Privacy policy

The short version

We collect what an order needs and nothing more: your email, your delivery address, and what you bought. We never see or store card numbers. We do not sell data, and we do not share it with anyone except the companies that take the payment and make the parcel.

What we collect

When you buy

• Email address — to confirm the order and send tracking
• Name and delivery address — to make and deliver the parcel
• Phone number, if you give one — some carriers require it for delivery
• What you ordered, the amount and the currency
• A payment reference from Stripe — an identifier such as pi_3Qk…, never a card number

When you create an account

• Email address and a password, stored hashed by Supabase Auth — we never see it
• Your name, and any addresses you choose to save
• Your order history

Automatically

• A cart cookie, so your bag survives a refresh. It holds an identifier, not your details, and is httpOnly — no script on the page can read it.
• A session cookie when you are signed in.
• Server logs containing IP address and request path, kept briefly for security and debugging.

We do not run advertising trackers, and there is no third-party analytics script on this site unless one is explicitly configured and disclosed here.

Who else processes it

• Supabase — the database and authentication behind this shop.
• Stripe — takes the payment. You go to Stripe directly to pay; it tells us only whether it worked.
• Printify and its print partners — receive your name and delivery address in order to produce and ship the parcel. They get nothing else.
• Vercel and Cloudflare — host and serve the site.
• Our email provider — sends order confirmations and tracking.

Each of these is a processor acting on our instructions. None may use your data for themselves.

Why we are allowed to hold it

• Performing a contract — we cannot deliver an order without an address.
• Legal obligation — tax and accounting rules require us to keep records of sales.
• Legitimate interests — preventing fraud, and keeping the site working.
• Consent — marketing email only, and only if you ticked the box. One click unsubscribes, and it does not affect your orders.

How long we keep it

• Order and payment records: seven years, because tax law requires it.
• Account data: until you ask us to delete the account.
• Abandoned carts: 30 days, then removed.
• Server logs: 30 days.

Your rights

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. Write to chat@ikenga.ng and we will reply within 30 days. Deleting an account does not remove the order records tax law requires us to keep, but we reduce them to the minimum.

If you are in the EU or UK and think we have handled this badly, you can complain to your national data protection authority.

Security

Traffic is encrypted in transit. Access to the database is restricted by row-level security, so one customer cannot read another’s orders. Card data never touches our infrastructure. Administrative access is limited to named accounts with an explicit role.

Children

This shop is not intended for children, and we do not knowingly collect their data.

Changes

If this policy changes materially we will say so on this page and update the date at the top. Continuing to use the shop after that means the new version applies.

Contact

Ikenga · chat@ikenga.ng · see also our terms and conditions.