Privacy Policy

Last updated: 29 October 2026

This Privacy Policy explains how Convinced Creations Company Limited, trading as Tatship, handles personal information through our websites, apps, design and preview tools, business services, purchases, and support (the Services).

1. Who we are and how to contact us

We are a company registered in Hong Kong and act as the data user or controller for personal information we process for our own purposes. For privacy enquiries and requests, contact our Privacy Contact at [email protected] or Convinced Creations Company Limited, 9/F, AMTEL BUILDING, 148 DES VOEUX ROAD CENTRAL, Hong Kong.

Where we process information solely on a business customer's instructions, that customer is responsible for its own privacy notice and our processing is governed by the applicable business agreement.

2. Information we collect

Depending on how you use the Services, we collect:

  • Account information: contact details, display name, profile information, sign-in identifiers, language, and preferences.
  • Content: photos, artwork, prompts, messages, designs, previews, saved projects, and related information generated when providing the features you request. This includes information you submit about clients or other people.
  • Purchase information: orders, payment status, subscription and usage history, refunds, and billing or delivery details. Payment providers handle payment credentials; we receive the transaction information needed to administer purchases.
  • Usage information: IP address, device and browser information, account, device or advertising identifiers, approximate location, feature interactions, campaign information, and diagnostic records. Try-on troubleshooting records contain operational details such as request identifiers, timing, error status, and recovery outcomes. These records exclude raw body photos.
  • Communications and business information: support requests, feedback, artist or studio profiles, enquiries, and information you choose to share publicly.

Information comes from you, your use of the Services, sign-in and payment providers, advertising and measurement partners, and businesses you interact with. Artist and business listings may also use publicly available professional information.

Information needed to provide an account, purchase, or requested feature is required for that purpose. If you do not supply it, the feature may be unavailable. Optional information is identified where collected.

3. Photos and creative content

We process photos and other content to provide previews, create or edit designs, save work, and fulfil your requests. Some features send content to our servers and third-party image-processing or AI service providers. Saved body-photo libraries are kept on your device. Photos may still be transmitted to provide the requested processing; device storage does not mean that every feature operates offline.

The information sent to a provider depends on the feature and can include prompts, selected images, and instructions. Provider processing and retention are governed by the applicable service arrangements. Contact our Privacy Contact for information about recipients relevant to your use.

Only submit content you have authority to use. Photos and other content may reveal sensitive personal information; avoid including unrelated personal details. Any additional use or processing requiring consent is subject to the applicable notice and permission requirements.

Sharing, publishing, or exporting content makes it available to your chosen recipients or audience. Some shared or hosted files are accessible to anyone with their link. Keep private links confidential. Copies held by recipients or saved outside Tatship are subject to their control.

4. Purposes and legal grounds

We use personal information to:

  • provide accounts, requested features, content processing, storage, and sharing;
  • administer payments, subscriptions, orders, deliveries, and support;
  • maintain, secure, troubleshoot, and improve the Services;
  • measure usage and advertising, understand interests, and personalise experiences or advertising, subject to applicable choices and permissions;
  • send service communications and, where permitted, marketing about our products and services; and
  • prevent fraud and abuse, comply with law, and establish or defend legal claims.

Automated processing supports creative features, access and usage checks, and abuse prevention. Contact us to raise a concern about a result or restriction.

Our processing is subject to Hong Kong's Personal Data (Privacy) Ordinance. Where the EU or UK GDPR applies, we rely on contractual necessity for requested services, legal obligations, consent where required, and legitimate interests in security, service improvement, business administration, and rights protection, balanced against individuals' rights. Sensitive information requires an additional legal condition where applicable.

For direct marketing, we may use contact details, preferences, and relevant service interactions, subject to applicable consent requirements. Unsubscribe using the message's controls or contact us; device settings control push notifications. Necessary service messages may continue. Accepting our Terms does not provide consent for processing that requires separate permission.

