Privacy policy

Who we are

M's Sweet Bakes & Treats (“we”) is a home bakery in Mombasa, Kenya, near Masjid Tawba. This policy explains what information we collect through our website (mssweetbakes.co.ke) and our Android app, and how we use it. Questions? WhatsApp or call us on 0799 511 960.

Information we collect

• Account details — your name, username, email address, phone number and password (stored securely as a hash by our sign-in provider).
• Order details — the cakes you order, flavours, sizes, the message on the cake, add-ons, your collection or delivery date, and for deliveries your delivery zone, address and instructions.
• Payment confirmations — the M-Pesa transaction code and amount you submit so we can check your payment. We never see or store your M-Pesa PIN, and payments are made by you directly through M-Pesa.
• Technical data — the minimum needed to keep you signed in (a sign-in token stored on your device). We do not use advertising or tracking SDKs, and we do not collect your location, contacts, photos or files.
• Notification token — if you allow notifications in our app, a device token from Google Firebase Cloud Messaging so we can send alerts about your orders to your phone. It is removed when you sign out or delete your account, and you can turn notifications off at any time in your phone settings.

How we use it

• To create and manage your account.
• To bake, prepare and deliver your order, and to contact you about it (including by phone or WhatsApp).
• To verify M-Pesa payments and keep accurate financial records.
• To notify you about your orders — for example when your payment is confirmed, your cake is being baked or is ready, and a reminder the day before.

Sharing

We do not sell your information. It is stored with our hosting and database provider (Supabase), who processes it on our behalf. Phone notifications are delivered by Google Firebase Cloud Messaging, which receives your device token and the text of the notification. Your delivery details may be shared with the rider delivering your cake. We may disclose information if required by Kenyan law.

Security & retention

Data is encrypted in transit (HTTPS) and access is restricted to the bakery. We keep your account until you delete it. Records of completed orders are kept for our financial records, without your personal details once your account is deleted.

Your rights & deleting your account

You can view and update your details at any time in your account. You can delete your account in the app (Account → Delete my account) or by following the steps on our account deletion page. Under Kenya's Data Protection Act, 2019, you may also ask us for a copy of your data or to correct it.

Children

Our services are intended for adults placing orders. We do not knowingly collect information from children under 13.

Changes

If we change this policy we will update the date below and, for significant changes, let you know in the app or by email.