Privacy policy

Effective date: This policy takes effect on 26 October 2026.

1. About this policy

1.1 This Privacy Policy explains how Krakking Korals Pty Ltd (ABN 57 657 708 720) (“Krakking Korals”, “we”, “us”) collects, holds, uses and discloses personal information when you:

  • visit or shop at krakkingkorals.com.au (the “Site”) or our store at 3/8 Withers Street, West Wallsend NSW 2286;
  • pay us by phone;
  • use the Ask chat on the Site;
  • join or use KK Rewards, our rewards program at rewards.krakkingkorals.com.au, including the Weekly points spin; or
  • contact us, or receive emails from us.

1.2 Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

1.3 We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For customers in New Zealand, we also follow the New Zealand Privacy Act 2020 and its Information Privacy Principles where it applies to us. Section 20 covers customers in the UK and the European Union.

1.4 Aquarium Ledger. Krakking Korals Pty Ltd also runs the Ask chat and the Aquarium Ledger app (aquariumledger.com). The Aquarium Ledger Privacy Policy covers the app itself. This policy covers the Ask chat on our Site and the link between Aquarium Ledger and KK Rewards.

1.5 This policy forms part of our Terms of Service (see clause 20.1) and our KK Rewards Terms.

2. Summary

  • We collect what we need to sell and ship your order, run your account and KK Rewards, answer your questions and improve our Site.
  • We never store your full card number, including when you pay by phone.
  • The Ask chat sends your questions, and any photos or ICP reports you upload, to our AI provider xAI in the United States. Don’t enter passwords, payment details or ID documents in the chat.
  • We only send marketing emails if you’ve agreed, and every one has an unsubscribe link.
  • Some of our service providers store or process information outside Australia. We list them and their countries in section 12.
  • You must be 16 or older to shop with us, join KK Rewards or use Aquarium Ledger (section 17).
  • You can ask to access or correct your information (section 18) or complain (section 19) by emailing our Privacy Officer at sales@krakkingkorals.com.au. We’ll respond within 30 days.
  • We don’t sell your personal information.

3. What we collect

  • Device and browsing information: Browser version, IP address, time zone, cookie information, pages and products you view, search terms, how you use the Site Why: To load the Site properly, keep it secure, and analyse and improve it
  • Order information: Name, billing and shipping address, email, phone number, items ordered, order history Why: To process and ship your order, send invoices and confirmations, prevent fraud and deal with returns
  • Payment information: Online payments are processed by our payment providers: Shopify Payments (cards, Shop Pay, Apple Pay and Google Pay), PayPal, Afterpay and Zip. In our store, card payments are processed by Commonwealth Bank of Australia through its EFTPOS terminal, or you can pay cash. If you pay by phone, we key your card details straight into our payment terminal or Shopify while we’re on the call. We never write down, keep or store your full card number or security code. We only see limited details, such as the card type and the last digits Why: To take payment and refund you
  • Account information: Your Krakking Korals customer account: name, email, login details, saved addresses Why: To run your account
  • Customer support information: Your messages, emails and calls, and the details you give us (for example, photos of a problem with livestock) Why: To help you and to resolve problems or claims
  • In-store sales: Your purchase, and your customer account if you ask us to attach it Why: To give you a receipt and KK Rewards points
  • Ask chat information: See section 4 Why: To answer your questions
  • KK Rewards information: See section 7 Why: To run KK Rewards
  • Marketing preferences: Whether you’ve subscribed, and consent records (section 9) Why: To send only the emails you’ve agreed to
  • Reviews: Reviews and photos you submit, with your name as you choose to show it Why: To publish reviews and, where offered, give review points

We usually collect this information from you, automatically through cookies and similar technologies (section 14), and from service providers such as Shopify, our payment providers and couriers. If you link Aquarium Ledger to KK Rewards, we also receive some information from it (section 8).

If you don’t give us information we need (for example, a delivery address), we may not be able to fill your order or provide a service.

Sensitive information: we don’t ask for sensitive information (such as health information). Please don’t include it in messages or the Ask chat.

