OVERVIEW
To access and use the Hilaac Cosmetics app, we may request personal data from you such as your name, email address, phone number and delivery address ("Personal Information"). By downloading, registering, and using the Hilaac app, you consent to the use, processing, and retention of your Personal Data as set out in this policy.
We use Personal Information for business purposes including processing your orders, notifying you of new products and promotions, and improving our service quality. We are committed to keeping your Personal Information secure and accurate.
INFORMATION WE COLLECT
- Full name and contact details (phone number and email address).
- Delivery address and location information.
- Order history and purchase preferences.
- Device information (model, OS version, unique device identifiers).
- Usage data such as screens viewed, features used, time spent in the app.
- Payment confirmation references. We do not store card numbers or M-Pesa PINs.
We collect this information when you register an account, place an order, contact support, or interact with any app feature.
Data retention: we retain personal data for as long as your account is active, or as needed to provide services. Order records are kept for 7 years in compliance with Kenya tax regulations. You may request deletion of your account and data at any time via orders@hilaaccosmetics.ke, or directly in-app under Profile → Settings → Delete Account.
HOW WE USE YOUR INFORMATION
- Process and fulfil orders, and send order confirmations.
- Send delivery updates via SMS and push notifications.
- Respond to enquiries and customer support requests.
- Personalise your shopping experience and recommend products.
- Send promotional offers and newsletters where you have opted in.
- Detect, prevent and address fraud or security issues.
- Comply with legal and regulatory obligations.
We will not use your information for a purpose outside this policy without your prior consent.
INFORMATION SHARING
We share personal information with trusted third parties only to the extent necessary to operate our business:
- Delivery and logistics partners who fulfil your orders.
- Payment processors — Paystack and M-Pesa via Safaricom Daraja — for transaction processing.
- Supabase, for secure data storage and authentication.
- Firebase (Google), for push notifications and crash reporting.
- Resend, for order confirmation and transactional emails.
- Zoho Books, for order and financial record management.
Cross-border transfers: Supabase and Firebase are hosted in the United States. By using the Hilaac app, you consent to your data being transferred to and processed there. All providers are held to adequate data protection standards.
We do not sell, rent or trade your personal information for marketing purposes. We may disclose aggregate, anonymised statistics for business reporting — never anything personally identifying.
PAYMENT INFORMATION
We do not store your card details or M-Pesa PIN on our servers. Card payments are processed through Paystack, a PCI DSS-compliant gateway. M-Pesa payments are processed directly through Safaricom's Daraja API. Hilaac staff will never ask you for your card number, CVV, or M-Pesa PIN through any channel.
DATA SECURITY
All data exchanged between the app and our servers is encrypted in transit using SSL/TLS. Your data is stored on Supabase with restricted access controls and row-level security policies. Access within our team is limited to authorised personnel on a need-to-know basis, and we carry out regular security reviews.
YOUR RIGHTS
- Access — request a copy of the data we hold about you.
- Correction — request we correct inaccurate or incomplete data.
- Deletion — request we delete your account and data.
- Opt-out — unsubscribe from promotional communications at any time.
Contact orders@hilaaccosmetics.ke to exercise any of these rights — we respond within 14 business days. Hilaac Cosmetics complies with the Kenya Data Protection Act 2019 (KDPA) and is registered with the Office of the Data Protection Commissioner (ODPC). You may lodge a complaint with the ODPC if you believe your data rights were violated.
CHILDREN'S PRIVACY
The Hilaac app is not intended for use by persons under 18. We do not knowingly collect data from minors, and will delete any such data promptly if discovered.
COOKIES & ANALYTICS
The mobile app does not use browser cookies. We may use anonymous, aggregated analytics — such as screen views and feature usage — to improve the app. No personally identifiable information is included.
CHANGES TO THIS POLICY
We keep this policy under regular review. Material changes will be communicated via push notification or in-app message before they take effect. Continued use after the effective date constitutes acceptance of the update.