Last updated: October 13, 2026
This policy explains what personal information karatandkin.com collects, why, who else handles it, how long we keep it, and the choices you have. "We", "us" and "Karat & Kin" mean Karat & Kin LLC, a New York limited liability company. It describes what the site actually does, and we update it when that changes.
The short version
- We don't sell your personal information, we don't run advertising pixels, and we send marketing email only to people who join our opening list.
- There are no customer accounts. You don't need to sign up to shop.
- To take an order we need your email, name, phone number and address. Payment is handled by Stripe, so your card number never reaches us.
- We use Google Analytics to understand how the shop is used. You can turn it off on our Your privacy choices page, and it switches off automatically if your browser sends Global Privacy Control.
What we collect
When you place an order
Checkout runs on Stripe's secure payment page. Stripe asks for your email address, name, phone number, shipping address and payment details, and may ask for a billing address. When your payment goes through, Stripe sends us your email, name, phone number, shipping and billing addresses, and the amounts paid. We never receive or store your full card number.
We keep that with your order: what you bought, the prices, tax and shipping charged, any discount code used, and the order's history (payment, shipping and tracking). We use your phone number only if there's a problem with your order or its delivery.
When you add something to your bag
Browsing on its own creates no record about you in our database. The first time you add a piece to your bag, we create a bag and remember it with a cookie. At that moment we also record:
- your IP address and browser type (the "user agent" your browser sends);
- how you found us: the website that linked you here, the page you arrived on, any campaign tags in the link (such as
utm_source), and whether you arrived from an ad click (we note only that an ad click ID was present, never the ID itself).
We use this to understand which channels bring shoppers to the store, to keep your bag working, and to spot abuse.
When you join our opening list
If you join the list for our opening offer, we keep your email address, the date you joined, where on the site you signed up, and your bag if you had one. We use it to send your opening code when the store opens and, now and then, news of new arrivals. Every one of those emails has an unsubscribe link, and you can also ask us to take you off the list at any time.
When you search
We record the words you search for and how many results came back, with no IP address or anything else that links the search to you. It shows us what shoppers look for that we don't carry yet.
When you visit any page
Like every website, our servers and our network provider see your IP address, the page requested and your browser type. We keep these server logs for 7 days to fix problems and defend the site against attacks.
When you email or call us
We keep your messages and our replies so we can help you and keep a record of what was agreed.
Cookies
We set a few cookies of our own. Google Analytics sets its own cookies unless you turn it off, and Cloudflare sets one for its security checks.
| Cookie | What it's for | How long it lasts |
|---|---|---|
kk_bag | Remembers your bag. Set only when you add something to it. | 30 days, renewed each time your bag changes |
kk_visit | Remembers how you first and most recently found us (the referring site, landing page and campaign tags described above). | 180 days |
kk_placed | Lets the order confirmation page count a purchase only once. | 30 minutes |
kk_privacy | Remembers your Google Analytics choice from our privacy choices page. | 400 days |
csrftoken | Security: stops another website from submitting our forms (such as "Add to bag") in your name. | 1 year |
_ga, _ga_* | Google Analytics (see below). Not set if you opt out or your browser sends Global Privacy Control. | Up to 2 years |
__cf_bm, cf_clearance | Cloudflare's bot protection: tells real visitors apart from automated attacks. | 30 minutes to 1 day |
You can block or delete cookies in your browser settings. Without kk_bag we can't keep your bag, but you can still browse.
Google Analytics
We use Google Analytics 4 to see how the shop is used: which pages are visited, roughly where visitors are, what device they use, and which pieces are viewed, added to a bag and bought. For a purchase we send Google the order number, the pieces bought, their prices, the tax, the shipping and any discount code. We never send Google your name, email, phone number or address.
Google Analytics doesn't store your IP address, and we keep its data for 14 months. We've turned on Google signals. If you're signed in to a Google account and have allowed ad personalization, that lets Google give us combined reports across your devices and broad audience reports (such as age range and interests). We only ever see totals, never individuals. You can control this in your Google account at My Ad Center, and Google explains how it uses this data in How Google uses information from sites that use its services.
To turn Google Analytics off for your browser, use Your privacy choices. If your browser sends Global Privacy Control, it's already off.
