Last updated: August 11, 2026
Two things first
You own the designs the Service generates for you, to the extent ownership is available in law. You may use them commercially: tattoo them, sell them, publish them.
A generated design may resemble existing artwork by coincidence. We do not warrant that any generated design is original, non-infringing, or protectable. You are responsible for reviewing every design before you use it, tattoo it, or sell it. It is going on skin permanently — look at it properly first.
This document was written by the operator, not by a lawyer, and is pending legal review.
Nico Winter, Ottawa, Ontario, Canada ([entity to be confirmed]). We are the organization responsible for personal information collected through Bad Vibes Studio.
Operate the Service, generate your designs, bill you, prevent abuse, and provide support. We do not sell personal information. We do not use your uploads or designs to train AI models, and we do not share your work with other users.
Only the service providers needed to run the product: Google (Gemini AI models) and fal.ai for image generation; Supabase for database and file storage; Render for hosting; Stripe for payments; Resend for email. These providers process data on our instructions. Some are located in the United States, so your information may be stored or processed outside Canada and may be accessible to foreign authorities under the laws of those countries.
If you upload a photograph of a client’s body, you are responsible for having that client’s consent. We recommend you obtain it in writing. We treat these images as sensitive: they are stored in a private, per-account area, served only to your logged-in session, and deleted automatically 90 days after upload unless you have saved a design derived from them. You can delete any upload immediately from your account.
Account and billing records: seven years (tax law). Uploads: 90 days. Generated designs: until you delete them or close your account, then 30 days. Backups may lag deletion by up to 30 days.
Passwords are hashed (PBKDF2, 240,000 iterations). Sessions use signed cookies. Files are stored in private buckets and served only after an ownership check. AI provider keys are held on a separate non-public server. No system is perfectly secure; we will notify affected users and the Privacy Commissioner of Canada of a breach that creates a real risk of significant harm, as PIPEDA requires.
You may access, correct, or delete your personal information, withdraw consent, or ask what we hold. Email hello@badvibes.ca; we respond within 30 days. If you are unsatisfied you may complain to the Office of the Privacy Commissioner of Canada. California residents: you have the right to know, delete, and opt out of sale — we do not sell personal information.
To delete your account outright, see Data Deletion.
The Service is not for anyone under 18.