Skip to content

Privacy

How your information is handled.

Last updated: June 1, 2026

In short

This site is run by Isaac Mackenzie, a tattoo artist working out of a private studio in Chinatown, Honolulu. Two things to know:

  1. The site loads the Meta Pixel — a JavaScript tag from Facebook / Meta — that tracks page visits and feeds into Meta advertising used to promote my tattoo work.
  2. If you fill out the booking form, the contents are emailed directly to me. Vercel hosts the site, Resend sends that email, and Supabase stores a one-way hash of your email address so the form can tell a repeat submission from a new one.

Nothing here is sold to other parties. You can opt out of Meta tracking and request deletion of any data I hold about you. Instructions are below.

Who I am and how to contact me

Site operator: Isaac Mackenzie, doing business as Tattoos by Isaac.

I am a tattoo artist working out of my own private studio at 928 Nuuanu Ave, Suite 301, Chinatown, Honolulu, HI 96817. tattoosbyisaac.com is my personal portfolio and booking site, and I am the only person who operates it.

Privacy contact:

I'm a sole proprietor running a small site, not a formal corporate data-controller structure. For privacy requests under any jurisdiction, email me directly and I'll handle it personally.

What this site collects

Booking form submissions

When you submit the booking brief at /book, I collect:

  • Name
  • Email address
  • Phone number (optional)
  • The project details, references, and reference photos you provide

This information is voluntary; you provide it so I can respond to your inquiry. It is emailed directly to me and is notstored in the site's database. The only thing the database keeps is a one-way SHA-256 hash of your email address and a timestamp, so the form can recognise a repeat submission. That hash cannot be turned back into your address.

Site usage and analytics

When you visit any page, automatic logs and analytics capture:

  • Pages you visited and the order
  • IP address
  • Browser type, device type, screen size
  • Referring URL (where you came from)
  • Approximate location (typically city-level, derived from IP)

This is captured by Vercel (the site's hosting provider) and the Meta Pixel.

Admin user accounts

I am the only person with access to the private /admin area. That account holds an email address and a hashed password. Public visitors do not create accounts.

How data is shared with third parties

The site uses a handful of services to operate. Each one receives only what's necessary for the function it provides.

Meta Platforms, Inc. (Facebook / Instagram) — via the Meta Pixel

Receives:pageview events, IP address, browser and device info, the page URL, and a Meta-assigned identifier if you're logged into Facebook in the same browser.

Why:the Pixel supports Meta advertising (Facebook + Instagram) used to promote my tattoo work and drive bookings. It is what lets Meta measure ad performance and build retargeting audiences. I do not have administrative visibility into Meta's internal account structure beyond the Pixel itself.

Meta's data policy: facebook.com/policy.php

Vercel — site hosting and analytics

Receives: standard HTTP request logs (IP, path, status), aggregated visit data. Why: to serve the site, monitor uptime, and detect attacks.

Supabase — database and authentication

Receives: a one-way hash of the email address used on the booking form, a one-way hash of the submitting IP address, my own admin login record, and blog post content. It does not receive the contents of your brief. Why:durable storage for the site's data and to limit duplicate or automated form submissions. Hosted in the US.

Resend — email delivery

Receives: contents of booking form submissions, so the email can reach my inbox. Why: reliable transactional email delivery.

Your information is not sold to other parties.

Cookies and tracking technologies

The Meta Pixel sets cookies in your browser to identify you across visits. Vercel may also set short-lived cookies for session tracking. The site does not set non-essential first-party cookies beyond what's required to keep an admin session signed in.

You can block third-party cookies in your browser settings, use private / incognito browsing, or install tracking-prevention extensions (uBlock Origin, Privacy Badger, etc.). The booking form and site content work fine with the Pixel blocked.

Your rights

Regardless of jurisdiction, I will honor these requests if you make them in writing to i.p.mcknz33@gmail.com:

  • Access — a copy of the personal data I hold about you.
  • Deletion— I'll delete records identifying you from the site's database. Pixel data already sent to Meta is governed by Meta's policies; see the opt-out section below.
  • Correction — fix inaccurate records.
  • Portability — your data in a portable, machine-readable format.
  • Opt-out of sale or sharing — under California's CCPA / CPRA, sharing data for cross-context behavioral advertising counts as "sharing." If you are a California resident, you have the right to opt out. Email me and I'll record your request for this site. For the Meta side, also follow Meta's opt-out steps below.

I will respond to verified requests within 30 days. If I cannot verify the request is from you, I may ask for additional information first.

Opt out of Meta tracking specifically

  • Adjust your Meta ad preferences: facebook.com/adpreferences
  • Browser-level tracking prevention: Firefox (Strict mode), Safari (Intelligent Tracking Prevention is on by default), Brave (Shields), or extensions such as uBlock Origin and Privacy Badger.
  • Digital Advertising Alliance opt-out tool: optout.aboutads.info

Opting out stops further collection going forward. It does not remove data Meta has already received from this site or any other site that runs the Meta Pixel.

Children's privacy

This site is not directed at children under 16. Getting tattooed is restricted to adults in Hawaii and most other jurisdictions (with narrow exceptions for minors with parental consent under specific conditions). I do not knowingly collect personal data from anyone under 16. If you believe a minor has submitted personal information through the site, email me and I'll delete it. This site is operated consistent with COPPA (the US Children's Online Privacy Protection Act) and equivalent provisions in other jurisdictions.

Data retention

  • Booking form submissions — these live in my email inbox, retained for approximately 2 years after our last contact so I can refer to your project history if you book follow-up sessions. Earlier deletion on request.
  • Submission hashes (email and IP) — one-way hashes kept so the booking form can spot repeat and automated submissions. No readable address is stored.
  • Meta Pixel data— governed by Meta's retention policies, not under my control. Meta typically retains pixel-derived data for around 90 days for ad-targeting purposes, longer in aggregated form.
  • Admin accounts — retained while the account is active. Deleted within 30 days of account termination.
  • Server access logs (Vercel) — typically retained for 30 days.

Changes to this policy

If anything material changes about what's collected or how it's shared, I'll update this page and bump the "Last updated" date below. Significant changes — new third-party data sharing, new categories of data collected — will be flagged with a notice at the top of this page for a reasonable period.

Last updated

June 1, 2026