Privacy

This Privacy Notice explains how we process personal data when you visit bigcityink.com, place an order or contact us, what the Site stores in your browser, and which external services it loads content from. The Site uses no advertising technologies and sets no cookies of its own. It measures visits with cookieless statistics that carry no identifier, as described in clause 3.

Controller

Big City Ink is the controller of the personal data described in this notice.

You may contact us about any matter relating to personal data at hello@bigcityink.com. We have not appointed a data protection officer, as we are not required to do so.

Personal data we process

Order data: the contact, billing and delivery details, product selections, personalization content, order history and payment status necessary to perform and support your purchase. Payment card data is processed by payment providers under their own terms; the payment data available to us depends on the checkout configuration and never includes full card numbers.

Correspondence: the content of your messages, your contact details and any supporting information you provide.

Technical data: requests to the Site involve your IP address, browser and device information, the resource requested and the time of the request. When you use The Atlas, searched addresses and selected map locations are processed to retrieve the relevant information.

Please do not include unnecessary sensitive information, or information about other people, in your personalization. Material you submit is used to produce and support your order and is not used in advertising.

Purposes and legal bases

We process personal data as necessary to take steps at your request before entering into a Contract, to perform the Contract and to provide related support (Article 6(1)(b) of the General Data Protection Regulation (“GDPR”)).

We process invoices and other records as necessary to comply with our legal obligations, including accounting and tax obligations (Article 6(1)(c) GDPR).

We process personal data on the basis of our legitimate interests in securing the Site, preventing fraud, responding to general inquiries and establishing, exercising or defending legal claims, where those interests are not overridden by your interests or fundamental rights (Article 6(1)(f) GDPR).

Visit statistics. To understand how the Site is used and to improve it, the Site sends a short record to our server when a page is viewed or a control is used, for example choosing a size, adding an item to the bag, opening a product from a list (and its place in the list) or switching a theme, layer or view in The Atlas. The record contains the page, the website you came from (domain only), campaign tags in the link, the device class by screen width, the time spent and how far you scrolled, and the option chosen, named as it is in our code. For an address search in The Atlas, only the borough is recorded, never the address. Initials and personalization text are never included. The record carries no cookie or other identifier, so visits cannot be linked to one another or to you. Your IP address is used only to determine your country and is not stored. We process this on the basis of our legitimate interest in measuring and improving the Site (Article 6(1)(f) GDPR). You may object at any time: the Site records nothing when your browser sends a Global Privacy Control or Do Not Track signal, or after you exclude this browser.

Where consent is required, we obtain it before the processing begins (Article 6(1)(a) GDPR). You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Placing an order does not constitute consent to marketing.

Recipients

We disclose personal data only to the extent necessary for the relevant purpose, to the following categories of recipients:

• Shop and checkout. Our bag, checkout, orders and order emails run on Shopify, which processes your contact and delivery details, your order and its payment status on our behalf. Card payments are processed by Shopify Payments; we never receive full card numbers. If you choose an accelerated checkout such as Shop Pay, PayPal, Apple Pay or Google Pay, that provider processes your data under its own privacy notice. See Shopify’s Privacy Policy.
• Production and fulfillment. Orders are produced and dispatched by Printful, our print-on-demand production partner, which receives your personalization, product selection and delivery details. See Printful’s Privacy Policy.
• Carriers. Delivery carriers receive the name, delivery address and, where necessary for delivery, the contact details on the order.
• Hosting and security. The Site is served by Cloudflare, which, as with any web server, receives your IP address and browser details with each request and may retain them in logs for security and delivery purposes.
• Print files. To produce your order, our system creates a print file with your personalization and passes it to Printful through file storage at Cloudflare. The file is removed from that storage once Printful has accepted the order for production. For a print from the Atlas (Wear this block), the design you see is saved to the same storage when you add it to your bag, so that the print matches it exactly. It is deleted once Printful has accepted the order, or after 14 days if no order is placed.
• Our data relay. Live train and bus times, subway elevator outages, air quality and the Live layer in The Atlas are delivered through our own relay on Cloudflare Workers, so that our access keys remain private. For air quality, the point you select on the map is sent to the relay, which requests readings for that area from EPA AirNow. Cloudflare receives your IP address with each request.
• Email and replies. Our mailbox is hosted by Google Workspace. Messages sent to our addresses are sorted and a draft reply is prepared by our service on Cloudflare Workers, which sends the message to Anthropic’s Claude for that purpose. Anthropic acts as our processor and does not use the content to train its models. A person reviews every reply before it is sent.
• Payment disputes. Where you dispute a payment, we provide your payment provider with the order records described in clause 7.2 of our Terms, as necessary to establish, exercise or defend our legal claims.
• Advisers and authorities, where disclosure is required by law or necessary to establish, exercise or defend legal claims.

The Atlas and external content

Certain features load content directly from third-party services. These requests may disclose your IP address, browser information, the content requested and, for address or location services, your query or selected point. Each service processes that information in its own capacity and under its own privacy notice.

