first, and I'll reply within 30 days. Some records I have to keep, such as signed consent forms. If I can't do what you ask, I'll tell you why.

Complaints

If you're worried about how I've handled your information, email me first and I'll do my best to fix it. If you're not happy with my reply, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

This website

This website doesn't use analytics or advertising cookies. It loads its fonts from Google Fonts. When you send an enquiry, your answers and photos go straight to my client system.

Contact

Questions or requests about your privacy: bookings@alexfernandes.ink. You can also message me on Instagram at @alexfernandes.tattoo.

Changes to this policy

I may update this policy from time to time. The effective date at the top shows when it last changed.