Privacy Policy

When you place an order we collect:

• Your name, phone number, and email if you give one
• Your delivery address and any delivery notes
• What you ordered — products, sizes and cake messages
• Payment details from M-Pesa: the phone number the STK prompt was sent to, the amount, and Safaricom's confirmation of what was paid

We don't collect anything beyond what checkout asks for, and we don't use cookies to track you around the web. If a Google Analytics measurement ID is configured, page views and order totals are reported to GA4 in aggregate — that traffic isn't tied back to your name or phone number by us.

Every field above exists to get a specific cake to a specific address on a specific date and to confirm you paid for it: your name and phone identify the order, your address routes the delivery, and the M-Pesa details let us confirm payment and resolve it if something doesn't match. We also use your phone and email to send order confirmations and, if a payment needs a human to check it by hand, to reach you about that.

The lawful basis is performance of a contract — we can't bake and deliver an order without this information. Where we keep payment records past delivery, that's our legitimate interest in resolving disputes and keeping accurate accounts.

We don't sell or rent your information. It passes through the services that actually fulfil your order:

• Supabase — hosts the order database
• Safaricom Daraja — processes the M-Pesa payment
• Africa's Talking and Resend — send the SMS and email confirming your order, where those are configured

Each only receives what it needs to do its part — none of them gets the full order history.

Order records — what was ordered, delivered, and paid — are kept as normal business and accounting records. The full M-Pesa callback Safaricom sends us, which can include more than an order needs once it's resolved, is kept for 90 days and then removed automatically, leaving the receipt number and amount on the order.

You can ask what we hold about you, ask us to correct it, or ask us to delete it once any order it's attached to is complete and no longer needs to be kept for accounting purposes. Message us on WhatsApp, call +254 758 923 103, or email tanuricreations@gmail.com.

Order data is only reachable through our servers, never directly from the browser — the admin board sits behind a login, and repeated checkout attempts are rate limited. Safaricom doesn't cryptographically sign its payment callbacks, so we additionally check the amount they report against what the order actually cost before treating anything as paid.

If what we collect or how we use it changes, we'll update this page. Contact us if anything here is unclear.

Tanuri Pastry Creations, Earlybird Road, Kiambu Town, Kiambu. tanuricreations@gmail.com