01. Identity and contact
This website presents the work of Oksana Lukianenko, known as Oxi Tattoo, and receives enquiries about her services at Nie Mów Mamie Tattoo in Gdańsk, Poland. Requests are available to this website’s authorised administration.
The following public channels are available for questions about your requests and data:
Oxi Tattoo · Oksana Lukianenko
Instagram: @oxi.tattoo
Studio contact: +48 507 458 605
Advertised appointment location: Słowackiego 89/m5 · Gdańsk, Poland.
These are the commercial identity and contact details displayed on the website. No dedicated privacy email address has been provided. The legal identity of this domain’s operator and the allocation of responsibilities between the operator, artist and studio still require confirmation by management.
This policy describes the operation of oxitattoo.pages.dev. It does not replace the policies of Instagram, the studio or other websites you choose to visit.
02. Quote requests
When you submit a request, you share your name, one contact method of your choice — Instagram, email or telephone —, your tattoo idea and the body placement. Size, a reference link and a reference image are optional. The submission date, acknowledgement of this policy, progress stage and notes made by the administration are also stored.
This information is used to receive your enquiry, discuss the project and follow up on your request. The purpose is to handle your request and take steps before entering into a possible contract, under Article 6(1)(b) of the European Union’s General Data Protection Regulation (GDPR).
The confirmation in the form records that you are requesting assistance and have acknowledged this policy. It does not authorise advertising, newsletters or optional analytics. This website does not automatically send messages to clients.
You can browse without submitting data. A valid contact method is needed to receive a reply about a request. Do not send documents, health information, intimate images or other people’s data without permission. Fields and references should contain only what is needed to explain your idea.
Submitting a request does not confirm a price, availability or booking. These details are agreed directly with the artist.
If you attach an image, you can select a JPEG, PNG or WEBP file of up to 12 MB. Before submission, your browser converts it to JPEG, reduces its dimensions to a maximum of 2,048 pixels and its file size to no more than 1 MiB, removing metadata embedded in the source file during conversion. Only the prepared version is submitted with your request; this form does not upload the original file. The image, its file name, type and size are kept in the same private request record in Cloudflare D1 and can be viewed only by an authorised administrator. It is not published in the portfolio or automatically sent to analytics or AI.
After the request is saved, the website prepares and attempts to copy a summary of the submitted details and a link to the request in the private dashboard, so authorised administration can view the reference. Copying depends on browser permissions. Once copying succeeds, the flow opens a conversation with Oxi on Instagram. If automatic copying fails, the request stays saved and the website displays a selectable summary and an option to open the conversation manually. You still need to paste the summary and send the message on Instagram. Request text is not included in the parameters of the Instagram link, and the image is not automatically attached to the message. Opening the conversation connects you to the platform under its own rules; the summary details are shared in the message only when you choose to paste and send them.
03. Optional analytics and approximate location
New browsing analytics are recorded only after you accept this purpose in your preferences. Rejecting analytics does not prevent you from viewing the portfolio, submitting a quote request or using the assistant. You can review your choice at any time.
When authorised, the website uses a random browser identifier, valid for 30 days, to reduce repeated counts. The database stores a protected representation of that identifier, the day, action types and the approximate country and city supplied by Cloudflare. Actions include opening the page, clicking Instagram, preparing a summary, opening the map and completing a request submission.
We also record the acceptance date and preference version to document your choice. Your name, Instagram, email, telephone, request text, attached image and AI conversation are not sent to analytics. We do not use device fingerprinting to recognise you or store raw IP addresses in the analytics database.
Country and city are network estimates, not GPS location. They may be inaccurate, especially with a VPN or mobile network. Unavailable information is shown as “Not identified”. We do not assign locations to old events.
“Estimated visitors” means identifiers of browsers that accepted analytics, counted once within the selected period. It is not a list of people: the same person on different devices, or after deleting the identifier or allowing it to expire, may be counted again. Visitors who reject or block measurement, or send a Do Not Track or Global Privacy Control signal, are excluded from this measurement.
Analytics relies on consent under Article 6(1)(a) of the GDPR. Withdrawing consent stops new events. When the current cookie still allows the identifier to be located, the server deletes the associated analytics and consent record and removes the cookie. Identifiers from other browsers, or those already expired or deleted, cannot be located by your name and remain subject to retention of up to 90 days. Withdrawal does not affect the lawfulness of earlier processing. See the periods below and the Cookie Policy.
Aggregate counts from before this measurement was introduced have no browser identifier or location. The dashboard displays them separately, without retrospectively estimating identities or cities.
04. Virtual assistant
The assistant is an automated AI tool provided by Cloudflare Workers AI. When you ask a question, its text and a limited portion of recent messages are sent to generate a contextual response. The conversation stays in the page’s memory while it is open; the application does not save the history in the requests database.
If you include a supported reference link, the server may retrieve public metadata from Instagram, Inkjin or iNKPPL. This does not mean the AI has seen the image or watched the video. Send only public links and avoid URLs containing personal data.
The processing is used to provide the automated assistance you requested and help prepare your idea. The AI does not decide on contracts, schedule sessions or confirm prices. The website does not use the conversation for advertising or to build a visitor profile.