5. Who receives information

We disclose relevant information to:

  • Service providers supporting hosting and storage, authentication, image and AI processing, communications, diagnostics, and customer support.
  • Payment and fulfilment providers handling transactions, subscriptions, printing, and deliveries, including content and address details needed to fulfil an order.
  • Analytics, advertising, and measurement partners receiving usage, device, campaign, account, and purchase information for the purposes described above. Some partners process information for their own advertising purposes.
  • Artists, studios, and other recipients when you use their services or share information with them, and the public when you publish content.
  • Professional advisers, authorities, and transaction counterparties where needed for legal obligations, rights protection, or a business transaction described in section 10.

Providers acting on our behalf are subject to the restrictions and safeguards applicable to their role. Independent providers and businesses also have their own privacy notices.

Where an app store offers optional sharing of purchase-use information for refund assessment, that sharing is subject to specific consent where required. That consent can be withdrawn by contacting us without deleting your account.

6. International processing

We operate from Hong Kong and use providers in other countries, including the United States. Your information may be processed outside your country, where privacy laws differ. Restricted transfers are subject to applicable safeguards, such as recognised adequacy decisions or approved contractual arrangements. Contact us for information about the safeguards applicable to your information and a copy where available, subject to necessary redactions.

7. Retention and deletion

We retain personal information for as long as reasonably necessary for the purpose concerned, taking account of account status, requested features, outstanding orders or support issues, security needs, legal obligations, and claims. Required accounting records may be retained for at least seven years under Hong Kong law; other information is subject to its own retention needs.

Local content remains on your device until removed. Account information, saved designs, operational records, and backups may have different retention periods. Deletion requests are subject to applicable rights and justified retention exceptions; removal from backups may follow the relevant retention cycle. Records retained after a request remain subject to applicable use and security restrictions.

8. Your choices and rights

Contact our Privacy Contact to request access, correction, deletion, or information about processing. Provide your account identifier and enough detail to locate the information. We may verify identity where appropriate and apply lawful fees, exceptions, or extensions. Responses follow applicable legal time limits.

For account deletion, use the app's account-deletion option where available or email [email protected] with the subject Tatship account deletion. The request covers the account and associated personal information, subject to lawful retention. Deleting an account does not cancel an app-store subscription or remove copies exported to your device or held by others.

Additional rights depend on the law applicable to you and Tatship:

  • Hong Kong: access, correction, and stopping use for direct marketing.
  • EEA and UK: access, correction, erasure, restriction, portability, objection, and withdrawal of consent, as applicable. You may object to direct marketing at any time. Withdrawal does not affect earlier lawful processing.
  • Other locations, including applicable US states: rights may include access, correction, deletion, portability, opting out of sale, sharing or targeted advertising, and appeal. Authorised agents may submit requests where permitted. To appeal a decision, reply to it or email us with the subject Privacy appeal.

Advertising disclosures may constitute sale or sharing under applicable law even without monetary payment. Submit an opt-out request or contact us. Applicable legally required opt-out signals must also be honoured. We do not discriminate for exercising protected rights. Our Cookie Policy describes browser and device controls.

You may complain to the Hong Kong Privacy Commissioner, your EEA supervisory authority, the UK Information Commissioner's Office, or another competent regulator.

9. Security and eligibility

We use measures designed to protect personal information, but no service can guarantee absolute security. Breaches are subject to applicable investigation and notification requirements.

The Services are intended for people aged 18 or older. Do not submit children's personal information. Contact us if you believe a child has provided information so that appropriate action can be taken.

10. Business transfers and updates

Personal information may be disclosed or transferred in connection with financing, a merger, reorganisation, or sale of the business or its assets, subject to applicable confidentiality, data-protection, and notice requirements.

We may update this Policy and will display its revision date. Material changes are subject to any additional notice or consent required by applicable law. See also our Terms and Conditions.