Privacy Policy

We only collect what we need to sell you a piece and get it to you:

• Order details: your name, phone number, delivery location, and any directions you add at checkout. No account is needed: checkout always works as a guest.
• If you sign in with Google (optional): Google shares your name, email address and profile photo with us. We use them to show your account, keep your orders, saved pieces and support chats together on any device, and fill in checkout for you. We never see your Google password, and we don’t access anything else in your Google account. Sign-in keeps a secure cookie on your device for up to 180 days; signing out removes it.
• Payment information: your phone number is sent to Safaricom to raise the M-Pesa payment prompt, and we store the resulting M-Pesa receipt number and amount against your order. We never see or store your M-Pesa PIN: you enter that on your own phone.
• Order history: the items, price, and status tied to your order number, so we can process delivery and answer queries.
• Basic technical data: standard server logs (e.g. IP address, browser type) needed to run and secure the site. If you install the app, your browser also keeps a local cache of pages on your device and a small flag recording that you dismissed the install prompt.
• Visit statistics: which pages are viewed, the site you came from, phone or computer, and your approximate city, tied to a random id in a cookie (not your name unless you are signed in). Kept by us only, to see how the shop is used. If you arrive through someone’s invite link, a cookie remembers that for 30 days so she can be thanked.
• Notifications (optional): if you turn on drop alerts or chat notifications, your browser gives us a notification address for this device. It contains no name or phone number, and is deleted when you turn notifications off.

Cookies we set (all our own, none for advertising): sign-in (up to 180 days, or until you sign out), your support chats on this device (1 year), the random visit-statistics id (1 year), and an invite-link referral (30 days). Your browser also keeps your cart and saved order numbers on your device only.

We do not use third-party advertising or analytics trackers, and we do not build marketing profiles about you.

• To reserve your item, take payment, and arrange delivery.
• To contact you about your order: usually by phone or WhatsApp.
• To keep accounting records and meet legal and tax obligations.
• To protect the site against fraud and abuse.

If you join our WhatsApp community, that is entirely optional and you can leave at any time. We message that group about new drops and restocks only.

We do not sell or rent your personal data. We share it only with:

• Safaricom (M-Pesa): your phone number and the payment amount, to process the transaction. Their handling of that data is governed by Safaricom’s own privacy policy.
• Google: only if you choose to sign in with Google, to confirm it’s you. Google’s own privacy policy covers your Google account.
• Delivery couriers: your name, phone number, and delivery address, for orders parcelled outside Nairobi CBD.
• Service providers that host the website and database on our behalf, under confidentiality obligations.
• Authorities, where we are legally required to disclose information.

We keep order and payment records for as long as needed to run the business and to satisfy accounting and legal requirements, after which we delete or anonymise them. Server logs are kept for a short period and then rotated out. Visit statistics are deleted after 13 months. If you have an account, it stays until you delete it: My Account, then Settings, then Delete account, or on our delete your account page (or ask us and we will). Your past orders stay as guest orders for our records. The cache and flag stored on your device stay until you clear your browser data or uninstall the app.

Under the Data Protection Act, 2019 you have the right to:

• ask what personal data we hold about you and get a copy;
• have inaccurate data corrected;
• ask us to delete your data where we no longer need it;
• object to or restrict certain processing;
• withdraw any consent you have given.

To exercise any of these, contact us on WhatsApp or by phone at +254 797 486 064. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

We take reasonable technical and organisational measures to protect your information, including transport encryption (HTTPS) and limiting who can access order data. No system is perfectly secure, but we work to keep the risk low.

The site is intended for adults (18+) and is not directed at children. We do not knowingly collect data from anyone under 18.

If we change how we handle your data, we will update this page and the “last updated” date above. Significant changes will be highlighted on the site.

Questions about this policy or your data? Reach us on WhatsApp or call +254 797 486 064.