Legal

DUBHCORE — Privacy Policy

Version 1.0 — Date: 30 August 2026 — Final version

1. Controller and contacts

  • Brand/service: DUBHCORE
  • Legal name: Gelsi Andrea (sole proprietorship)
  • VAT (P.IVA): 02826520211 — Tax code (Codice Fiscale): GLSNDR81B26H786D
  • Registered office: Via Auen 3, 39031 Brunico (BZ), Italy
  • Email: info@dubhcore.com — Website: https://dubhcore.com
  • Data Protection Officer (DPO): as at the date of this notice, no Data Protection Officer (DPO) has been appointed, as the conditions for mandatory appointment under Art. 37 GDPR do not currently apply based on the processing carried out. This assessment will be reviewed should the activities or processing evolve.

2. Roles in the processing (DUBHCORE / Studio)

DUBHCORE is a management software (SaaS) for tattoo and piercing studios. Depending on the processing:

  • DUBHCORE is Controller for the processing for which it determines purposes and means: creation/management of platform accounts, DUBHCORE subscriptions, administration, security, support, technical management of the service, fulfilment of its own obligations.
  • The Studio/Professional is Controller of the data of its own clients processed through the platform (requests, appointments, documents, consents, images, health data for piercing, etc.). The Studio must ensure the lawfulness of the processing and identify the applicable legal basis/condition.
  • DUBHCORE is Processor (Art. 28 GDPR) when it processes the data of the Studio's clients on behalf of and according to the instructions of the Studio (see the dedicated DPA).
Note. For the own processing necessary to manage account/platform, technical security, abuse prevention, rate limiting, management of the service and billing/administration of its own platform, DUBHCORE acts as an autonomous Controller, within the limits described in this Privacy Policy. For client/service data processed on behalf of the Studio, the following remains firm: Studio = Controller, DUBHCORE = Processor under Art. 28. DUBHCORE does not pursue autonomous purposes on the health data of the treatments.

3. Categories of data processed (VERIFIED in the code)

  • Account/profile: email, first name, last name, date of birth, address, phone, document language, role, password (stored only as a bcrypt hash).
  • Studio/professional data: studio name, city, logo, VAT, tax code, IBAN/BIC, payments email, PayPal, deposit/cancellation policies.
  • Studio clients' data: personal/contact data, tattoo/piercing requests, description, style, body position (body map), budget, notes.
  • Health-related data (special category — VERIFIED as present in the Tattoo and Piercing flows): for Tattoo, the possible "Scars" field; for Piercing, metal allergies, irritation/infection problems of the area, scarring problems, medications/medical conditions, pregnancy/breastfeeding. The implemented condition under Art. 9 GDPR is the explicit consent of the data subject — Art. 9(2)(a) GDPR (see §4-bis). DUBHCORE is not a healthcare service and does not determine medical purposes; the basis is not Art. 9(2)(h). For PMU (permanent make-up), the system does not currently collect structured health data.

*Infrastructure note (verified):* Emergent has confirmed in writing that the processing/storage of this health information is permitted for the application, in compliance with the applicable GDPR requirements and the DPA, requiring adequate access controls and security measures. Such confirmation from the provider does not in itself constitute the lawfulness condition under Art. 9 GDPR, which remains to be identified by the Controller (Studio), together with the basis under Art. 6, the Controller's responsibilities, the access restrictions, the security measures and the retention rules.

