Bianca Kato← Back to the site
Legal document

Privacy Policy

This policy describes how we handle your personal data when you browse biancakato.com, get in touch with Bianca Kato Art or fill in the Health Questionnaire before your appointment, in accordance with the Brazilian General Data Protection Law (LGPD, Law no. 13.709/2018).

Last updated: 15 September 2026

1. Who controls the data

The controller of the personal data collected through this website is Bianca Kato, a self-employed tattoo and visual artist working in São José dos Campos/SP and São Paulo/SP, Brazil. You can reach out on Instagram @biancakatoart or on WhatsApp.

2. What data we collect

We only collect what is needed to answer you and prepare a responsible quote. The data you voluntarily give us through the contact form is:

  • The name or nickname you would like to be called by;
  • WhatsApp number (and the country that number belongs to);
  • Email address;
  • The channel you would rather be reached on, where WhatsApp is not the most common one in your country;
  • Preferred location for the appointment;
  • Type of service you are interested in (cover-up, mini tattoo, painting, mentorship, live painting);
  • Placement of your current tattoo (cover-ups only);
  • What you are hoping for with the project (cover-ups only);
  • When you would like the project to happen;
  • Whether you already know the investment range for the project;
  • Your story, feelings and style references written in the free text field;
  • Instagram (optional);
  • How you found us;
  • Any photos of your current tattoo sent over WhatsApp for a preliminary assessment.

We also collect, automatically and in aggregate form, technical browsing data such as approximate IP address, device type, browser and pages visited, exclusively for statistical purposes and website security.

2.1. Health Questionnaire and Consent Form

Before an in-person appointment, we ask you to fill in a Health Questionnaire (available through a direct link, kept out of search engines). This form collects the data needed for the safety of the tattoo procedure, including:

  • Full name, tax ID, date of birth, phone number, email and city;
  • Sensitive personal health data (art. 11 of the LGPD): relevant health conditions, allergies, pregnancy or breastfeeding, ongoing medication, healing history, conditions requiring specific care, recent alcohol intake, sun exposure or procedures in the area, and any laser history on the area to be tattooed;
  • Whether or not you allow your images to be used to showcase the work;
  • Your acceptance of the Consent Form, with the signature name, date/time and IP address of the submission, recorded as proof of consent.

This data is processed for the sole purpose of ensuring the safety and suitability of the procedure for your health condition. It is accessible only to Bianca Kato and is never used for marketing nor shared with third parties for that purpose. Filling in the health fields is your decision: you may choose not to provide them, aware that this may affect the safety assessment of your appointment.

3. What we use your data for

  • Replying to you and preparing a quote for a tattoo, mentorship, painting or live painting;
  • Scheduling and organising your session;
  • Sending reminders, schedule changes and aftercare instructions;
  • Keeping a minimal project history for touch-ups or continuity;
  • Complying with legal, tax and regulatory obligations where applicable;
  • Preventing fraud and protecting the controller’s rights.

4. Legal basis for processing (LGPD)

Your data is processed on the following legal bases set out in art. 7 of the LGPD:

  • Consent (art. 7, I): by filling in and submitting the form, you authorise the use of your data for the purposes described in this policy;
  • Performance of a contract and preliminary procedures (art. 7, V): to handle quotes and deliver the contracted service;
  • Compliance with a legal or regulatory obligation (art. 7, II);
  • Legitimate interest (art. 7, IX): website security, fraud prevention and a professional portfolio without personal identification.

For the sensitive personal health data collected in the Health Questionnaire, processing is based on the specific and highlighted consent of the data subject (art. 11, I of the LGPD), given through express acceptance of the Consent Form, and on the protection of health (art. 11, II, “f”), since this information is essential to assess the safety of the procedure. This data is not used for any other purpose.

5. Data sharing

We do not sell your data. We may share it only with:

  • Website hosting providers (e.g. Vercel) and messaging services (WhatsApp), exclusively to make communication possible;
  • Audience measurement and advertising providers (Google Analytics, Meta/Facebook), under the conditions described in section 10, and only with your consent;
  • Accounting or legal professionals, bound by confidentiality, when strictly necessary;
  • Public authorities, upon a lawful request.