4. The Ask chat

4.1 The Ask chat on our Site is an AI assistant provided through Aquarium Ledger. It runs in a window (iframe) from aquariumledger.com on our Site. Aquarium Ledger’s servers and database are in the United States (section 12).

4.2 What the chat receives. When you use it, the chat receives:

  • your questions and the conversation in the chat;
  • if you’re signed in to your Krakking Korals account, your customer ID and email address;
  • your cart contents and the product page you’re on, so it can answer about them;
  • a random device ID stored in your browser; and
  • any photos or ICP (water test) reports you upload.

4.3 What the chat can do. With your instruction, the chat can add products to your cart and apply offer codes it gives you. It may search our online store and the web for current product and aquarium information. If you ask for a back-in-stock alert, we keep the product and your email address to tell you when it’s back. Alerts end after 90 days and are deleted 30 days after that.

4.4 AI processing in the United States. To generate answers, your questions, the conversation, the page and cart context, and any photos or ICP reports you upload are sent to our AI provider, xAI (Grok models and xAI web search), in the United States. Under xAI’s published API terms, xAI keeps API requests and responses for up to 30 days for security and abuse checks, then deletes them, and doesn’t use them to train its models.

4.5 Usage limits. We count how many questions each customer asks each week, so we can apply free allowances and Ask credits. For guests (not signed in), we keep only a keyed one-way hash of your IP address and a browser cookie or device ID, not your name or email. We delete these counters and hashed IP addresses after 120 days.

4.6 Aquarium Ledger accounts. If you’re signed in to Aquarium Ledger, it keeps your chat history and a short “Ask memory” for each tank so Ask can follow up. You can view and clear the Ask memory in the app. The Aquarium Ledger Privacy Policy explains this.

4.7 Improving answers. When an answer goes wrong (for example, no matching product is found, or you report it), we keep the question and a short summary of the answer without your customer ID or device ID, and delete it after 120 days.

4.8 Please don’t enter passwords, payment card details, bank details or identity documents (such as a driver’s licence or passport) in the chat or in uploads. AI answers can be wrong, so check important advice (for example, about livestock health) with us.

5. How we use personal information

We use personal information to:

  • sell, process, pack and ship orders, including livestock, and arrange courier delivery;
  • take payments, give refunds and deal with returns and warranty or DOA claims;
  • run your customer account, KK Rewards and the Ask chat;
  • answer questions and give customer support;
  • send service messages (for example, order updates and KK Rewards notices);
  • send marketing, but only as described in section 9;
  • show and measure ads, and analyse how the Site is used (section 10);
  • detect and prevent fraud, misuse and security problems;
  • improve our products, Site and services; and
  • comply with the law (for example, tax and consumer law records) and protect our rights.

We use and disclose information for these purposes, for related purposes you would reasonably expect, with your consent, or where the law allows or requires it.

6. Who can see what we collect

Our staff only access personal information when they need it for their work. We don’t sell personal information.

7. KK Rewards and the Weekly points spin

7.1 KK Rewards is open to Krakking Korals customers aged 16 or over in Australia and New Zealand.

7.2 What we collect for KK Rewards:

  • Account and membership: your Krakking Korals customer ID, name, email address, country and membership status, from our Shopify store when you log in.
  • Age confirmation: when you join KK Rewards online, your confirmation that you’re 16 or over, and the date and time you gave it.
  • Points and transactions: points earned, redeemed, reversed and adjusted; the online orders and in-store sales that earned or used points (order number, date, qualifying amounts, refunds); reward codes issued and used; points boosts; staff adjustments and the reasons for them.
  • Tiers and perks: your tier, points earned in the last 12 months, tier-up rewards, free frags owed or sent, and shipping-back points.
  • Referrals: your referral code or link, who you referred and whether their qualifying order was made or refunded. We don’t contact your friends for you.
  • Birthday (optional): day and month only, never the year, for your birthday bonus. You can remove it at any time.
  • Weekly points spin: the country and state of your account address, or your answer if there’s no address (to check you’re in Australia or New Zealand), and a record of each spin (member, time, random result and points won).
  • Aquarium Ledger activity: see section 8.
  • Security records: login sessions, and an audit log of actions on your account (including staff actions).