  • Data of minors and parents/guardians: where the client is a minor, the system provides for entering the parent/guardian data (first name, last name, date of birth, tax code, document type/number/expiry, relationship with the minor) and a double signature in the studio (minor + guardian). DUBHCORE does not autonomously set minimum ages or health/legal requirements for tattoos/piercings: such rules are the Studio's responsibility.
  • Images and attachments: photos of requests and chat attachments, on private Object Storage; profile/portfolio photos of the professionals.
  • Appointments/calendar, messages/chat, quotes/deposits, documents/consents/releases/signatures (with immutable snapshots), notifications, no-shows/reschedules.
  • Payments and subscriptions: billing data, deposits (bank transfer with receipts, Stripe Connect), subscriptions managed via Stripe.
  • Google Calendar: OAuth tokens (stored encrypted with Fernet — VERIFIED) and imported events (read-only), subject to the user's authorisation.
  • Technical data/IP: the IP address may be processed transiently by the application (headers X-Forwarded-For/X-Real-IP) for rate limiting/security of the public endpoints. There is no application-level persistence of the IP in the DUBHCORE database. Distinct from this are any infrastructure logs of the provider (see §8), the specific duration of which has not been communicated or confirmed by the provider (managed by Emergent within its own infrastructure; no unverified numerical period is stated).
  • Audit logs: action, author, object, timestamp, studio scope.

4. Purposes and legal bases (indicated only when verifiable)

  • Provision of the SaaS service, management of accounts and studios → performance of the contract (Art. 6(1)(b)).
  • Subscriptions/billing → contract and legal obligations (Art. 6(1)(b)/(c)).
  • Security, abuse prevention, rate limiting, logs → legitimate interest (Art. 6(1)(f)) / obligations (to be assessed).
  • Customer support → contract/legitimate interest.
  • Studio clients' data (incl. health for piercing) → basis identified by the Studio as Controller; for health data, the condition under Art. 9 identified by the Studio (not determined by DUBHCORE).
  • Google Calendar integration → the user's consent to the OAuth authorisation.

4-bis. Processing of health data (Art. 9) — implemented system

Tattoo and Piercing services may involve the collection of health-related data. The lawfulness condition implemented in the platform is the explicit consent of the data subject pursuant to Art. 9(2)(a) GDPR, identified and managed by the Studio as Controller. DUBHCORE provides the technical tool as Processor and does not provide healthcare services nor adopt Art. 9(2)(h).

(a) Distinct and prior consent. Consent to health data is separate from: acceptance of the Terms, acknowledgement of the Privacy notice, consent/authorisation to the treatment, signatures and image release. It is required before the collection of structured health data and by means of an explicit affirmative action.

(b) Tattoo (adults). A consent step precedes the potentially health-related part. In case of refusal, the request may still proceed: the "Scars" field is not collected, the operational/free-text fields (description, notes) remain usable, and a minimisation notice is shown. The description/notes fields are not automatically classified as health data.

(c) Piercing (adults). Consent precedes the health questionnaire: with consent the questionnaire is available; without consent the questionnaire is skipped and no structured health data is collected, while the non-health part of the request may proceed. The structured health responses are separate from the operational summary and are not incorporated into it.

(d) PMU. No structured health questionnaire, no health consent step and no health consent created in the normal PMU flow: there are only minimisation notices in the free fields.

(e) Minors. If the client is a minor, in the remote flow (app) the minor does not provide the Art. 9 consent autonomously and no structured health data is collected; any consent to the processing of health data is provided in the studio by the parent/guardian on behalf of the minor, remains distinct from the treatment authorisation and the signatures, and is linked to the specific treatment. No additional biometric verification or KYC is introduced.

(f) Withdrawal. Consent to health data may be withdrawn at any time, with effect for the future; withdrawal does not affect the lawfulness of the processing carried out before it. Withdrawal does not equate to automatic deletion: data and documents may be retained where there is another legal basis or an applicable obligation. Any new subsequent consent constitutes new evidence and does not retroactively "reactivate" the withdrawn record. The adult client can manage their consents in the app; consents provided by the parent/guardian are withdrawable in the studio by authorised staff.

(g) Access to health data (minimisation/least privilege, server-side). Access to the health data of the treatment is limited, at API level (not only graphical), to: studio owner (admin), manager, professional assigned to the treatment (tattooist for the tattoo, piercer for the piercing) and client concerned in their own flows. Health data is not returned to: reception, unassigned professionals, staff of other studios, other clients or unauthorised users. The same protection applies to minors' health data.

