Store information
Privacy Policy
Effective date: 2026-10-15
REQUIRES CONTROLLER IDENTITY, PROCESSOR REVIEW AND QUALIFIED LEGAL APPROVAL
1. Who is responsible
The storefront display name is Tync systems Inc.; the registered legal entity/data-controller identity is not established by the application settings. The configured postal address is P.O BOX 11637-0040. A dedicated privacy contact is not configured. Until confirmed, privacy requests can be submitted through the Privacy Request page or Contact page; the controller must provide a verified contact before approving this policy.
2. Information handled
Depending on how you use the store, the application handles account names, email, phone, password hashes, email verification and remember-token data; checkout name, email, phone, cart contents, product options, delivery/pickup choice and location; order, receipt, tax, payment-status and submitted manual M-Pesa reference data; contact-form name, email, phone, subject and message; newsletter email and consent status; and limited technical/session/browser-storage information described in the Cookie Policy. Do not send card details through the manual M-Pesa receipt field.
3. Purposes and legal bases
The application uses account and order details to create and secure accounts, respond to checkout requests, verify order/payment references, fulfil or arrange pickup/delivery, provide order updates and support, and maintain transaction records. Depending on the applicable law and purpose, processing may be necessary for steps requested before a contract or performance of a contract, a legal obligation, or a documented legitimate interest such as service security and fraud prevention. Optional browser storage and promotional email are enabled only after the relevant consent. The controller must confirm and document each applicable legal basis before publication; consent is not asserted as the basis for every activity.
4. Recipients and providers
Store staff who handle orders and support can access relevant records. Transactional messages are sent through PHPMailer using SMTP settings configured by the store or application environment. The active SMTP provider, hosting/database provider, their locations, contractual terms and any other recipients have not been verified. Manual M-Pesa receipt references are checked by the store's internal workflow; no live card processor or automated M-Pesa gateway was found in the active checkout configuration. Delivery arrangements may involve a carrier chosen by the store, but no carrier integration is present in the inspected code. The controller must complete this recipient/processor list before approval.
5. Transfers and locations
The application's configured production origin is blank in the active settings, and hosting, SMTP and database locations are not established by source code. International transfers and safeguards therefore require provider and hosting review; no transfer representation should be made until confirmed.
6. Retention
The code records timestamps but does not define a complete retention schedule. Information should be retained only while needed for the stated purpose and applicable accounting, tax, security, dispute or legal-claim requirements, then deleted or de-identified where appropriate. The controller must set and document actual periods/criteria with its accountant and legal adviser before approval. Privacy requests do not automatically erase records the business must lawfully retain.
7. Security
The application uses password hashing, prepared statements in the reviewed ecommerce flows, CSRF tokens on checkout/account/contact forms, and session/remember-token controls. No method can guarantee absolute security. The shared configuration contains hard-coded fallback secrets and session cookie settings needing production review; credential rotation and secure environment configuration are required before deployment. Report a suspected privacy or security issue through the Contact page while a dedicated privacy contact is established.
8. Your rights and requests
Depending on applicable law, you may request access, correction, deletion where applicable, restriction, objection, withdrawal of consent, or raise a complaint. Submit a request using the Privacy Request page. The store may need to verify identity before disclosing or changing account/order data and may retain records where legally required. No request is automatically fulfilled by this form; it creates a reviewable case for authorized staff.
9. Children and automated decisions
The reviewed account flow is not configured as a child-directed service; age safeguards and applicable age rules require owner/legal confirmation. The application performs routine checks such as email verification, stock/availability checks and manual payment-reference review. No consequential profiling or automated legal/significant decision-making was identified in the inspected storefront flow.
10. Changes and effective date
Published revisions will show a version and effective date. This draft reflects the code/settings reviewed on 2026-10-15 and must be updated when providers, purposes, jurisdictions or retention rules change.
Draft effective date: 2026-10-15. This draft is not legal advice and is not approved for final publication.
1. Who is responsible
The storefront display name is Tync systems Inc.; the registered legal entity/data-controller identity is not established by the application settings. The configured postal address is P.O BOX 11637-0040. A dedicated privacy contact is not configured. Until confirmed, privacy requests can be submitted through the Privacy Request page or Contact page; the controller must provide a verified contact before approving this policy.
2. Information handled
Depending on how you use the store, the application handles account names, email, phone, password hashes, email verification and remember-token data; checkout name, email, phone, cart contents, product options, delivery/pickup choice and location; order, receipt, tax, payment-status and submitted manual M-Pesa reference data; contact-form name, email, phone, subject and message; newsletter email and consent status; and limited technical/session/browser-storage information described in the Cookie Policy. Do not send card details through the manual M-Pesa receipt field.
3. Purposes and legal bases
The application uses account and order details to create and secure accounts, respond to checkout requests, verify order/payment references, fulfil or arrange pickup/delivery, provide order updates and support, and maintain transaction records. Depending on the applicable law and purpose, processing may be necessary for steps requested before a contract or performance of a contract, a legal obligation, or a documented legitimate interest such as service security and fraud prevention. Optional browser storage and promotional email are enabled only after the relevant consent. The controller must confirm and document each applicable legal basis before publication; consent is not asserted as the basis for every activity.
4. Recipients and providers
Store staff who handle orders and support can access relevant records. Transactional messages are sent through PHPMailer using SMTP settings configured by the store or application environment. The active SMTP provider, hosting/database provider, their locations, contractual terms and any other recipients have not been verified. Manual M-Pesa receipt references are checked by the store's internal workflow; no live card processor or automated M-Pesa gateway was found in the active checkout configuration. Delivery arrangements may involve a carrier chosen by the store, but no carrier integration is present in the inspected code. The controller must complete this recipient/processor list before approval.
5. Transfers and locations
The application's configured production origin is blank in the active settings, and hosting, SMTP and database locations are not established by source code. International transfers and safeguards therefore require provider and hosting review; no transfer representation should be made until confirmed.
6. Retention
The code records timestamps but does not define a complete retention schedule. Information should be retained only while needed for the stated purpose and applicable accounting, tax, security, dispute or legal-claim requirements, then deleted or de-identified where appropriate. The controller must set and document actual periods/criteria with its accountant and legal adviser before approval. Privacy requests do not automatically erase records the business must lawfully retain.
7. Security
The application uses password hashing, prepared statements in the reviewed ecommerce flows, CSRF tokens on checkout/account/contact forms, and session/remember-token controls. No method can guarantee absolute security. The shared configuration contains hard-coded fallback secrets and session cookie settings needing production review; credential rotation and secure environment configuration are required before deployment. Report a suspected privacy or security issue through the Contact page while a dedicated privacy contact is established.
8. Your rights and requests
Depending on applicable law, you may request access, correction, deletion where applicable, restriction, objection, withdrawal of consent, or raise a complaint. Submit a request using the Privacy Request page. The store may need to verify identity before disclosing or changing account/order data and may retain records where legally required. No request is automatically fulfilled by this form; it creates a reviewable case for authorized staff.
9. Children and automated decisions
The reviewed account flow is not configured as a child-directed service; age safeguards and applicable age rules require owner/legal confirmation. The application performs routine checks such as email verification, stock/availability checks and manual payment-reference review. No consequential profiling or automated legal/significant decision-making was identified in the inspected storefront flow.
10. Changes and effective date
Published revisions will show a version and effective date. This draft reflects the code/settings reviewed on 2026-10-15 and must be updated when providers, purposes, jurisdictions or retention rules change.
Draft effective date: 2026-10-15. This draft is not legal advice and is not approved for final publication.