Envis

Privacy policy

Last updated: 24 October 2026

Envis is a web application tattoo studios use to show a design to their customers on their own body via a link. This policy describes what data arises, what it is used for, how long it stays and what rights you have. It covers the website envis.at, the studio panel and the customer pages under envis.at/v/.

1. Controller

The controller for processing on this website and for studio accounts is Fabio Michael Gell, Ottakringer Straße 180/12, 1160 Vienna, Austria, email hallo@envis.at. No data protection officer has been appointed, as the legal requirements for one are not met.

2. Two roles: studio and Envis

For the data of a studio's customers (designs, snapshots, placements, replies) the studio is the controller within the meaning of Art. 4(7) GDPR. The studio decides which design it uploads, who gets the link and when a project is archived. Envis processes this data as a processor under Art. 28 GDPR, solely on the studio's instructions and on the basis of the data processing agreement each studio concludes when creating its account.

For the studio accounts themselves (email address, sign-in, session) and for running the website, Envis is the controller.

3. Which data, for what, on what basis

Studio account

To sign in, studios provide their email address. Envis sends a sign-in link that is valid for 15 minutes and can be used once. Stored are the email address, the time of the last sign-in, the chosen language, the studio name, the city, an optional logo and the time the data processing agreement was confirmed. To prevent abuse, the IP address and time of each sign-in request are kept for one day. The basis is the contract with the studio (Art. 6(1)(b) GDPR), and for abuse prevention the legitimate interest in secure operation (Art. 6(1)(f) GDPR).

When a client sends a message, a reaction, a snapshot or an approval in a project, Envis sends the studio an email with the number five minutes later. The email names no project and contains no content. For this, Envis stores whether these emails are on and when each member last opened a project. The studio turns the emails off in the settings. The legal basis is the contract with the studio (Art. 6(1)(b) GDPR).

Projects and customer pages

A studio creates one project per customer: a label (such as a first name), the body part, the size, a note and the design in all its versions. On the customer page, placements, snapshots (photos from the customer's phone that the customer sends themselves) and replies as text or reaction are created. There is also a counter for how often a link was opened. The camera stream on the customer page is processed only on the device; only the snapshot the customer explicitly sends reaches Envis. The studio is the controller for this data; the legal basis follows from the relationship between studio and customer, usually the initiation of a contract (Art. 6(1)(b) GDPR).

Setup, contract and payment

When a studio sets up Envis, Envis stores the opening hours, the details for the contract (company, address, VAT ID) and the acceptance of the contract with name, chosen signature, time, IP address and version of the contract. For billing, Envis stores the customer number at Stripe, the state of the subscription and open amounts. When the studio invites artists, they get an email with a link that is valid for seven days. The legal basis is the contract with the studio (Art. 6(1)(b) GDPR), and for keeping the contract and invoices the legal obligation under § 132 BAO (Art. 6(1)(c) GDPR).

Deposit

If a studio asks for a deposit on approval, the customer pays it to the studio through Stripe. For this the studio connects its own Stripe account to Envis and is the merchant for this payment; the money goes to its account. The customer enters name, email address and card details on the Stripe payment page, and Envis does not store them. For the deposit, Envis stores the amount, the status (open, paid, refunded), the times and the identifiers of the payment at Stripe; they are deleted with the project. For the connected account, Envis stores its identifier at Stripe, whether it accepts payments, and the deposit amount. The studio is the controller for the deposit data, as for the other data of the customer page.

Studios that Envis contacts

Envis introduces itself to tattoo studios in Vienna in person and brings them a folder. For this, Envis stores from public sources (website, Instagram, Google Maps) the name, address, phone number, website, Instagram profile and rating of the studio, plus notes on the visit and the state of the conversation. When someone books an appointment with the code in the folder, Envis stores name, phone number, note and the appointment. The legal basis is the legitimate interest in introducing Envis to studios (Art. 6(1)(f) GDPR). A studio can object at any time by email to hallo@envis.at, and Envis then deletes its details.

Server logs

When a page is requested, Cloudflare's infrastructure processes the IP address, time, requested address and browser type in order to answer the request and fend off attacks. Envis itself keeps error messages and requests for seven days without building user profiles from them. The basis is the legitimate interest in secure and functioning operation (Art. 6(1)(f) GDPR).

4. Recipients and storage location

Envis runs on the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Database and image storage are pinned to the Western Europe region; the data is stored there. Cloudflare is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply in addition.

Sign-in links and emails about new responses are sent through Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA), with processing in the EU region (Ireland). For this, Resend receives the studio's email address and the content of these emails.

The details of the studios Envis contacts, appointments and reports sent with “Problem or request” are stored at Supabase, Inc. (USA) in its Frankfurt data centre. Envis has a contract with Supabase under Art. 28 GDPR with standard contractual clauses.

Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) handles two kinds of payments. For payments of studios to Envis, Stripe receives company, address, VAT ID, email address and amount, plus the payment details (card or SEPA direct debit) that the studio enters directly at Stripe. For a deposit a customer pays to a studio, Envis passes Stripe the amount, the studio's name and an identifier of the deposit; the customer enters name, email address and card details directly at Stripe. Stripe receives no designs, snapshots or replies. Envis does not see card details. Stripe processes the payment details as a controller in its own right under its privacy policy at stripe.com/privacy.

There are no other recipients. Envis does not sell data and only hands it over where required by law.

5. Retention

  • Sign-in links: valid for 15 minutes, deleted after one day.
  • Sessions: 30 days after last use, immediately on sign-out.
  • Projects, designs, snapshots and replies: as long as the studio keeps the project. Archived projects remain visible to the studio; the customer link is dead from the moment of archiving. The studio can instruct Envis to delete a project at any time; deletion takes place within 30 days.
  • Studio account: until the studio requests deletion. Account, projects and images are then deleted within 30 days, unless a statutory retention duty applies.
  • Server logs: seven days.
  • Invitations for artists: valid for 7 days, then deleted. A withdrawn invitation is deleted after one day.
  • Contract, acceptance and invoices: seven years from the end of the year in which the contract ends (§ 132 BAO).
  • Details of studios that Envis contacts: until the studio objects, otherwise at most two years after the last contact.

6. Cookies

Envis sets three cookies, all technically necessary and therefore permitted without consent (§ 165(3) Austrian TKG 2021): envis_s keeps the studio signed in (30 days), envis_lang remembers the chosen language (one year), envis_c marks the device on customer pages so that snapshots and placements from the same phone belong together (one year, only under envis.at/v/). There are no advertising or tracking cookies and therefore no cookie banner.

When a customer erases areas in a photo or taps the start and end of the spot themselves, their browser stores these points for the link, together with a checksum of the photo. If they choose the same photo again, for example for a new version of the design, the points still apply. The photo itself is not stored, and none of this is sent to Envis. This storage is technically necessary for this function used by the customer (§ 165 (3) TKG 2021) and ends when they delete the site data in their browser.

7. No analytics services

Envis embeds no analytics, advertising or social media services. Fonts, scripts and images are served from envis.at itself. There is no profiling and no automated decision-making.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on a legitimate interest (Art. 21). Write to hallo@envis.at for this.

If you are a studio's customer and your request concerns your design, your snapshots or your replies, the studio is your point of contact. Envis forwards requests that reach it directly to the studio and supports the studio in answering them.

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

9. Changes

If anything about the processing changes, this policy is updated and the date at the top is refreshed. Studios hear about material changes by mail.