(h) Evidence of consent. The system records as metadata of the consent: subject, studio, treatment (where applicable), type of service, consent version, "granted" status, affirmative action, granted_by (self/guardian), reference to the guardian where applicable, date/time and any withdrawal date. The personal data of the parent/guardian is not duplicated in the consent record.

5. Methods of collection

Data entered by: clients (registration, requests, chat, remote signature), studio staff (client records, appointments, in-studio signatures, guardian data), administrators (studio, payments, documents). Apple Calendar: access takes place on the user's device (expo-calendar module); DUBHCORE does not upload the entire Apple calendar to its servers.

6. Recipients and providers (sub-processors)

Access to data is limited to authorised personnel and, for the Studio's clients, to the Studio itself (multi-tenant isolation). External providers actually used (see the "Sub-processors" document):

  • Stripe (payments/subscriptions and Stripe Connect for deposits);
  • Google (OAuth authentication and Google Calendar, read-only);
  • Emergent (hosting infrastructure, managed Object Storage, sending of transactional emails via managed Resend).

There are no systems for analytics, tracking or advertising in the application code (absence VERIFIED).

6-bis. Public website DUBHCORE Hub (dubhcore.com) — VERIFIED by technical audit

The public website DUBHCORE Hub (dubhcore.com) is distinct from the application. Based on the technical audit of its code:

  • Contact form (`/contact`): collects name, studio, email, country, message. The data is sent to the Hub backend and stored in the MongoDB collection of the Hub project `contact_requests`. No external email provider or newsletter service receives the contact form data.
  • Public studio pages (`/s/:slug`): the Hub interacts with the public API of the DUBHCORE App to display the studio pages.
  • Payments: the Hub does not collect payment data; users are redirected to the external Stripe Payment Links (buy.stripe.com) and the checkout takes place on Stripe's domain, outside the Hub.
  • `/support` and `/demo`: do not collect form data/personal data; no newsletter, no registration takes place on the Hub.
  • `/delete-account`: public informational page; account deletion is performed within the DUBHCORE App (with /support available in case of loss of access).
  • No tracking: the Hub does not set/read first-party cookies, does not use localStorage/sessionStorage/IndexedDB, does not use analytics (incl. Google Analytics/GTM), pixels (Meta/TikTok), advertising, fingerprinting, heatmaps or session recording (VERIFIED).
  • External assets: the fonts and the "Origin" image are hosted locally; the previous external requests to Google Fonts and Unsplash have been removed (no longer active external recipients/providers).
  • Infrastructure: the Hub uses its own backend/API and the Emergent infrastructure/platform for hosting.

7. International transfers

Verified information (confirmation from Emergent Support): for the deployed DUBHCORE application, the infrastructure of the production database, storage and backups is located in the UNITED STATES. The processing therefore involves a transfer to a third country (USA). Such transfers take place within the framework of the DPA of Emergent Labs Inc., which incorporates the Standard Contractual Clauses (EU Decision 2021/914) where applicable. Further providers (e.g. Stripe, Google) may involve processing outside the EU with analogous contractual guarantees.

Infrastructure log data: the Emergent DPA defines the infrastructure "Log Data" as potentially comprising IP address, approximate location, browser information, device/session identifiers and operational telemetry. The specific retention period of such logs has not been communicated or confirmed by the provider (Emergent); these logs are managed by the provider within its own infrastructure and applicable terms/documentation. DUBHCORE does not state an unverified numerical period.

