Last updated: 06.10.2026 (version 1)
This notice explains, in line with Articles 12 to 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and Belgian data protection law, how personal data is handled when you use Linea. Linea is a web tool that turns the places of a journey into a single line that can become a tattoo design. It is published by mertcoart. This notice completes our general Data Protection & Privacy Policy and applies first to everything you do in Linea. The shorter notice inside the tool itself says the same in practical terms.
1. Who is responsible
Mert Coşkun, trading as mertcoart
Rue des Brasseurs 9, 1000 Brussels, Belgium
Enterprise number (BCE/KBO): BE 0798.618.618
E-mail: info@mertcoart.com
Mert Coşkun is the data controller. As a sole practitioner without large-scale monitoring or large-scale processing of special category data, no Data Protection Officer is required under Article 37 GDPR. All requests go to the e-mail address above.
2. The short version
- The line is drawn on your device. The places you type, your notes and the line itself stay in your browser unless you choose to send them.
- Anything that reaches outside the page (online place search, remembering your journey, web fonts) is off until you switch it on in the permission screen. You can change your choice at any time under Preferences.
- If you press “Send to mertcoart”, the journey and the details you typed are sent to the studio so a design can be prepared. You can take that back at any time with the withdrawal link you receive.
- There are no accounts, no advertising, no analytics and no tracking in Linea.
3. What is processed, why, and on what basis
Drawing a line on your device
Data: the places, nights, moments, notes and tags you enter, coordinates, uploaded itinerary files, and your interface choices.
Purpose: to draw the line and let you adjust, download and keep it.
Basis: this happens on your device and is not received by us. Where Linea stores something in your browser, it relies on your consent through the permission screen (Article 6(1)(a) GDPR and the Belgian rules on terminal equipment); storage strictly needed for the page to work does not need it.
Retention: until you delete it (clear, the cross on a kept line, Preferences or your browser settings).
Optional features you switch on
- Find places online. The text you type is sent to OpenStreetMap (Nominatim), run by the OpenStreetMap Foundation, together with your IP address.
- Google Places search, only if the studio has enabled it. The text you type and your IP address go to Google.
- Web fonts are loaded from Google Fonts. Google receives your IP address and browser information.
Basis: your consent (Article 6(1)(a)), given in the permission screen and withdrawable at any time under Preferences. When you use these services, the provider acts as an independent controller under its own privacy policy. We do not receive that data.
Sending a line to the studio
Data: your first name, the contact detail you choose to give (optional), an optional note, the journey (places, nights, moments, notes and tags, and for a second traveller their places), the line settings and size, your interface language, the date you accepted the terms and notice, and whether you came through an invitation.
Purpose: to receive your request, prepare a tattoo design and answer you.
Basis: steps taken at your request before a possible agreement (Article 6(1)(b)). Notes and tags can reveal feelings or personal experiences. Do not write anything you do not want the studio to see, and in particular no health information. If you do, you give it voluntarily and we process it only to understand and interpret your design (Article 9(2)(a), your explicit consent by sending it).
Retention: a line you sent is deleted automatically 12 months after it was sent, unless it leads to a confirmed tattoo project, in which case it becomes part of your client file and follows the retention periods in our Data Protection & Privacy Policy. The notification e-mail is part of the studio’s e-mail correspondence and follows the retention periods in that policy. You can withdraw the line yourself at any time (see section 7).
Security, abuse prevention and operation
Data: IP address and technical data of requests, request counts, standard server logs.
Purpose: to keep the service available, limit abuse and answer attempts to guess passwords.
Basis: our legitimate interest in the security of the service (Article 6(1)(f)).
Retention: request counters for 15 minutes to 1 hour; server logs for the hosting provider’s standard period. These logs never contain your journey.
Your login
Access to Linea is by a username and password that the studio makes for you.
Data: the username, a salted hash of the password (never the password itself) and the dates the login was made and ends. Nothing else about you is stored for the login.
Purpose: to let in only the people the studio invited, and to stop the access after one week.
Basis: our legitimate interest in keeping the tool to invited people (Article 6(1)(f)).
Retention: the login works for one week from the day it was made. It is then deleted for good 30 days after it ended, or earlier if the studio deletes it.
Signing in sets one strictly necessary cookie, “linea_session”, which remembers that you signed in until your login ends, at most one week. It holds no personal data. It is removed when you sign out, when it expires, or when the login is deleted or its password changes. This cookie does not need consent.
Invitation links and share links
An invitation link may contain your first name so that the page can greet you. A share link carries the journey inside the address itself (after the “#”), so it is not sent to our server when you open it. Whoever you give the link to can read what it contains, so share it with care.
4. Who receives your data
The studio, and the following processors acting on our instructions under data processing terms:
- Vercel Inc. hosts Linea and runs the functions that receive a line you send.
- A managed Redis database (Upstash, through Vercel) stores the lines you send, and the customer logins, until they are deleted. The studio uses a region in the European Union.
- Resend delivers the notification e-mail to the studio. It carries the contents of what you sent.
We do not sell data, do not use it for advertising and do not share it with anyone else, except where the law requires it.
5. Transfers outside the European Economic Area
Some providers are based in, or may process data in, the United States. Where this happens we rely on the EU-US Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses of the European Commission, together with the technical measures described below. OpenStreetMap and Google are only involved if you switch on the matching option.
6. No automated decisions
Linea draws a line from your input by an algorithm. This is not a decision with legal or similarly significant effects and involves no profiling. Words in your notes are matched to a style on your device only; no text is sent anywhere to be analysed.
7. Your rights and how to use them
You may at any time:
- ask what personal data we hold about you and get a copy (access);
- have it corrected, erased or restricted;
- object to processing based on legitimate interest;
- receive the data you provided in a structured, commonly used format (portability);
- withdraw a consent you gave, without affecting what happened before.
Withdrawing a line you sent. After sending, Linea shows a reference and a “Withdraw” link. One tap deletes the line from the studio inbox at once. If you also want the notification e-mail removed, or you no longer have the link, write to info@mertcoart.com with the reference, or your first name and the date, and we will handle it as an erasure request.
Requests are answered free of charge within one month. We may ask you to confirm who you are. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.autoriteprotectiondonnees.be, contact@apd-gba.be, or with the authority of your own country.
8. Security
Linea uses an encrypted connection (HTTPS), a strict content security policy, signed and expiring tokens for withdrawal and sign-in, a studio inbox that opens only with a secret token, rate limiting, and the principle of keeping as little as possible: no accounts, nothing uploaded unless you send it. Access to what you send is limited to the studio. In the event of a personal data breach that poses a risk to you, the Belgian Data Protection Authority and, where required, the people concerned are notified as the GDPR requires.
9. Age
You can use Linea to draw a line at any age. Sending a line to the studio, and any booking or tattoo, is for people aged 18 or over, in line with Belgian law. A line sent by or for a person under 18 is deleted and no service is provided.
10. Changes
If this notice changes in a way that matters, the version number is raised, the date above is updated and Linea asks for your permissions again. The latest version is always on this page. See also the Data Protection & Privacy Policy, the Legal Notice and the Terms & Conditions.