Privacy Policy

1. Who we are

AfriPantry is the data controller for personal data collected through our website. This policy explains what we collect, why, and your rights under the UK GDPR and the Data Protection Act 2018.

2. What we collect

• Account data — name, email, password hash, profile picture (if signing in with Google).
• Order data — delivery addresses, postcode, delivery notes, order history.
• Payment data — processed by Stripe. We never see or store your full card number.
• Support data — messages you send via the chat widget or WhatsApp.
• Usage data — device type, pages viewed, anonymised performance analytics.

3. How we use your data

• To process and deliver your orders (legal basis: contract).
• To provide customer support and respond to queries (legal basis: legitimate interests).
• To improve the service, fix bugs and prevent fraud (legal basis: legitimate interests).
• To send transactional emails such as order confirmations (legal basis: contract).
• Marketing emails are only sent with your explicit opt-in consent, and you can unsubscribe at any time.

4. Sharing with vendors

When you place an order, we share your name, delivery address, phone (if provided) and order details with the relevant vendor(s) so they can fulfil the order. Vendors are required to use this data only for order fulfilment.

5. Third-party processors

• Stripe — payment processing.
• Google — optional sign-in via Google OAuth.
• MongoDB Atlas — secure database hosting.
• PostHog — anonymised product analytics.

All processors are contractually obliged to protect your data.

6. International transfers

Some processors may transfer your data outside the UK/EEA. Where this happens, transfers are protected by Standard Contractual Clauses or equivalent safeguards approved under UK GDPR.

7. Retention

Order records are retained for 6 years to meet UK tax and consumer-protection requirements. Inactive accounts are deleted or anonymised after 36 months. You can request deletion earlier (see section 9).

8. Cookies

We use strictly-necessary cookies for authentication and cart state. We do not use third-party advertising cookies. Analytics cookies are used in an anonymised form only.

9. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict processing, object to processing, and data portability. To exercise any of these, contact us via WhatsApp at +44 7979 127731 or through the in-app support chat. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

Passwords are hashed with industry-standard algorithms. Traffic is encrypted via HTTPS. Access to production systems is restricted and logged.

11. Children

AfriPantry is not intended for children under 16. We do not knowingly collect data from children under 16.

12. Updates

We will update this policy from time to time. Material changes will be communicated via email or a banner on our site.