Privacy Policy

Information you provide to us:

• Contact data — your name, phone number, and email address, provided when you check out or contact us.
• Delivery data — your delivery address or chosen pickup point, and any delivery notes.
• Order data — the products you buy, order amounts, payment status, and your order history.
• Account data (optional) — if you create an account, your sign-in email and profile details. Creating an account is never required to order.
• Communications — messages you send us, for example on WhatsApp or social media.

Information collected automatically:

• Device and log data — such as your IP address, browser type, and the pages you visit, collected by our hosting infrastructure to operate and secure the Site.

A note on payment. Your phone number is used to send the mobile money (M-Pesa or Airtel Money) payment prompt for your order, and is shared with our payment provider for that purpose. You approve payments by entering your PIN on your own phone — we never see, collect, or store your mobile money PIN.

• to process, deliver, and confirm your orders, including collecting payment;
• to communicate with you about your order and respond to your requests;
• to provide account features if you sign up — such as order history, reordering, and faster checkout;
• to prevent fraud and keep the Site and our services secure;
• to comply with legal obligations, including tax and record-keeping; and
• to understand how the store is used and improve it.

We do not sell your personal data, and we do not use it for third-party advertising.

We keep tracking to a minimum. Your shopping cart is stored locally in your own browser. If you sign in to an account, our authentication provider sets session cookies to keep you signed in.

We use PostHog, a product analytics service, to understand how the Site is used: which pages and products are viewed, what is added to the cart, and where checkout is abandoned or completed. PostHog stores a random visitor identifier in a first-party cookie and local storage, and may record how you interact with pages (session replay); anything you type into a form is masked before it leaves your browser. If you sign in, your account identifier and email address are associated with your activity so we can help you with your orders. We do not use advertising cookies.

We share personal data only as needed to run the store:

• Payment processing — our payment provider receives your phone number and the order amount to initiate the mobile money prompt and confirm payment. If you choose to pay with USDC or USDT, it receives the order amount and, once you pay, the public blockchain record of your transfer.
• Wallet connections— if you pay from a crypto wallet, the connection is made through Reown (WalletConnect), which sees your wallet address and this Site's name. Your payment is recorded on the Base blockchain, which is public and permanent; we store the transaction hash against your order.
• Order SMS— Africa's Talking, a Kenyan messaging provider, receives your phone number and the text of order updates (payment received, order delivered) so it can deliver them. We never send marketing SMS.
• Delivery and pickup partners — couriers and pickup services (such as Pickup Mtaani) receive your name, phone number, and delivery details to fulfil your order.
• Service providers — companies that host the Site, store product images, deliver our emails, and (if you use accounts) manage sign-in. They process data on our behalf under contract.
• Analytics — PostHog receives the usage data described in section 3 and processes it on our behalf.
• Address autocomplete — if you use the address suggestion feature at checkout, your address query is sent to Google to return suggestions.
• Authorities — where required by law, or to protect our rights, your safety, or the safety of others.
• Business transfers — if Spicey-O is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction.

Some of our service providers process data outside Kenya (for example in the United States or Europe). Where personal data is transferred out of Kenya, we do so in line with the Data Protection Act, 2019, using providers that offer appropriate safeguards for your data.

We keep personal data only as long as needed for the purposes described above. Order records are retained to meet legal, tax, and accounting requirements and to handle any disputes. Account data is kept while your account is active. When data is no longer needed, we delete or anonymise it.

We use technical and organisational safeguards designed to protect your personal data, including encrypted connections and access controls. No internet service can be guaranteed fully secure, but we work to protect your data and limit access to it.

Under the Data Protection Act, 2019, you have the right to:

• be informed about how your personal data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted where there is no good reason for us to keep it;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us on WhatsApp. We may need to verify your identity before acting on a request. If you are not satisfied with our response, you can lodge a complaint with the Office of the Data Protection Commissioner at www.odpc.go.ke.

The Site is not directed at anyone under 18 years of age, and you must be at least 18 to place an order. If you believe we have collected personal data from a child, please contact us and we will delete it.

The Site links to services we do not operate, such as WhatsApp and social media platforms. Their privacy practices are governed by their own policies, which we encourage you to read.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and may post a notice on the Site. Your continued use of the Site after changes take effect means the updated policy applies.

For questions about this Privacy Policy or your personal data, reach us on WhatsApp (+254717996898). See also our Terms & Conditions.