7.3 We use this to work out and show your points, tier and perks, issue and check reward codes, run the spin, reverse points for refunds, prevent misuse, answer your questions and keep the records the law requires. KK Rewards service emails (for example, about your points) are sent from noreply@krakkingkorals.com.au through our Google Workspace email.

8. Aquarium Ledger and KK Rewards link

8.1 If you’re in Australia or New Zealand, you can link your Aquarium Ledger account to KK Rewards to earn points.

8.2 When you link them, Aquarium Ledger shares with KK Rewards:

  • your Aquarium Ledger email address (and whether it’s verified), to match the accounts;
  • your country, to check you’re in Australia or New Zealand;
  • your Aquarium Ledger account ID, to keep the link; and
  • for the test-logging perk, the date and time you logged a water test on your own tank, with a random ID for that test.

We never receive your test readings, notes or photos. KK Rewards shares your points balance back to Aquarium Ledger so the app can show it, and lets you move between the two apps already signed in.

8.3 You can unlink at any time, either in Aquarium Ledger (the KK Rewards card on the Desk, then Unlink) or in KK Rewards (Profile, then Unlink Aquarium Ledger). Deleting your Aquarium Ledger account also unlinks it. Unlinking stops new sharing. Points already earned stay in your account.

9. Direct marketing

9.1 We only send marketing emails (specials, new arrivals and rewards updates) if you have agreed, for example:

  • by ticking an unticked box at checkout or in your account;
  • by ticking the KK Rewards box: “Yes, email me Krakking Korals specials, new arrivals and rewards updates. Unsubscribe any time.”; or
  • where the Spam Act 2003 (Cth) otherwise allows.

9.2 Consent records. When you opt in or out through KK Rewards, we record the date and time, the exact wording and version shown, and technical details (IP address and browser), as evidence of consent under the Spam Act. Your choice is synced to our Shopify store, and our marketing emails are sent through Shopify Email.

9.3 Unsubscribe. Every marketing email identifies us and has an unsubscribe link. You can also unsubscribe in your account or the rewards site, or by emailing us. We act on unsubscribes within 5 business days. We may still send service messages (for example, about an order or your points).

9.4 We don’t sell or rent your email address for others to market to you.

9.5 No text messages. We don’t send marketing or notification text messages (SMS). We use your phone number only to deal with your order and delivery (for example, so a courier or our staff can contact you).

10. Analytics and advertising

10.1 We use Google Analytics and Google Ads to understand how customers use the Site and to measure our ads. Read how Google uses information at https://policies.google.com/privacy, or opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout.

10.2 We use Meta (Facebook and Instagram), including the Meta pixel, to advertise and to reach potential customers. We may share information about your use of the Site, your purchases and your interaction with our ads with our advertising partners, directly or through cookies, pixels and similar technologies (with your consent where the law requires it).

10.3 Opting out of targeted ads:

  • Facebook: https://www.facebook.com/settings/?tab=ads
  • Google: https://www.google.com/settings/ads/anonymous
  • Digital Advertising Alliance: http://optout.aboutads.info/
  • Learn how targeted advertising works: http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work

11. Who we share personal information with

We share personal information only as needed with:

  • Shopify, which powers our online store, checkout, point of sale, customer accounts and marketing email (see https://www.shopify.com/legal/privacy);
  • payment providers: Shopify Payments (including Shop Pay, Apple Pay and Google Pay), PayPal, Afterpay, Zip, and Commonwealth Bank of Australia for in-store card payments through its EFTPOS terminal;
  • couriers and freight carriers (for example Australia Post, StarTrack, TNT, and airline or airport freight services) to deliver orders, including Australia Post for New Zealand orders;
  • Aquarium Ledger and xAI for the Ask chat (section 4);
  • hosting and database providers: Vercel and Neon, for KK Rewards and Aquarium Ledger;
  • email providers: Google Workspace for KK Rewards service emails and our own email, and Resend for Aquarium Ledger emails;
  • analytics and advertising partners: Google and Meta;
  • other service providers that help us run the Site and our marketing, under their own privacy terms;
  • our professional advisers (for example, accountants and lawyers); and
  • government agencies, regulators, courts or police when the law requires or allows it, for example to respond to a subpoena or warrant, or to protect our rights.