• Maps. When The Atlas opens, base map tiles and map lettering load from OpenFreeMap (OpenStreetMap data). Aerial imagery loads from the City of New York’s imagery service on ArcGIS only when you turn on Aerial.
• Address search. Text entered in a search box in The Atlas is sent to NYC Planning’s Geosearch service to locate the place. A point you select on the map may also be sent to that service to identify the nearest address.
• Your location. When you press the location button in The Atlas, your browser asks for your permission and, if you allow it, shares your device’s location with the page to show it on the map. Your location stays in your browser: it is not sent to us or stored. Map tiles for the area shown load from OpenFreeMap as described above. You can withdraw permission at any time in your browser settings.
• Weather alerts. When The Atlas opens, your browser requests active alerts for New York from the National Weather Service. The request contains no location of yours.
• Street imagery. When you use Street in The Atlas or open a 360° image, your browser loads images and data from Mapillary, a Meta service. Mapillary’s Privacy Policy applies to those requests.
• YouTube. The Live layer in The Atlas uses YouTube API Services. Our relay requests public live streams in New York from the YouTube Data API; that request contains no information about you. When the layer is on, stream thumbnails load from YouTube’s image servers. The video player loads from youtube-nocookie.com only when you press Watch. The same applies to our music videos on object pages: nothing loads from YouTube until you press Watch the video. YouTube is a Google service, and the Google Privacy Policy applies to information YouTube collects. We do not access or store YouTube account data.
• Fonts and code. Fonts and scripts are served from our own Site.

Cookies and browser storage

The Site sets no cookies of its own. It stores a small number of entries in your browser’s storage so that features you use function and choices you make are remembered. These entries are not used for tracking or advertising and are not transmitted to us. Each is strictly necessary for a feature you request or records a preference you set, and therefore does not require consent.

The following entries remain until you clear this Site’s data in your browser:

• Bag: the reference to your bag at Shopify, our checkout provider, so that its contents are kept between visits.
• Country or region: the country you chose, so prices show in the right currency.
• Songs: the songs you marked as favorites, whether you play only your favorites, and whether shuffle and repeat are on.
• Sound: whether you turned sound on, on pages that offer it.
• Atlas panels: whether you pinned the side panels of The Atlas open.
• Atlas view: the view you last picked under Who’s looking? (for example, renting), or that you skipped it.
• Saved addresses: the addresses you saved in The Atlas and the last five you searched for.
• Hints: that you have already seen a hint, so it does not show again.
• Statistics opt-out: that you excluded this browser from visit statistics (only if you choose to).

The following entries remain only until you close the browser tab:

• City opening: that you have already seen a city’s opening sequence, so it plays shorter next time.
• Your text: text you typed in a personalization box, carried to the product page and deleted as soon as that page reads it.

You may remove these entries at any time by clearing this Site’s data in your browser settings. If you press Watch on a YouTube stream, YouTube’s player may store its own data on your device. Checkout and payment services may use cookies or similar technologies strictly necessary to complete a payment securely. Any non-essential storage or access that requires consent will take place only after consent has been given.

Do Not Track, sale and sharing

We do not track visitors over time or across third-party websites, and we do not permit third parties to do so through the Site for advertising purposes. When your browser sends a Global Privacy Control or Do Not Track signal, the Site does not record your visit in its statistics.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws.

International transfers

Certain providers, including production, infrastructure and embedded services, may process personal data outside the European Economic Area, including in the United States. Where we transfer personal data outside the European Economic Area, we rely on an appropriate transfer mechanism under Chapter V GDPR, such as an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified recipients) or the Commission’s standard contractual clauses. Information on the mechanism used is available on request.

Retention

We retain personal data only for as long as necessary for the relevant purpose and to comply with applicable legal obligations:

• Orders, invoices and tax records: ten years, as required by Lithuanian accounting law.
• Order records relating to acceptance, delivery and payment: for as long as a claim or payment dispute concerning the order can be raised.
• Personalization and print files: up to three years after delivery, to handle any claim under the legal guarantee, then deleted.
• Correspondence: for as long as necessary to resolve your enquiry and any related claim.
• Visit statistics: up to 400 days, after which they are deleted.
• Reply log: the category of each message and a one-line summary without your name or contact details, up to 12 months, after which they are deleted.
• Security logs: for a short period determined by our hosting and infrastructure providers.
• Browser storage: on your device, until you clear it, as described in clause 6.

Your rights

Subject to the conditions of applicable law, you have the right to request access to, rectification or erasure of, and restriction of processing of your personal data, and the right to data portability. You have the right to object to processing based on legitimate interests and to withdraw consent where processing is based on consent. To exercise these rights, contact hello@bigcityink.com.

We respond within one month of receipt of your request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons for it.

You have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (vdai.lrv.lt) or with another competent supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Statutory or contractual requirement and automated decisions

The provision of payment, personalization and delivery information is a contractual requirement and is necessary to enter into a Contract. Without it, we are unable to accept or perform your order.

Personalization text is checked by an automated filter, which may decline certain words or characters; you may then submit different text. Messages you send us are sorted, and draft replies prepared, with the help of an AI system; a person reviews each reply before it is sent. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Children

The Site is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this notice

We update this notice when our processing changes and indicate the date of the latest revision. Where required by law, we will provide additional notice or obtain your consent before using personal data for a new purpose.