Privacy notice

• When you order: your name, phone number, email address if you give one, and your delivery address and directions.
• When you pay: the M-Pesa number that paid, the amount, and the M-Pesa receipt number. We never see or store your M-Pesa PIN.
• If you sign in: the addresses you save, when you signed in, and whether you agreed to offers by SMS, with the date you agreed.
• Notes from our team that help with your orders, such as gate directions.
• On your device: your cart and a link to your recent orders are kept in your browser. If you sign in, two cookies keep you signed in and show your first name at the top of the page. We don't use advertising or tracking cookies.
• Security logs: our servers record the internet address of requests for up to 14 days to stop abuse, such as someone guessing sign-in codes.

• To take, deliver and look after your order, and to take your M-Pesa payment or send a refund. We need this to sell to you.
• To text you about your order, for example when your payment arrives and when the rider leaves, and to send sign-in codes.
• To keep the sales records Kenyan tax law requires.
• To protect you and the shop from fraud and abuse.
• To send offers by SMS, only if you switch them on. You can switch them off at any time under My account.

Only what each one needs to do their part:

• Safaricom, to process M-Pesa payments and refunds.
• Our SMS provider, to deliver the texts we send you.
• The rider or courier delivering your order: your name, phone number and address.
• Our hosting provider, Contabo, whose servers store the shop's data outside Kenya. Their contract with us requires them to keep it secure and to use it only to run our servers.
• Cloudflare, which every visit to the website passes through to keep it fast and protect it from attacks. It sees your device's IP address and the pages you request, on servers that may be outside Kenya, and handles them on our behalf under its data protection terms.
• Government authorities, when the law requires it.

We never sell your data.

• Your account and saved addresses: until you delete your account.
• Orders and payments: as long as Kenyan tax law requires. If you delete your account, we keep these records without your name, phone number or address.
• Sign-in codes: 10 minutes. Security logs: up to 14 days.

Under the Data Protection Act you can:

• get a copy of your data. If you signed in, download it yourself under My account, or ask us.
• ask us to correct anything that's wrong.
• ask us to delete your data, or delete your account yourself. We can't do this while an order is still on its way to you.
• object to how we use your data, or withdraw a consent you gave, such as for SMS offers.
• complain to the Office of the Data Protection Commissioner (odpc.go.ke) if you're unhappy with how we handle your data.

• Every page is sent over an encrypted connection.
• Signing in uses a one-time code sent to your phone, so there's no password to steal.
• Each member of our team sees only what their job needs.
• Payment details stay with Safaricom.

When we change this notice, we update the date at the top of this page.