8. Retention

There is no single period applied to all data: retention depends on category, purpose and privacy role, according to the internal document "Data Retention Schedule V1" (source of the periods). At the application level, no general automatic deletion (TTL) is configured, except for the password reset tokens (validity 30 minutes + TTL cleanup — VERIFIED); the other periods are a documentary policy (not yet automated) and the signed documents are immutable (snapshot). Main periods (policy V1):

  • Operational accounts (Studio/staff/clients) after termination/deletion: 30 days, subject to the documented exceptions;
  • Non-converted requests: 12 months;
  • Structured health data (Tattoo/Piercing): 12 months after completion/cancellation (not automatically 10 years);
  • Chat/attachments: 24 months; operational data of treatments/appointments as relevant: 36 months;
  • Images: follow the purpose/relevant record (project→request, operational→treatment, marketing→autonomous basis);
  • Fiscal/accounting data as relevant: 10 years when required by the applicable regulation (legal obligation);
  • Signed documents/treatment consent: 10 years as a evidentiary/defensive policy linked to the ordinary limitation period (Art. 2946 Italian Civil Code) — not a GDPR obligation;
  • Evidence of Art. 9 consent and withdrawal: retainable separately for up to 10 years as an accountability/evidence policy (Art. 7(1)); such evidence is distinct from the underlying health data and does not extend its retention;
  • Litigation: in the presence of a dispute/defence need, the only necessary data may be retained beyond the ordinary period, with minimisation.

For the client/service data, the Studio is Controller and DUBHCORE is Processor under Art. 28: the periods may follow the documented instructions of the Studio when justified by applicable obligations or its retention policy; this DUBHCORE policy does not constitute a universal obligation imposed on the Studio.

Infrastructure backups (managed by the provider Emergent — verified confirmation): the production database is subject to automatic backups managed by Emergent according to a rotating schedule: hourly (7 days), daily (7 days), weekly (4 weeks), monthly (12 months), yearly (1 year), with continuous point-in-time recovery over the last 7 days. The production backups are stored in the United States. Deletion from the operating system may not result in the immediate removal of copies already present in the backups, which are deleted/overwritten according to the provider's rotation cycles. The duration of the infrastructure logs has not been communicated or confirmed by the provider (managed by Emergent within its own infrastructure; no unverified numerical period is stated). These schedules are controlled by the infrastructure provider, not by DUBHCORE, and do not extend the active retention periods provided at the application level.

9. Deletion, export and rights

  • Account deletion: available with re-authentication via password.
  • Client deletion (by the Studio/Admin): with data summary and explicit confirmation; the client's personal account is removed only if not linked to other studios.
  • Data export (portability, Art. 20): the user may request the export of their data in JSON format, protected by re-authentication via password.
  • Data subject rights (Art. 15–22): access, rectification, erasure, restriction, portability, objection and, where applicable, withdrawal of consent (incl. the consent to health data, manageable by the client in the app; for minors, the withdrawal of the consent given by the guardian takes place in the studio — see §4-bis). For the Studio clients' data, the rights are exercised towards the Studio as Controller; DUBHCORE assists as Processor.
  • Contact for rights: info@dubhcore.com.

10. Security (measures VERIFIED in the code)

Passwords with bcrypt; sessions with JWT; role-based access control (RBAC); multi-tenant isolation per studio; encryption (Fernet) of Google tokens and payment credentials; private Object Storage with access control; rate limiting on public endpoints; audit logging; immutable snapshots of signed documents; normalisation of emails at login/registration.

11. Automated decisions / profiling

As at the current state, DUBHCORE: does not carry out profiling; does not take solely automated decisions with legal or similarly significant effects within the meaning of Art. 22 GDPR; does not use AI/LLM to analyse personal data, health data, requests, chats or client documents; does not use behavioural analytics in the App/Hub, according to the technical audits carried out.

12. Complaint to the authority

The data subject may lodge a complaint with the competent supervisory authority (in Italy: Garante per la protezione dei dati personali).

13. Changes

This notice may be updated; the version and date in force are indicated at the top. Substantial changes will be communicated to users by appropriate means.

14. Contacts

DUBHCORE — info@dubhcore.com — https://dubhcore.com — Gelsi Andrea (sole proprietorship), Via Auen 3, 39031 Brunico (BZ), Italy.