Privacy Policy

1. Information we collect

When you create an account or use our services, we may collect:

• Account information — your name, email address, and password (passwords are stored securely and hashed by our authentication provider; we never see or store them in plain text).
• Profile information — optional details such as phone number and delivery address.
• Order and shipment information — quotes, orders, shipment tracking records, invoices, payment status, and any messages or support requests you send us.
• Buy For Me submissions — if you paste a product URL for us to look up, we fetch and display the listing's title, price, image, and supplier. We do not extract or store personal information from these URLs.
• Payment information — when you make a payment, your billing name, email, phone number, and the amount and currency of the transaction are shared with our payment processor (see "Third-party service providers" below). We do not store full card or mobile money details ourselves.

2. How we use your information

We use the information we collect to:

• create and manage your account and the customer portal;
• process and fulfil orders, quotes, shipments, and deliveries;
• process payments and issue invoices and receipts;
• send transactional emails such as registration confirmations, quotes, invoices, and shipment tracking updates;
• respond to support requests and communicate with you about your account;
• maintain the security and integrity of our platform; and
• comply with applicable legal, tax, and accounting obligations.

3. Legal bases for processing

Where applicable (for example, for visitors in the European Union or United Kingdom), we process personal data on the following legal bases: performance of a contract with you (e.g. fulfilling an order), our legitimate interests in operating and improving our services, your consent (where requested), and compliance with legal obligations.

4. Third-party service providers

We share personal data with the following third-party providers, solely to operate our services:

• Supabase — provides authentication, database, and file storage for account, order, shipment, and invoice data.
• Resend — sends transactional emails on our behalf (e.g. registration, quotes, invoices, tracking updates), using your name, email address, and relevant order details.
• Paystack — processes payments and receives your billing name, email, phone number, and the amount, currency, and reference of the transaction.

We do not sell your personal data, and we do not use advertising or analytics trackers on our website or portal.

5. Cookies and local storage

We do not use cookies. To keep you signed in, our customer and admin portals store an authentication session (access token, refresh token, and basic account details such as your name, email, and role) in your browser's local storage. This information is removed from your browser when you sign out.

6. Data retention

We retain account and transaction records for as long as your account is active and for as long afterwards as required to meet our tax, accounting, and legal obligations under Kenyan law. If you ask us to delete your account, we will do so except where we are required or permitted to retain certain records.

7. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to access, correct, update, or request deletion of your personal data, to object to or restrict certain processing, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

If you are located in the European Union or United Kingdom, you have equivalent rights under GDPR-style data protection law, including the rights to access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us using the details below.

8. Data security

We use reasonable technical and organizational measures to protect your personal data, including encrypted connections (HTTPS) and access controls on our database and file storage. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

9. International data transfers

Our service providers (Supabase, Resend, Paystack) may process and store data on servers located outside Kenya. Where this occurs, we rely on the safeguards and practices of these providers to protect your information in line with this policy.

10. Children's privacy

Our services are not directed at, and we do not knowingly collect personal data from, children under the age of 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after a change means you accept the revised policy.

12. Contact

Questions about this policy or your personal data? Email help@importsbyokoro.com or write to us at Westlands, Nairobi, Kenya.