Privacy Policy

This Privacy Policy explains how Teyatao collects, uses, shares, and protects personal information when you use our Platform. We process data in line with applicable law, including the Kenya Data Protection Act, 2019 where it applies.

• Account & profile: name, email, phone, password (hashed), delivery addresses.
• Orders & payments: order history, payment status, transaction references (we do not store full card numbers; payment partners process card data).
• Device & usage: IP address, browser type, pages viewed, cookies and similar technologies (see Cookie Policy).
• Communications: messages to support, reviews, and survey responses.

• Process orders, payments, delivery, and returns.
• Provide customer support and send service messages (order updates, security alerts).
• Improve the Platform, prevent fraud, and enforce our Terms.
• Send marketing where you have opted in; you may unsubscribe at any time.
• Comply with legal obligations and respond to lawful requests.

We share data with:

• Logistics partners — to deliver your order.
• Payment processors — e.g. M-Pesa and card acquirers to complete transactions.
• Technology providers — hosting, analytics, and email services under contract.
• Authorities — when required by law or to protect rights and safety.

We do not sell your personal information to third parties for their independent marketing.

We retain information as long as needed for the purposes above and as required by law (e.g. tax and accounting records). We use administrative, technical, and organizational measures to protect data; no method of transmission over the internet is 100% secure.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to withdraw consent where processing is consent-based. To exercise rights, contact privacy@teyatao.com. You may lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local authority.

Data may be processed in Kenya and other countries where our service providers operate. We use appropriate safeguards where required for cross-border transfers.

The Platform is not directed at children under 18. We do not knowingly collect data from children.

We may update this policy. The "Last updated" date will change when we do. Significant changes may be notified by email or on-site notice.