Privacy policy

Siena Lisa keeps your phone number, name, addresses, and order history so we can sell you shoes and deliver them. We don't sell your data, we don't spam you, and you can download or delete your data any time at your account → My data.

Siena Lisa is operated by Dan Muiru, registered in Nairobi, Kenya. Our Data Protection Officer is reachable at dpo@sienalisa.co.ke.

• Phone number — required. Used as your account ID and for SMS order updates.
• Name — for the rider, the receipt, and us calling you politely.
• Email — optional. Used for receipts and (only with your consent) marketing.
• Delivery addresses — to deliver your order.
• Order history — what you ordered, when, where it went.
• Trust tier — calculated from your history (new / verified / trusted / VIP) — drives how many pairs you can try at a time.
• Recently viewed products— saved on your device only (your browser's localStorage). Never sent to us.

• Passwords. We use phone OTP — there's no password to leak.
• Card numbers. Pesapal handles those — we never see them.
• Your M-Pesa PIN. The STK Push prompt comes directly from Safaricom.
• Location, except where you explicitly grant browser permission.
• Behavioural tracking pixels (no Facebook Pixel, no advertising cookies).

• Contract — phone, name, addresses, order data: necessary to fulfil orders.
• Legal obligation — order records: kept 7 years for KRA tax.
• Legitimate interest — trust tier and fraud rules to prevent order fraud, calibrated to the minimum data needed.
• Consent — only for marketing emails/SMS. We ask explicitly, you can withdraw any time.

We share only the minimum needed with these processors:

• Pesapal — to take your payment. They handle card details under PCI-DSS.
• Africa's Talking — to send your phone the verification code and order updates.
• Supabase — our database host, in the EU. Encrypted at rest.
• Vercel — our app host. They process page requests; never see your raw data.
• Couriers (G4S, Wells Fargo, etc.) — your name, phone, address when you choose courier delivery.

We do not sell your data. Ever.

• OTP codes: 10 minutes, then deleted.
• Login sessions: 30 days, then expire.
• Account data (name, phone, addresses): until you delete the account.
• Order records: 7 years (KRA tax requirement).
• Inactive accounts (no order in 24 months, no login in 6): we'll email you to ask if you want to delete; auto-anonymised after another 6 months if no reply.

• Access — download your data: /account/data
• Rectification— fix anything that's wrong: edit it in your account.
• Erasure — delete your data: same page. Order records are kept (anonymised) for tax law.
• Object — opt out of any processing based on consent: reply STOP to any SMS, or email us.
• Complain — to the Office of the Data Protection Commissioner if you think we've mishandled your data.

We use one essential cookie (your sign-in session, valid for 30 days) and store some preferences in your browser's localStorage (cart, wishlist, recently viewed). We don't set any tracking cookies, advertising cookies, or analytics cookies that identify you.

• HTTPS-only across the site.
• HttpOnly, SameSite=Lax session cookies.
• Database encrypted at rest (Supabase Postgres).
• OTP rate-limited (3 per hour per phone).
• Admin access logged. Customer accounts have separate, scoped access.

We'll update this page when our practices change. Material changes (e.g. adding a new processor) are emailed to active customers.

Questions, requests, or concerns: email dpo@sienalisa.co.ke or WhatsApp us at +254 731 688 073.