Privacy Policy

1. What this policy covers

This policy explains how KenyLink ("we", "us") handles personal data when you use the Platform — as a store owner, provider, or customer — including stores powered by KenyLink on our subdomains or on custom domains.

Individual stores are operated by their owners, who are responsible for how they use customer data outside the Platform (for example, contacting you on WhatsApp). This policy covers the data handled by the Platform itself.

2. Data we collect

Account data: name, email address, phone number, password (stored hashed), country, and business details you provide at signup.

Store and order data: products, orders, delivery addresses, payment status, and messages exchanged through the Platform.

Technical data: IP address, device and browser information, and usage events, collected via cookies and similar technologies for security, analytics, and improving the product.

Payment data: card and mobile-money payments are processed by our payment providers (for example Stripe, M-Pesa). We do not store full card numbers.

3. How we use data

To operate the Platform: creating and hosting stores, processing orders and deliveries, sending transactional emails (order confirmations, password resets, store activation).

To keep the Platform safe: fraud prevention, rate limiting, and audit logging of administrative actions.

To improve the product: aggregate analytics about how features are used.

To communicate: service announcements and, only where you have opted in, marketing messages. You can unsubscribe from marketing at any time.

4. Sharing

We share data with service providers who help us run the Platform: hosting, payment processing, email delivery, error monitoring, and analytics. They process data only under our instructions.

When you buy from a store or accept a provider offer, we share the data needed to fulfil the order (name, contact details, delivery address) with that store owner or provider.

We may disclose data where required by law or to protect the rights and safety of users and the Platform.

We do not sell personal data.

5. Cookies and analytics

We use essential cookies for login sessions and security, and analytics cookies (for example Google Analytics) to understand usage. Where the law requires, we ask for your consent before enabling non-essential cookies, and you can withdraw consent at any time from the cookie banner.

6. Data retention

We keep account and order data while your account is active and as needed for legal, tax, and accounting obligations. When you close your account, store data is available for export for 30 days and then scheduled for deletion, except where law requires longer retention.

7. Your rights

Depending on your country (including under the UK/EU GDPR and the Nigeria Data Protection Act), you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing.

To exercise these rights, contact us through your dashboard or the support address shown on the Platform. We respond within the timelines required by applicable law.

8. International transfers

Our infrastructure providers may process data in countries other than your own. Where required, we use appropriate safeguards (such as standard contractual clauses) for those transfers.

9. Security

We protect data with encryption in transit, hashed passwords, role-based access controls, audit logs, and rate limiting. No system is perfectly secure — if we become aware of a breach affecting your data we will notify you as required by law.

10. Children

The Platform is not directed at children under 18, and we do not knowingly collect their data.

11. Changes and contact

We will notify account holders of material changes to this policy by email or in-product notice. Questions or requests: contact us through your dashboard or the support address shown on the Platform.