This policy explains what personal information Tshanku collects when you use our store, why we collect it, and how we protect it.

To fulfil an order we collect your name, email address, phone number and delivery address (with optional map coordinates you choose during address lookup). If you create an account we also store your password in a securely hashed form — we never store or see your actual password. Your cart and sign-in session are stored on your own device.

We use your information to process and deliver your orders, contact you about your order, and — if you have an account — show you your order history and send you order-status notifications in the app. We do not sell or rent your personal information to anyone.

If you pay with M-Pesa, your payment is processed by the payment provider on its own secure page. We receive confirmation of the payment (including the M-Pesa transaction reference and the phone number used to pay) but never your M-Pesa PIN.

Order and delivery details are shared only with the people and services needed to get your order to you (for example our delivery personnel and, for M-Pesa orders, the payment provider). Our data is hosted with reputable cloud providers.

We keep order records for as long as we need them for accounting, warranty and dispute purposes. You can ask us to delete your account and associated personal information at any time via the Contact page.

You may ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, in line with the Data Protection Act 2011 of Lesotho. Contact us via the Contact page to make a request.