Privacy policy

Coffee Heist, Sunflag Building, Kilimani, Nairobi, Kenya. We run this website and the ordering service on it, and we decide what happens to the information described below.

When you sign in. Your name, email address and profile picture, passed to us by Google through our authentication provider. We never see your Google password.

What you tell us. Your phone number and delivery address, when you choose to save them or enter them on an order. You can change or clear both at any time on your account page.

Your orders. What you ordered, the total, whether it was delivery, collection or a table, how it was paid for, and the times it moved between stages. Where an order is changed, refunded or disputed, we keep a record of that too — it is how we can answer a question about your money later.

The chat assistant. The messages you type, and the order details needed to answer them.

We do not run advertising trackers or analytics cookies on this site, we do not build profiles of you for advertising, and we do not sell your information to anyone.

We use a small number of service providers to run the site. They handle your information only to provide their service to us:

• Clerk — sign-in and account security.
• Convex — the database holding your profile and orders.
• Vercel — hosting and delivery of the website.
• OpenRouter — the language model behind the chat assistant. What you type in the chat, and the order details needed to answer, are sent there.
• Cloudinary — image hosting.
• Safaricom — M-Pesa payments, where offered.

Some of these providers store data outside Kenya. We only use providers who commit to protecting it.

Where an M-Pesa payment is offered, the prompt is handled by Safaricom on your phone. We never see or store your M-Pesa PIN. What we keep is the amount, whether it succeeded, and the receipt number, because that is what proves an order was paid for.

Orders are kept as business records, including for tax and accounting. Your profile — name, phone, address — is kept until you ask us to remove it. Ask and we will delete what we are not required to keep.

Under Kenya's Data Protection Act, 2019 you may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Ask through our contact page and we will respond.

You may also complain to the Office of the Data Protection Commissioner.

We set a session cookie so you stay signed in between pages. It is necessary for the site to work, and it is not used for advertising.

If we change this policy we will update the date at the top. Where the change is significant, we will say so on the site.