How we use your information
- To take, charge for, ship and support your order, including returns and exchanges.
- To send emails about your order: the order confirmation, and a notice if a piece in your bag sells out before you check out.
- If you joined our opening list: your opening code and, now and then, news of new arrivals. We send no other marketing email.
- To keep your bag working while you shop.
- To understand and improve the shop: which channels bring shoppers, what they search for, and which pieces they look at.
- To protect the site, our customers and ourselves from fraud and attacks.
- To meet our legal obligations, such as tax and accounting records.
Who else handles your information
We share personal information only with the companies that run parts of the shop for us, and only what each one needs:
- Stripe: payments, sales tax calculation and fraud screening. See Stripe's privacy policy.
- Heroku (Salesforce): hosts the website and its database.
- Cloudflare: delivers the site and our product images, blocks attacks, and gives us cookie-free visit totals.
- Google: Google Analytics, as described above, and Google Search Console, which tells us how the site appears in Google search (totals only, nothing about individual visitors).
- Resend: sends our order emails and our opening-list emails.
- Sentry: alerts us when part of the site breaks. Error reports carry technical details of the fault, not your IP address, cookies or contact details.
- Anthropic: we use the Claude AI assistant to summarize our daily traffic statistics for us. Those statistics can include the IP addresses of very busy visitors (usually automated bots) and the city and state of recent orders, but no names or contact details.
- Our jewelry suppliers and shipping carriers: many pieces ship directly from the supplier, so they and the carrier receive your name and shipping address to pack and deliver your order.
We may also disclose information when the law requires it or to protect our rights or someone's safety. If the business is ever sold, we may pass information to the buyer, and this policy will continue to apply to it.
We don't sell personal information, and we don't share it for targeted advertising. We don't use advertising pixels from Meta, TikTok, Pinterest or anyone else, and we don't buy personal information from data brokers.
How long we keep it
- Bags: an empty bag is deleted after 6 hours. A bag with no email attached is deleted after 30 days without activity, and a bag with an email after 90 days.
- IP address and browser type recorded with a bag are erased 60 days after they were recorded. A visit record that no longer belongs to any bag is deleted 30 days after it was recorded.
- Orders are kept for as long as we need them for returns, questions about your piece, tax and accounting.
- Opening list: until you unsubscribe or ask us to remove you.
- Server logs: 7 days.
- Google Analytics: 14 months.
- Backups of our database rotate: daily copies are kept for a week and weekly copies for about a month. We also keep occasional archive copies, stored securely.
- Search terms are kept, but with nothing that links them to you.
Your choices and rights
Wherever you live in the United States, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct anything that's wrong;
- delete your information (we keep only what the law requires, such as the tax record of an order);
- turn off Google Analytics on your browser, which you can do yourself on Your privacy choices.
Email [email protected] or write to us at the address below. We'll confirm we've received your request within 10 days and answer it within 45 days. To protect you, we'll check that the request comes from you, usually by replying to the email address on your order. Someone you authorize can ask on your behalf with your written permission. We'll never charge you more or treat you differently for using these rights.
We honor Global Privacy Control. If your browser or a browser extension sends it, Google Analytics stays off for you automatically.
Your order's receipt link
Your order confirmation links to a receipt page that shows your order and shipping address. The link is long and random, so nobody can guess it. Anyone you send it to can open it, though, so please share it with care.
Keeping it safe
The whole site runs over an encrypted connection (HTTPS), and Stripe handles card payments entirely. Only the business owner can reach our order records, through a protected sign-in. No way of storing or sending information is perfectly secure, but we work to protect yours. If a breach affects you, we'll tell you as the law requires.
Children
The shop is meant for adults. We don't knowingly collect information from children under 13. If you believe a child has given us information, contact us and we'll delete it.
Where your information is kept
We ship only to addresses in the United States. Our systems and service providers store and process information in the United States.
Changes to this policy
When the way the site handles personal information changes, we update this page and the date at the top. If a change is significant, we'll say so clearly on this page.
Contact us
Karat & Kin LLC
405 RXR Plaza, PMB A188
Uniondale, NY 11556
United States
Email: [email protected]
Phone: +1 516-246-5186