6. Use of images and portfolio

Photos of the finished work may be used in the professional portfolio (Instagram, website, social media and promotional materials) without personally identifying the client. If you would rather your tattoo was not published, just let us know in writing before or right after the session and we will fully respect that. Any identified use (video testimonial, tagging on social media, etc.) requires specific, express consent.

7. How long we keep your data

We keep your contact data for as long as needed to serve you and for up to 5 years after the last interaction, for touch-ups, project continuity, defence of rights and compliance with legal deadlines (including the Brazilian Consumer Protection Code). The Health Questionnaire data, including the record of the Consent Form, is kept for the same period of up to 5 years, which also preserves the evidence of consent and the defence of rights related to the procedure. After these periods, data is deleted or anonymised. You may request early deletion at any time (see section 9).

8. Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, alteration or improper disclosure, including a secure connection (HTTPS), restricted access on personal devices and encrypted storage where possible. Sensitive Health Questionnaire data travels encrypted (HTTPS) and is accessible only to Bianca Kato. No system is 100% secure, so outside the Health Questionnaire we recommend not sending sensitive data or documents through the other contact channels (such as WhatsApp and the quote form), which are meant for the initial conversation only.

9. Your rights as a data subject

The LGPD grants you the following rights over your personal data:

  • Confirmation that processing exists;
  • Access to the data we hold about you;
  • Correction of incomplete, inaccurate or outdated data;
  • Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
  • Data portability;
  • Deletion of data processed on the basis of consent;
  • Information about who we share your data with;
  • Information about the option not to give consent and the consequences of that;
  • Withdrawal of consent at any time, upon express request.

To exercise any of these rights, get in touch on WhatsApp or Instagram. We will respond within 15 business days at the latest.

10. Cookies and similar technologies

We use cookies and measurement technologies in four categories. Only the first two work without your consent; the others stay blocked until you accept them in the banner shown on your first visit.

  • Essential (always on). Required for the website to work technically: language preference, security and the record of your own consent choice. Without them the site does not function.
  • Cookieless measurement (always on). We use Vercel Analytics and Vercel Speed Insights to count visits and measure page speed. These tools do not store cookies, do not create a permanent identifier and cannot identify you individually.
  • Statistics (require consent). Google Analytics 4, which stores its own cookies to understand how people browse the site, which pages draw the most interest and where visits come from.
  • Marketing (require consent). The Meta Pixel, from Facebook/Instagram, which stores the _fbp and _fbc cookies to measure the results of our ads and to allow ads to be shown to similar audiences.

You can accept or decline each category in the consent banner, and change your mind at any time through the same banner. Declining statistics or marketing does not limit your access to the website or the service you receive in any way.

11. Server-side ad measurement (Conversions API)

In addition to the Meta Pixel, which runs in your browser, we use Meta’s Conversions API: when you submit the contact form, our server reports that event directly to Meta. This exists so that ad results are measured correctly even when the browser blocks the Pixel.

That server-side call may include:

  • your IP address and your browser identifier (user-agent);
  • the _fbp and _fbc cookies, where they exist;
  • your phone number in encrypted, irreversible form (SHA-256 hash), never as readable text;
  • the service and city you selected in the form, plus an internal priority rating worked out from the timeline and investment range you indicated.

This only happens if you have accepted the marketing category. If you decline, the event is not sent, neither from the browser nor from the server. The legal basis is your consent (art. 7, I of the LGPD), which you may withdraw at any time.

12. International data transfers

Google (Google Analytics), Meta (Pixel and Conversions API) and Vercel (hosting) are companies based outside Brazil, and this data may be processed in the United States and in other countries. Such international transfers are made under art. 33 of the LGPD, supported by those providers’ contractual clauses and data protection commitments.

If you would rather not have data transferred to Google and Meta, simply decline the statistics and marketing categories in the consent banner.

13. Children and teenagers

Bianca Kato’s tattoo services are intended for people aged 18 and over. We do not knowingly collect data from anyone under 18 through this website. If we find that this has happened, we will delete the data immediately.

14. Changes to this policy

This policy may be updated to reflect legal, technical or process changes. The current version is always available on this page, with the date of the last update shown at the top. Significant changes will be announced through our official channels whenever possible.

15. Contact and Data Protection Officer

Given the size of the business, Bianca Kato acts directly as the person in charge of personal data processing. For any question, request or communication related to privacy:

You may also file a complaint directly with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.