Cloudflare states that it does not use content processed by Workers AI to train models. Processing and any operational, security or legal exceptions follow its data usage documentation. Do not send sensitive data; confirm decisions with the artist.
05. Security and restricted access
Traffic uses HTTPS. Requests are stored in a Cloudflare D1 database and accessed through an administration area protected by login. The server verifies administrator authorisation before providing requests or allowing changes or deletions. The public area does not display other clients’ data.
To reduce abuse, spam and excessive requests, the server temporarily processes the network address received by the infrastructure and produces a protected key that changes hourly. This protection does not store the raw IP address in the application database and is not used as an analytics identifier. It serves the legitimate interest of keeping the service available and protecting requests, under Article 6(1)(f) of the GDPR.
The infrastructure provider may process technical data, such as IP addresses and security logs, to deliver and protect the website. This differs from the analytics data held by the application. No system offers an absolute security guarantee.
06. How long data is stored
| Information | Application retention period |
|---|---|
| Requests, contact details, stage, notes and reference image | Up to 12 months after the last update to the enquiry. The administration may delete them sooner, including in response to a valid request. |
| Browsing analytics and consent records | Up to 90 days. The dashboard indicates when the new analytics became available. |
| Older aggregate counts | Up to 90 days from the event date, without adding identity or location. |
| Analytics cookie | 30 days from creation, without renewal on each event; removed when you withdraw consent. |
| Browser privacy preference | 180 days, or until you clear the website’s storage or change your choice. |
| Browser language preference | Until you change the language or clear website storage. Your explicit choice is saved in oxi_language to display the requested language, without tracking or changing your privacy preference. |
| Temporary request-limit keys | Expire logically within 2 hours. They are not used to track browsing. |
| Assistant conversation | In the page’s memory, without being saved to the database by the application. The provider handles the request under its own policy. |
Expired database records are automatically cleaned up on the next API operation that triggers the retention routine. Records may therefore wait for that operation after reaching the stated period. Provider backups and operational logs follow the service’s own cycles, and deletion in the application does not mean immediate removal of all such copies.
A subsequent contract, tax documentation or services outside this website may create other records, subject to the specific information and obligations of the party responsible for that service.
The reference image follows the request: it is removed from the active record when the request is deleted and follows the same period of up to 12 months after the last update, including the cleanup routine described above. Sharing the dashboard link does not make the attachment public; access still requires administrative authorisation.
07. Services and transfers
- Cloudflare: hosting, file delivery, server execution, D1 database, administrative access protection and Workers AI. The authorised administrator and providers needed to operate the service may process data for these purposes.
- OpenStreetMap: the embedded map loads only when you request it. Loading it connects your browser to the map provider.
- Instagram, Google Maps and reference links: external destinations you may choose to open. Those platforms’ policies apply there. Telephone or email links open the corresponding application on your device.
This version does not include Google Analytics, Meta Pixel or other advertising trackers. Presentation fonts and media files are delivered by this website.
Cloudflare operates an international network. Depending on the service, data and metadata may be processed outside the European Economic Area. Its Data Processing Addendum provides transfer mechanisms, including standard contractual clauses where applicable. This does not mean that all processing takes place only in Poland or the European Union. You may request information about providers and safeguards through the contact channels above.
See also Cloudflare’s Privacy Policy and the OpenStreetMap Foundation Privacy Policy.
08. Your rights and how to make a request
Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction of processing and portability of your data, and object to processing based on legitimate interests. You may withdraw analytics consent without losing access to the website’s main functions.
Contact Oxi on Instagram or the studio by telephone, state that your enquiry concerns privacy and specify the request or information you wish to access. To locate a quote request, use the same contact information you provided when submitting it. Proportionate identity verification may be necessary before disclosing or changing data.
Analytics are not associated with names or contact details in requests; providing an Instagram handle alone cannot identify a browsing record. We do not ask for additional personal data solely to try to identify anonymous visitors.
The GDPR requires a response without undue delay and normally within one month. In circumstances permitted by law, this period may be extended with an explanation of the reason. Some rights depend on the context and may have exceptions; any refusal must be explained.
You may also complain to the competent data protection authority, including UODO in Poland, following its channels and requirements, or the authority where you habitually reside, work or where the alleged infringement occurred, where applicable.
09. Legal notice
This website presents artistic work and helps prepare contact. Its information is not a binding quote, booking confirmation or medical advice. Price, availability and session terms are confirmed directly with the artist.
The tattoos, portrait and video shown are attributed to Oksana Lukianenko / Oxi Tattoo, according to portfolio credits and sources. Titles of selected works may be editorial descriptions. External links are references or contact methods; they do not imply that those platforms operate this website’s enquiry service.
This text describes the practices reported and implemented at this address. It is not a certification of compliance or an absolute guarantee of security.
10. Changes and references
This policy may be updated if purposes, services or operation change. The date at the top identifies the current version. Changes requiring a new analytics choice will be presented before the corresponding activation.
Official references: GDPR — Regulation (EU) 2016/679; European Commission — exercising rights; UODO — data protection rights. For browser storage, see the Cookie Policy.