12. Overseas disclosure

12.1 Some of the providers in section 11 store or process personal information outside Australia. The countries are:

  • xAI: Ask chat questions, conversation, cart and page context, photos and ICP reports; web searches – United States
  • Aquarium Ledger hosting (Vercel and Neon): The Ask chat (including your customer ID, email and cart if you’re signed in), Aquarium Ledger accounts, and the KK Rewards link – United States
  • KK Rewards hosting (Vercel and Neon): KK Rewards accounts, points, spin records and consent records – Australia (Sydney)
  • Shopify: Store, checkout, point of sale, customer accounts, orders, marketing email – Canada, the United States, Singapore and other countries where Shopify and its service providers operate
  • Google (Analytics, Ads, Workspace): Site analytics, advertising, and our email, including KK Rewards service emails – United States and other countries where Google has data centres
  • Meta: Advertising – United States and other countries
  • Resend: Aquarium Ledger emails – United States
  • PayPal: Payments – United States and other countries
  • Afterpay and Zip: Buy now, pay later payments – Australia, and the overseas countries listed in their own privacy policies (including New Zealand and the United States)
  • Couriers: Delivery details – Australia; New Zealand for New Zealand deliveries

12.2 Before disclosing information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the APPs, for example through contracts and the provider’s privacy and security commitments. Overseas recipients may be subject to foreign laws that require them to disclose information to authorities.

13. Automated decisions

13.1 Shopify uses limited automated decision-making to prevent fraud. This doesn’t have a legal or similarly significant effect on you. For example:

  • IP addresses linked to repeated failed transactions go on a temporary denylist for a small number of hours; and
  • credit cards linked to denylisted IP addresses go on a temporary denylist for a small number of days.

13.2 The Ask chat uses AI to generate answers and product suggestions, and may apply offer codes. The Weekly points spin picks points at random. These don’t make decisions with a legal or similarly significant effect on you.

14. Cookies

14.1 A cookie is a small file stored on your device when you visit the Site. Cookies remember your actions and preferences (such as login and cart) and tell us how the Site is used. We use functional, performance, advertising and social media cookies, and similar browser storage.

Cookies needed for the store to work (Shopify)

  • _shopify_essential: Keeps the store working: cart, checkout, login and security.
  • localization: Remembers your country and language.
  • cart_currency: Remembers your cart currency.
  • _shop_app_essential: Used by Shop Pay (set on shop.app).
  • _ab, _secure_session_id, cart, cart_sig, cart_ts, checkout_token, secret, secure_customer_sig, storefront_digest, _shopify_u: Older Shopify names for cart, checkout, login and account functions, which some browsers may still have.

Reporting, analytics and advertising

  • _shopify_analytics: Shopify analytics.
  • _shopify_marketing: Shopify marketing and referral tracking.
  • _tracking_consent: Your tracking preferences.
  • _landing_page, _orig_referrer, _s, _shopify_fs, _shopify_s, _shopify_sa_p, _shopify_sa_t, _shopify_y, _y: Older Shopify analytics names, which some browsers may still have.
  • _ga, _ga_TV1YGSLDSQ, _ga_2744BP7N5W: Google Analytics: tells visits and visitors apart.
  • _gcl_au: Google Ads: measures ad clicks and conversions.
  • _fbp, _fbc: Meta pixel: measures and targets ads.
  • fr: Meta (set on facebook.com): advertising.

Ask chat

  • kkAskDevice: Stored in your browser on our Site: the random device ID for the Ask chat.
  • rl_guest: Set by aquariumledger.com inside the chat window: a random guest ID for the weekly free allowance.

14.2 Session cookies last until you stop browsing. Persistent cookies last until they expire or are deleted, usually between 30 minutes and about 13 months.

14.3 You can manage cookies in your browser settings (see www.allaboutcookies.org). Blocking cookies may stop parts of the Site working, and may not stop all sharing with advertising partners. Use the opt-outs in section 10 as well.

14.4 Do Not Track. There’s no consistent industry approach to “Do Not Track” signals, so we don’t change our practices when we detect one.

