Privacy Policy

Last updated: February 2026

1. Who We Are

Skyline Treats is a fast food restaurant based in Nairobi, Kenya (Tom Mboya Street, Nairobi CBD). We operate this website and mobile platform to allow customers to browse our menu and place orders. References to "we", "us" or "our" mean Skyline Treats.

2. What Information We Collect

We collect information you provide directly to us, including:

• Account information: First name, last name, username, email address, and password (stored as a secure hash).
• Profile data: Phone number and location, which you may optionally add.
• Order data: Items ordered, quantities, prices, order status, and order history.
• Payment references: We store M-Pesa phone numbers, wallet addresses, or card-type references as transaction identifiers. We do not store full card numbers or CVV codes.
• Delivery information: Delivery address and GPS coordinates when you use our delivery service.
• Communication: Messages you send via our contact form.
• Google sign-in: If you use Google to sign in, we receive your name, email, and profile picture from Google as permitted by your Google account privacy settings.

3. How We Use Your Information

• To create and manage your account.
• To process and fulfil your food orders.
• To calculate and apply delivery fees based on your location.
• To send order confirmation and status updates.
• To send password reset emails when requested.
• To improve our menu, services and platform.
• To detect and prevent fraud or misuse.

4. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers: Hosting providers (cloud servers) and email delivery services, strictly to operate our platform.
• Payment processors: Mobile money and card networks to process transactions.
• Legal authorities: When required by Kenyan law or a valid legal order.

5. Data Security

We protect your data using industry-standard measures including password hashing (bcrypt), HTTPS encryption in transit, JWT token authentication, and database access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide services. Order history is retained for 3 years for accounting purposes. You may request deletion of your account and personal data at any time by contacting us.

7. Your Rights (Kenya Data Protection Act 2019)

• Right to access your personal data.
• Right to correct inaccurate data.
• Right to request deletion of your data.
• Right to object to processing of your data.
• Right to data portability.

To exercise these rights, email us at privacy@skylinetreats.co.ke.

8. Cookies

We use local storage (not traditional cookies) to store your authentication token and preferences (theme setting, cart items) on your device. These are essential for the platform to function and are not used for advertising tracking.

9. Third-Party Services

Our website uses Google Maps API for location and delivery distance calculations, and Google Fonts for typography. These services are governed by Google's Privacy Policy.

10. Changes to This Policy

We may update this policy occasionally. We will notify you of significant changes by updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance.

11. Contact Us

Questions? Contact us at privacy@skylinetreats.co.ke or visit Tom Mboya Street, Nairobi CBD.