Last Updated: October 22 , 2026
This Privacy Policy explains how OOK Group S.R.L (“we,” “us,” or “our”) processes information when you use our AI tattoo-design mobile application (“Application”) on Android or iOS.
Your saved designs, preferences, and other locally stored Application content are kept on your device. We do not operate our own server or database to store that content. However, AI features require transmitting information to external providers, and our analytics and subscription-management providers process information on their own systems.
Depending on the features you use, the Application processes:
Text descriptions, prompts, instructions, and other content you submit to generate or modify tattoo designs.
Images you choose to submit through features that support image input, including image editing.
Preferences, such as tattoo styles and gender selections, used to personalize results.
Generated designs and related content saved on your device.
Content you submit may contain personal information. Please avoid including sensitive personal information or information about other people unless you have an appropriate legal basis to provide it.
Our integrated services may process:
App-instance, installation, device, and user-profile identifiers.
Device model, operating system, Application version, language, and related technical information.
App launches, sessions, feature interactions, and other usage events.
Diagnostic information, including errors, crashes, and performance information.
IP addresses and approximate geographic information derived from network connections.
Collection of the iOS Advertising Identifier (IDFA) and Android Advertising ID is disabled in the current Application configuration. This does not disable other identifiers used for analytics or subscription management.
The information processed depends on the service, platform, SDK configuration, permissions, and applicable consent choices.
We use RevenueCat to help manage in-app purchases and subscriptions.
Depending on your platform and purchase activity, this processing may include:
An app user identifier used to associate purchases and subscription access with an Application user or installation.
Purchase receipts, purchase tokens, and transaction identifiers.
Purchased products, subscription status, and related purchase, renewal, expiration, or refund information.
Technical information necessary to validate purchases and provide subscription access.
Payments are handled by the Apple App Store or Google Play. We do not receive your full payment-card details through these in-app purchases.
If you contact us by email, we receive your email address, message, attachments, and any other information you choose to provide.
Identifiers and technical information may qualify as personal data even when we do not know your name.
We process information to:
Generate and modify tattoo designs using AI.
Personalize results according to your instructions and preferences.
Save and display content locally on your device.
Validate purchases, manage subscriptions, restore eligible purchases, and provide access to paid features.
Understand how the Application is used and improve its functionality.
Understand purchase and subscription performance.
Identify technical problems and improve reliability.
Respond to support requests and privacy inquiries.
Maintain security, prevent misuse, and comply with legal obligations.
Where consent is required by applicable law or platform rules, the relevant processing is subject to that consent. This Privacy Policy does not replace any separate permission or consent request that may be required.
The Application uses OpenAI APIs, the paid Gemini API provided by Google, and Replicate to access xAI’s Grok image model for the Edit Image feature.
When you use an AI feature, the content needed for your request is transmitted to the relevant provider. This may include your text instructions, selected preferences, images you submit, and related request information.
The provider used depends on the feature. Not every request is sent to every provider.
This processing takes place on external systems and is separate from saving designs locally on your device.
OpenAI states that API inputs and outputs are not used to train or improve its models by default unless the API customer explicitly opts in to data sharing.
OpenAI’s default abuse-monitoring logs may contain request content and associated metadata and are generally retained for up to 30 days. Longer retention may apply for legal or safety reasons. Certain API features and settings can involve separate storage.
Local storage by the Application does not mean that OpenAI provides zero data retention.
Further information: OpenAI API Data Controls.
Under the standard terms for paid Gemini API services, Google states that prompts and responses are not used to improve its products.
Google’s abuse-monitoring documentation specifies a 55-day retention period for prompts, contextual information, and outputs. Authorized personnel may review flagged content for policy enforcement.
Additional storage or different data-use arrangements may apply to optional features, logging, or separately enabled data sharing.
Further information: Gemini API Terms and Abuse Monitoring.
The Edit Image feature uses xAI’s Grok image model through Replicate. When you use this feature, the selected image, editing instructions, and related request information are transmitted to Replicate for processing using that model.
Replicate states that input parameters, output values, output files, and logs for predictions created through its API are automatically removed after one hour by default.
This describes Replicate’s default handling of API prediction data. It does not establish a universal deletion period for separate operational records or any processing by an underlying model provider. Applicable retention and data-use conditions depend on the model service and API configuration used.
Further information: Replicate Data Retention and Grok Image Model on Replicate.
If you do not want content transmitted for AI processing, do not submit it through the AI generation or editing features.
We do not maintain our own remote repository of your saved designs, preferences, or locally stored generation history.
Locally stored content remains on your device until it is removed through available Application controls, by clearing the Application’s storage, or by deleting the Application and its data.
Copies exported to your photo library, files, or other applications must be deleted separately.
Depending on your device settings, the operating system or a backup service may include Application data in device backups. Such copies are controlled through the relevant device or backup service.
Deleting local content does not automatically delete information previously transmitted to AI, analytics, or subscription-management providers.
We use Google Analytics for Firebase to understand usage and measure how Application features are used.
Depending on the platform and configuration, it may process app-instance identifiers, device information, sessions, interactions, purchase events, and approximate geographic information.
IDFA and Android Advertising ID collection is disabled in our current configuration. Other analytics identifiers may still be processed.
Further information: Google Analytics Data Collection.