15. Security

We protect personal information with reasonable steps, including:

  • secure (HTTPS) connections;
  • payment processing by PCI-compliant providers, and never storing card numbers;
  • access controls and audit logs for staff;
  • hashing of IP addresses used for rate limits; and
  • choosing reputable providers.

No system is completely secure. If a data breach is likely to cause serious harm, we’ll notify you and the OAIC (and, for New Zealand customers, the NZ Privacy Commissioner) as the law requires.

16. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. After that, we delete or de-identify it. In particular:

  • Orders, transactions and other tax and financial records (including KK Rewards points, reward codes and Weekly points spin records): 5 years, as Australian tax law requires.
  • Marketing consent records: while you’re subscribed, and after that for as long as we need them to show you consented.
  • Customer support messages: as long as we need them to help you and deal with any claim.
  • Ask chat: weekly question counters, guests’ hashed IP addresses and wrong-answer notes are kept for 120 days, then deleted. AI provider retention is described in section 4.4.
  • KK Rewards account closure: we delete your KK Rewards data within 30 days, except records the law requires us to keep.
  • Customer account: until you ask us to delete it, except records the law requires us to keep.

17. Age limit (16+)

You must be 16 or older to buy from our Site or store, create a customer account, join KK Rewards (including the Weekly points spin) or use Aquarium Ledger. When you join KK Rewards online, we ask you to confirm that you’re 16 or over, and we record when you confirmed it. We don’t knowingly collect personal information from children under 16. If you’re a parent or guardian and believe your child under 16 has given us personal information, contact us and we’ll delete it.

18. Access and correction

18.1 You can ask for access to the personal information we hold about you, and ask us to correct it if it’s inaccurate, out of date, incomplete, irrelevant or misleading.

18.2 Contact our Privacy Officer at sales@krakkingkorals.com.au, call 0411 755 668, or write to the Privacy Officer, Krakking Korals, 3/8 Withers Street, West Wallsend NSW 2286. You can update many details yourself in your Krakking Korals account or the rewards site.

18.3 We’ll need to confirm your identity. We’ll respond within 30 days. Access is free, though we may charge a reasonable cost for large requests and will tell you first.

18.4 We may refuse access or correction where the law allows (for example, where it would unreasonably affect someone else’s privacy). If we do, we’ll tell you why in writing and how to complain. If we don’t agree to correct information, you can ask us to attach a statement saying you believe it’s wrong.

18.5 You can also ask us to delete your account and information, and we’ll do so except for records we must keep (section 16).

19. Complaints

19.1 If you have a privacy complaint, email our Privacy Officer at sales@krakkingkorals.com.au with the details. We’ll acknowledge it and respond within 30 days.

19.2 If you’re not satisfied with our response, you can complain to:

  • the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992; or
  • if you’re in New Zealand, the Office of the Privacy Commissioner: privacy.org.nz.

20. Customers outside Australia

20.1 New Zealand. We handle NZ customers’ information consistently with the NZ Privacy Act 2020. You have the same access, correction and complaint rights as set out above.

20.2 United Kingdom and European Union. If the UK or EU GDPR applies to you:

  • Legal bases: we rely on contract (orders, accounts and KK Rewards), legitimate interests (security, fraud prevention and analytics), consent (marketing and non-essential cookies) and legal obligation (tax records).
  • Your rights: you can ask for access, correction, deletion, restriction, portability, or object to processing, and you can withdraw consent at any time.
  • Transfers: your information is processed in Australia and other countries (section 12). Shopify processes European customer data initially in Ireland, then transfers it outside Europe, including to Canada and the United States (see https://help.shopify.com/en/manual/your-account/privacy/GDPR). Transfers rely on adequacy decisions or standard contractual clauses where needed.
  • Complaints: you can complain to your local data protection authority (for example, the UK ICO).

21. Changes to this policy

We may update this policy to reflect changes to our practices or the law. We’ll post the new version on the Site with its effective date. If a change is significant, we’ll tell you by email or on the Site.

22. Contact us

Privacy Officer, Krakking Korals Pty Ltd (ABN 57 657 708 720) 3/8 Withers Street, West Wallsend NSW 2286, Australia Email: sales@krakkingkorals.com.au Phone: 0411 755 668