Legal

Privacy Policy

Last updated: July 19, 2026

Crowned Koi is a single-operator luxury watch business based in New York City. Every transaction is handled personally by Pat, the founder. This policy explains what information we collect, how we use it, and the choices you have regarding your data.

Information We Collect

When you contact us, submit an offer, purchase a watch, or consign a piece, we collect the information needed to complete the transaction and keep honest records. That typically includes:

• Your full name
• Email address
• Phone number
• Shipping address and billing address
• Transaction records (watches purchased, sold, consigned, or serviced)
• Content of form submissions, emails, and text messages you send us

Where Your Data Lives

Client records and transaction history are stored in a private Supabase database hosted in a United States region. Access is limited to the Crowned Koi operator and the infrastructure providers required to keep the system running. We do not sell, rent, or trade your personal information to any third party, and we do not share it for marketing purposes.

Payment Information

Card payments are processed by Stripe. Crowned Koi never sees or stores your full card number, expiration date, or security code. Wire transfer details are exchanged securely and retained only as long as needed to reconcile the transaction. When cryptocurrency is accepted on a case-by-case basis, we receive only the wallet address and on-chain transaction reference.

Cookies, Storage, and Analytics

We use two categories of cookies and local storage:

• Strictly necessary — required to run the site and keep you signed in to the client portal. These are always on and exempt from consent. We also use local storage for conveniences like your wishlist and recent searches.
• Analytics (optional, off until you opt in)— Vercel Analytics, Vercel Speed Insights, and our own first-party page-view measurement (recording pages visited, referrer, and a rotating session identifier to understand how the site performs). None of this runs until you accept it in the cookie banner, and you can change or withdraw your choice at any time via “Cookie Preferences” in the footer.

We do not use advertising or cross-site tracking cookies, and we do not run Google Analytics or a Meta/Facebook pixel.

How We Use Your Information

Your information is used to process transactions, ship watches, authenticate and service pieces, respond to inquiries, keep required business and tax records, prevent fraud, and occasionally send you messages about a watch you expressed interest in. We never send unsolicited bulk marketing to addresses collected through transaction paperwork.

Legal Basis for Processing

For visitors in the EEA/UK, we rely on: contract (to process a sale, consignment, service, or sourcing request you asked for); legitimate interests (to run and secure the site, prevent fraud, and respond to inquiries); consent (for optional analytics cookies and marketing emails, withdrawable at any time); and legal obligation (to keep tax and transaction records).

How Long We Keep It

Transaction, tax, and authentication records are kept for the period required by tax and anti-fraud law (generally up to seven years). Inquiry, sourcing, and marketing data is kept only while useful for that purpose or until you ask us to delete it or unsubscribe. Optional analytics data is retained in aggregate by our providers under their standard periods.

Who We Share Data With

We do not sell your data. We share it only with the service providers (processors) needed to run the business, each under their own data-protection terms:

• Supabase — database and client-portal authentication
• Stripe — card payment processing
• Resend — transactional and newsletter email delivery
• Vercel — website hosting and (with consent) analytics
• Google — client-portal sign-in and, on some pages, business reviews

International Transfers

Crowned Koi operates from the United States and the providers above are US-based, so data about EEA/UK visitors is transferred to the US. Where required, these transfers rely on the providers’ Standard Contractual Clauses and/or their EU–US Data Privacy Framework certification.

Your Rights

Depending on where you live, you have the right to access a copy of your data, correct inaccuracies, request erasure, restrict or object to processing, request portability of the data you gave us, and withdraw consent at any time (without affecting prior processing). Certain records tied to completed transactions may be retained where tax and anti-fraud law requires it. To make a request, email pat@crownedkoi.com from the address on file. If you are in the EEA/UK and believe we have mishandled your data, you also have the right to lodge a complaint with your local data-protection supervisory authority.

Children

Crowned Koi is not directed to anyone under the age of 18 and we do not knowingly collect information from minors. If you believe a minor has contacted us, please let us know and we will delete the record.

Updates to This Policy

We may update this policy as the business evolves. Material changes will be reflected in the “last updated” date at the top of the page.

Contact

Questions about privacy or data can go directly to Pat at pat@crownedkoi.com.