Privacy Policy

Effective 20 September 2026. Words such as studio, access, restock and lot are defined in section 1 of the Terms of supply.

In brief

We hold the data needed to verify a studio, fulfil its restocks and trace every lot we ship. Nothing more.
We do not sell personal data. Advertising measurement (Meta, Google) runs only after you accept it in the cookie notice, and you can switch it off on the Your privacy choices page. Marketing email goes only to people who ticked the box, and one click stops it.
Shopify hosts the site and processes payments on our behalf. Carriers receive what a delivery needs.
You may see, correct, export or delete your data by writing to contact@blackkoisupply.com. Restock and lot records may have to be kept for traceability.

1. Who this policy covers

BlackKoi Supply ("we", "us") supplies professional tattoo materials to studios in the United States, Canada and Europe through blackkoisupply.com. This policy explains what personal data we collect, why, who receives it, how long we keep it and what rights you have. It covers:

visitors to the site, whether or not they hold access;
applicants, the people who ask us to verify a studio;
studios and their people: the owners, artists and staff who use a studio's access.

Business details such as a studio's name, address and tax numbers are not personal data, but the names and contact details of the people behind them are, and this policy treats them as such.

2. What we collect, and why

When	What	Why
You ask us to verify a studio	Your name, the studio's name and city, a studio email address, anything you add in the message	To verify that the studio exists and is licensed, and to decide on the request
You hold access	The studio profile: contact and delivery details, the people allowed to sign in, sign-in times, Engine settings	To run the account, deliver restocks and send the notices you ask for
You tick the email box	Your email address, the choice you made, and when and where you made it (a form on the site or the checkout)	To send Field Notes, new materials and restock reminders by email, and to prove the consent
You place a restock	What was ordered, the price, the delivery address, the lot numbers of every box, the dispatch note	To fulfil the restock, answer questions about it and trace every lot (recalls, regulation)
You pay	Payment is handled by the payment processor at checkout. We receive the confirmation, the last four digits and the billing name, never the full card number	To take payment and match it to the restock
You write to us	The email and its attachments: photos of boxes, lot numbers, defect reports	To answer you, and to log defects against lots
You browse	IP address, browser, device, pages viewed, the cart, the referring page, through the cookies in section 5	To keep the site working and secure, and to understand how it is used

We collect no data about your clients. Lot numbers in your client records stay in your records.

3. Legal grounds

Where a law asks us to name a basis, we process data to perform the contract with your studio (access, restocks, delivery), to meet legal obligations (traceability of sterile materials, tax and accounting), and for our legitimate interests in running, securing and improving the site and in preventing fraud. Restock notices from the Engine and recall notices are part of the service. Marketing email (Field Notes, new materials, restock reminders) rests on your consent: the box you tick on the site or at checkout, never pre-ticked. You may withdraw it at any time with the unsubscribe link in every message or by writing to us, and nothing else about your studio changes.

4. Who receives the data

Shopify Inc. hosts the site, the checkout and the customer records, and processes them on our behalf under its customer privacy policy. Shopify's servers may be located outside the United States.
Payment processors offered at checkout, which handle card data under their own terms and PCI DSS.
Carriers, which receive the name, the delivery address, a phone number where the service needs it, and the contents description required for shipping.
Manufacturers, only in a recall or a defect investigation, and only the lot numbers and the fact that a studio received them; not the studio's identity unless the studio agrees or the law requires it.
Authorities, where the law requires it, including recall and traceability requests, tax audits and lawful orders.
Professional advisers, such as accountants, lawyers and insurers, bound by confidentiality.
Advertising platforms: Meta Platforms, Inc. and Google LLC, only the measurement data described in section 5, only after you accept it there.

We do not sell personal data and do not give it to data brokers. Sharing for cross-context behavioural advertising happens only through the tools in section 5, only after consent, and the Your privacy choices page ends it.

