Privacy policy

Who is responsible for your data

Kim Kho Studio is the data controller for the information described here.

The short version

• The only cookie beyond the ones that make the shop work is Google Analytics — and only if you agree to it. Say no and it is never loaded.
• There is no advertising tracking. Nothing follows you around the internet afterwards.
• Your basket is stored in your own browser and is never sent to us.
• We only see your details if you place an order or send a message.
• The mailing list is entirely optional. You're only on it if you typed your address into the box in the footer, and every email has an unsubscribe link.

What we collect, and why

When you browse

Nothing that identifies you. The site keeps your basket in your browser's local storage so it survives a refresh — that stays on your device, and clearing your browser data removes it. It is strictly necessary to make the shop work, so it isn't something we ask consent for.

Our hosting provider, Vercel, keeps short-lived server logs that can include your IP address. That's a normal part of running a website securely and spotting abuse.

Cookies and analytics

The first time you visit, a bar at the bottom of the screen asks about cookies. Nothing analytics-related loads until you answer. “Accept all” switches Google Analytics on. “Cookie settings” shows you what each cookie is for, with Analytics unticked; save it that way and the Google script is never fetched and no analytics cookie is ever set. Until you've answered, the page can be read but not used.

If you say yes, Google Analytics tells us things like:

• which pages and sticker packs are being looked at;
• roughly where in the world visitors are;
• whether people arrived from Instagram, Google or a link.

It is used to decide what Kim draws next, not to identify anyone. Your IP address is anonymised before it reaches the reports, and analytics data is kept for a limited period set in Google Analytics — no longer than 14 months.

Changed your mind? Use the Cookie settings link at the bottom of any page. It opens the same list with your current answer filled in, and you can switch it either way as often as you like. Switching Analytics off also removes the Google Analytics cookies it had set.

Two other things are stored on your device and are not covered by that choice, because the shop cannot work without them: your basket, and your answer to this cookie question. Neither is sent to us.

If you use the free habit tracker, the habits you type are saved in your browser too, so they're there next month. That only happens because you asked for it, it never leaves your device, and clearing your browser data removes it.

Separately, our host Vercel counts page visits for us through Vercel Web Analytics. It is deliberately anonymous: no cookie, nothing stored on your device, no profile built and no way for us to single anyone out. It tells us how many people looked at a page, and nothing about who they are — so there's nothing to ask permission for, and nothing you'd need to opt out of.

The checkout runs on Shopify, which sets its own cookies needed to hold your order together while you pay.

When you message us

The contact form opens your own email app with the message written out. Nothing is sent through this website, and we hold nothing until you actually press send. After that we have whatever you wrote and your email address, sitting in an inbox, so we can reply.

When you join the mailing list

If you enter your email address in the box at the bottom of the page, it is stored in Shopify — the same place order records live — and tagged so Kim knows it came from the website. It is used for one thing: an occasional email about new sticker packs. It is never sold, never shared for anyone else's marketing, and never used to build a profile of you.

Every email carries an unsubscribe link, and unsubscribing is instant. You can also email kimkhostudio@gmail.com and ask to be taken off, and we'll remove the address entirely.

When you order

To send you stickers we need your name, delivery address, email address and what you bought. We keep those records so we can post your order, answer questions about it, handle returns and satisfy HMRC — business records have to be kept for six years.

We never see your card details. The checkout is run by Shopify, who take the card information directly through their payment provider. Your card number does not pass through this website and is not stored by us.

The lawful basis

• Performing our contract with you — processing and posting an order you placed.
• Legal obligation — keeping sales records for tax.
• Legitimate interests — replying to your message, and keeping the site secure and working.
• Consent — the analytics cookie, and the mailing list. You can withdraw either at any time: the Cookie settings link in the footer for one, the unsubscribe link in any email for the other.

Who else sees it

Only the companies needed to actually get an order to your door:

• Shopify — runs the checkout, takes the payment, holds the order record and stores the mailing list.
• Royal Mail (or whichever carrier is used) — needs your name and address printed on the parcel.
• Vercel — hosts the website, and counts visits anonymously.
• Google — provides the email account we reply from, and Analytics if you agreed to it.

We do not sell your information, and we do not share it for anyone else's marketing. Some of these companies are based outside the UK; when that's the case they operate under transfer safeguards approved for UK data.

How long we keep it

• Order records — six years from the end of the tax year, because HMRC requires it.
• Emails — up to two years, then deleted.
• Server logs — a short period set by our host, usually under a month.
• Analytics — no longer than 14 months, and only if you agreed to it.
• Mailing list — until you unsubscribe or ask to be removed.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of what we hold about you;
• correct anything that's wrong;
• delete it — though we can't delete order records we're legally required to keep;
• restrict or object to how we use it;
• send it to you, or another provider, in a portable format.

Email kimkhostudio@gmail.com and we'll sort it out. There's no charge, and we'll reply within a month.

If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you told us first so we can put it right.

Children

This shop is intended for adults. We don't knowingly collect information from children — if you're under 16, please ask a parent to order for you.

Changes

If this policy changes, the date at the top of the page changes with it.