We use AppMetrica by Yandex to analyze Application usage and identify technical problems.
AppMetrica may process installation and device identifiers, usage events, technical information, and diagnostics, depending on the SDK configuration.
The Application also sends a user-profile identifier to AppMetrica to associate analytics information with an Application profile. An identifier can qualify as personal data even when it does not contain your name or email address.
Further information: AppMetrica Security and Data Practices.
We use RevenueCat to validate purchases, manage subscription access, restore eligible purchases, and understand subscription performance.
RevenueCat processes the purchase, subscription, identifier, and technical information described in Section 1. We may access relevant subscription records and reports through its dashboard.
Further information: RevenueCat Privacy Policy.
The current Application does not display third-party advertisements. Collection of IDFA and Android Advertising ID is disabled.
Other identifiers used to distinguish installations, profiles, or subscription records may still be processed.
Where required by applicable law, non-essential analytics is subject to prior consent. You may withdraw consent through any available privacy controls or contact us for assistance.
Features that require device permissions are subject to the permissions applicable to your operating system. You can manage granted permissions through your device settings.
Selecting an image for a supported feature allows that image to be processed for the requested purpose, including transmission to an AI provider when needed.
A device permission does not replace any separate consent required for a different processing purpose.
Information may be disclosed to:
OpenAI and Google for the AI processing described in Section 3.
Replicate for image editing using xAI’s Grok model and, where involved in serving that model, xAI.
Google and Yandex for the analytics described in Section 5.
RevenueCat for purchase validation, subscription management, and subscription analytics.
Apple or Google in connection with purchases through their respective app stores.
Our email service provider when you contact support.
Authorities or other recipients where disclosure is legally required or necessary to establish or defend legal claims.
If our business is transferred or reorganized, information that we actually hold may be transferred subject to applicable law and appropriate notice. This does not give us access to content stored only on your device.
Different categories of information have different retention arrangements.
Local content: Remains on your device until removed as described in Section 4.
AI requests: Subject to the provider-side retention described in Section 3. Certain API features or categories of records may have separate retention arrangements.
Analytics: Retention depends on the provider, data category, and settings applied to our analytics projects. We retain identifiable analytics information only for as long as necessary to measure usage, assess performance, investigate problems, and meet applicable obligations. Aggregated statistics may remain after underlying records are deleted.
Purchase and subscription records: Retained as needed to validate purchases, maintain and restore subscription access, resolve purchase-related issues, prevent fraud, and meet applicable legal obligations, subject to the relevant provider agreements and retention arrangements.
Support messages: Retained for as long as reasonably needed to resolve your inquiry and handle related follow-up, unless further retention is required for legal obligations or claims.
You may contact us for information about the retention settings applicable to your data.
To request deletion of information processed through our services, contact ookgroup@gmail.com. We will assess your request and use the relevant provider procedures where applicable.
We may need limited information to locate the relevant records. We cannot directly remove content stored only on your device. Deletion requests may also be subject to lawful retention requirements.
Deleting the Application or requesting deletion of personal data does not itself cancel an app-store subscription. Manage or cancel subscriptions through the relevant app store.
We use reasonable technical and organizational measures appropriate to the information processed. These include encrypted network communications with service providers, restrictions on access to service accounts and support correspondence, and reliance on device protections for locally stored content.
No transmission or storage method can guarantee absolute security. Protecting access to your device and managing its backups also helps protect locally stored information.
Our providers may process information outside your country, including in the United States and other countries where they or their service providers operate.
AppMetrica’s published documentation identifies storage in the European Union and the Russian Federation.
International processing is subject to applicable data-protection requirements and the relevant provider agreements. Where required, appropriate transfer safeguards must apply.
You may contact us for information about the destinations and transfer safeguards applicable to your information.
Depending on your location and applicable law, you may have rights to:
Receive information about how your personal data is processed.
Request access, correction, or deletion.
Request restriction of processing or object to certain processing.
Receive eligible information in a portable format.
Withdraw consent where processing relies on consent.
Complain to the competent data-protection authority.
For users covered by the GDPR, our legal bases, as applicable, are:
Performance of a contract: To provide the AI features you request and manage purchases and subscription access.
Consent: For processing that requires your consent, including non-essential analytics where applicable.
Legitimate interests: For security, preventing misuse, handling support inquiries, and establishing or defending legal claims, where those interests are not overridden by your rights.
Legal obligations: Where processing or retention is required by applicable law.
Where the LGPD or another privacy law applies, we will handle requests under that law.
These rights may apply to identifiers and technical records even if we do not collect your name. If we cannot identify the records associated with you, we will explain what information is reasonably needed to handle your request.
Contact ookgroup@gmail.com to exercise your rights. Withdrawing consent does not affect the lawfulness of processing completed before withdrawal.
The Application is intended for adults aged 18 and over and is not directed to people under 18.
This age restriction also reflects the applicable Gemini API terms.
If you believe that someone under 18 has provided personal information through the Application, contact us. We will investigate and take appropriate steps concerning information within our control.
We may update this Privacy Policy when our features, providers, data practices, or legal requirements change.
The “Last Updated” date identifies the latest revision. We will provide additional notice of material changes and obtain fresh consent where required.
OOK Group S.R.L
str. Pușkin 32
Chisinau, Moldova
Email: ookgroup@gmail.com