5. Cookies and similar tools

The site uses:

Essential cookies set by Shopify to run the store: session, cart, sign-in, security and load balancing. They cannot be switched off without breaking the site.
Analytics: Shopify's own store analytics, which report page views, traffic sources and sales to us in aggregate.
Preferences: browser storage that remembers, for example, that the intro has already played this session.
Advertising measurement, only after you accept it in the cookie notice: the Meta Pixel and Conversions API (Meta Platforms, Inc.) and the Google tag (Google LLC). They record the pages you view, what you add to the cart and what you order, tied to a cookie or, for the Conversions API, to a hashed email address, so that we can see whether a post or a listing led to a restock and, later, show our materials to people who visited the site. Meta and Google use this data under their own policies and may combine it with what they already hold about you.

Advertising measurement is off until you accept it. In the European Economic Area, the United Kingdom, Switzerland, Canada and the US states that require it, nothing but the essential cookies runs before the notice is answered. You can change your answer at any time on the Your privacy choices page, which also carries the "Do not sell or share my personal information" choice for California and the other opt-out states, and you can block or clear cookies in your browser.

6. How long we keep it

Data	Kept for
Verification requests that are declined or never completed	12 months, then deleted
Studio profile and sign-in records	While the studio holds access, then 12 months
Restocks, dispatch notes and lot numbers	7 years from the restock, for traceability, tax and accounting
Defect reports and recall correspondence	7 years from the closure of the case
Other correspondence	3 years from the last message
Marketing consent and unsubscribe records	While you are subscribed, then 3 years as proof of the choice
Site logs	As set by Shopify, normally no longer than 12 months

7. Your rights

Whoever you are and wherever you are, you may ask us to:

see the personal data we hold about you, and how we use it;
correct it where it is wrong or out of date;
delete it;
give you a copy in a common machine-readable format;
stop using it for a purpose you object to; for marketing email the unsubscribe link in every message does this without writing to us.

Write to contact@blackkoisupply.com from the studio email address, or tell us how to verify that it is you. We answer within 30 days and never charge for a first request. We do not treat a studio differently for exercising a right.

One limit. Restock and lot records may have to be kept for the 7-year period in section 6 even after a deletion request, because they are what allows a recalled lot to be traced. In that case we delete everything else and tell you what remains and why.

California. Residents have these rights under the CCPA and CPRA, including the right to know, to delete, to correct, to opt out of sale or sharing (we do not sell; sharing for advertising measurement runs only after consent and ends on the Your privacy choices page) and not to be discriminated against. An authorised agent may act for you if we can verify the authority.

Canada. PIPEDA and the provincial privacy laws give you the rights above, including the right to complain to the Office of the Privacy Commissioner of Canada.

Europe and the United Kingdom. Where the GDPR, the UK GDPR or the Swiss or Norwegian data-protection acts apply to you, the rights above apply in the form those laws give them, and you may also complain to your supervisory authority. Your data is processed in the United States and on Shopify's infrastructure; the transfer rests on Shopify's standard contractual clauses and on the necessity of the transfer to perform your studio's contract. Our contact for data-protection matters is contact@blackkoisupply.com.

Other US states. Where a state privacy law applies to you, the rights above apply in the form that law gives them.

8. Security

The site, the checkout and the customer records run on Shopify's infrastructure, which is certified PCI DSS Level 1, and data travels over TLS. Sign-in is by a one-time code sent to the studio email, so there is no password on our side to be stolen; keep that mailbox secure. Our own access to studio records is limited to the people who need it to verify studios and fulfil restocks. If a breach ever affects your data, we tell you and the authorities as the law requires.

9. Children

This site is for professional businesses. We do not knowingly collect data from anyone under 18, and accounts are for studios represented by adults.

10. Changes

When this policy changes, the effective date at the top changes with it. A change that affects what we collect or who receives it is announced to studios with an account by email before it takes effect.

Contact

BlackKoi Supply
contact@blackkoisupply.com
Monday to Friday, 9:00–17:00 Eastern Time