Privacy notice
Updated 19 October 2026. This notice explains how your data is processed when visiting this website, contacting the studio, booking an appointment or using Maria, our virtual assistant.
1. Data controller
Trustline Art UG, represented by managing director Juan Manuel Sanchez Becerra, Klingenberger Straße 62, 74080 Heilbronn, Germany. Email: info@linetattooheilbronn.de. Telephone: +49 1575 3616993. Contact us by email or post with privacy enquiries.
2. Technical delivery and security
This website is hosted through Cloudflare Workers (Cloudflare, Inc.). Technical data such as IP address, time, page and browser is processed to deliver and protect the service. The D1 chat database has EU jurisdiction; this does not guarantee that all infrastructure processes data exclusively in the EU. Operation and technical security rely on Article 6(1)(f) GDPR and our legitimate interest in providing an available, secure website. Application logs do not contain messages, phone numbers or images. Providers may retain technical logs and backups under their terms. Do not put personal details in page addresses.
3. Contact and enquiries
If you contact us by email or telephone, we use the contact details and content you provide to handle your enquiry. The basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries; for other enquiries, Article 6(1)(f), reflecting our interest in responding. We delete data when no longer needed unless legal retention duties or claims require longer storage. The studio’s email service is provided by IONOS SE. When you email us, this service also processes sender and recipient addresses and technical delivery data.
4. Bookings through Kisscal
Piercing, tooth gem and tattoo consultation bookings use the external Kisscal portal provided by Kiss Solutions GbR. It loads in an embedded window only after you press a booking button, transmitting technical connection data to the provider. The studio and relevant service providers receive the contact, appointment and project data you enter to book. Necessary booking data is processed to arrange and provide your appointment under Article 6(1)(b) GDPR. Any health data requested needs a separate basis under Article 9; clicking a booking button does not replace explicit consent. Also consult the portal’s information about required fields, cookies, recipients and retention. Non-essential device access requires separate consent where required by law.
5. Price calculator and image download
Design size, colours, shading and project type, the calculation and PNG generation are processed in your browser. Calculating or downloading alone does not send these details to the studio or an AI provider. A downloaded file stays on your device until you delete it. If you later attach it to a booking or send it to us, the booking or contact sections apply. Avoid unnecessary personal information in reference images.
6. Maria, virtual assistant and human support
Maria is a virtual assistant and starts after you accept the chat notice. Messages, language and conversation context are processed to answer your enquiry. Phone numbers and other contact details you type also become conversation content. Text and contact data are encrypted in storage. Web chats are not linked to your Instagram account. Conversations and related requests expire 30 days after creation; access is blocked on expiry and scheduled cleanup removes active data every five minutes. “Delete chat and data” deletes active conversation data and revokes the session. Provider technical backups follow their own cycles and are not deleted by this button. Image attachments are currently disabled. For a personal reply, email info@linetattooheilbronn.de: storing a chat enquiry does not notify the team or confirm a callback or appointment. Maria does not diagnose or make legally significant automated decisions. Do not send identity documents, health data or photos of complications.
7. OpenAI API processing
When studio rules do not resolve an enquiry, the server uses the OpenAI API to classify it. Your message and up to eight relevant recent conversation entries may be sent. Recognised phone numbers are removed from the AI context; detection of all personal details in free text is not guaranteed. Prices and booking links follow studio rules. Requests use store:false to avoid storing response state; this does not exclude OpenAI security logs. By default, these may be retained for up to 30 days, or longer where required by law or service security. API data is not used for model training by default. Chat and AI rely on your consent under Article 6(1)(a) GDPR. You can withdraw it for future processing by deleting the chat. Booking and email remain available without Maria. EU data residency and Zero Data Retention are not guaranteed for this integration. The API key remains on the server.
8. Browser storage, cookies and external content
Starting Maria sets the technical __Host-maria session cookie for up to 30 days, with HttpOnly, Secure and SameSite=Strict, to restore your conversation in this browser. It is not set before chat consent. The private panel, if enabled, uses __Host-maria-admin for eight hours. We do not embed our own advertising analytics, maps or external fonts. Gallery images are served from this website’s hosting; Instagram opens only when you click a link. Kisscal may use its own cookies and storage when booking opens. The local editor demo saves changes under line-preview-v1 only when you choose to save in this browser; it does not publish them. The downloaded copy also supports a local demonstration chat without sending messages to the server.
9. Recipients and transfers
Depending on the features used, recipients include the studio, Cloudflare for hosting and storage, OpenAI for AI classification and Kisscal for bookings. Processing outside the EEA, including the United States, is possible. Safeguards provided in the Cloudflare and OpenAI processing addenda include Standard Contractual Clauses. You may ask the controller by email for information and a copy of the safeguards applicable to your data. D1 EU jurisdiction does not imply that the OpenAI API or all hosting logs remain in the EU. Provider notices linked below explain recipients, transfers and retention.
10. Your rights
Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation under Article 21 GDPR. You may withdraw consent for future processing without affecting prior lawful processing. You may complain to a data protection authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.
11. Updates
We update this notice when features, providers or processing change. Send questions and requests to exercise your rights to info@linetattooheilbronn.de. Maria is optional; you can book directly or contact the studio instead.