Privacy policy

Who is responsible for your data

The business behind PrintSap, in Nairobi, Kenya, is the data controller for everything described here. That means we decide what is collected and why, and we are the ones you can hold to account.

A contact address for data questions has still to be set — see the note at the top of this page.

What we collect, and why

When you order, with or without an account

Your name, email address, phone number and delivery address; what you ordered, in what size and colour; the artwork you designed; and the Paystack reference for your payment.

We need this to make the thing you bought and get it to you. In the language of the Act, the lawful basis is performance of a contract — we cannot fulfil an order without it.

We never see your card or M-Pesa details. Payment happens on Paystack’s own pages. What comes back to us is a reference, an amount and whether it succeeded.

When you open an account

Your email address and a password we never store in readable form. If you sign in with Google, we receive your email address and name from Google, and no password at all.

You can save addresses and designs to your account. Those are yours, and deleting them deletes them.

When you sell

Your store name and its web address, your products, and the bank or mobile-money account you are paid into. Payout details are held by Paystack as a subaccount; we hold the reference to it, not the account number.

When you just visit

Our host records ordinary server logs — IP address, page, time, browser — which is how we see that the site is working and how we would investigate abuse. The lawful basis is our legitimate interest in keeping the service up and safe.

Your basket lives in your own browser until you check out. It is not sent to us and is not linked to you.

What we do not do

We do not sell your data. We do not share it for anyone else’s advertising. We do not run advertising or analytics trackers, and we set no cookies beyond the one that keeps you signed in.

We do not send marketing email unless you ask us to. The emails you get are about your own order: confirmation, printed, shipped, delivered.

Who else sees your data

Only these, and only what each one needs:

• Our print partner in Nairobi — the order reference, what to make, the size, the colour and the artwork. Not your name, address, phone number or email. Their console reads from an endpoint that returns only production details, because a printer does not need to know who you are to print a shirt.
• The courier — your name, address and phone number, so they can deliver.
• Paystack — your email and the amount, to take the payment.
• Supabase — our database and file storage.
• Vercel — our hosting.
• Resend — our email sending.
• The seller, when you buy from a storefront — that a sale happened, what sold and what they earned. Not your name or address.

Supabase, Vercel and Resend store data outside Kenya. Where the Act requires it, those transfers rely on the providers’ standard data protection terms.

We would also hand over data if the law required it — a court order, or a properly made request from a regulator.

How long we keep it

• Orders and their artwork — seven years, which is how long tax records must be kept.
• Your account — until you close it.
• Saved designs and addresses — until you delete them, or you close your account.
• Server logs — as long as our providers keep them, typically weeks.
• A basket you never checked out — it stays in your browser and never reaches us.

Closing your account does not delete orders you have already placed. We are required to keep those records, and they stop being linked to a live account.

What you can make us do

Under the Data Protection Act 2019 you have the right to:

• See what we hold about you.
• Correct anything wrong.
• Delete it, except where we must keep it — order records, mainly.
• Object to a use of it, or ask us to restrict that use.
• Take it with you, in a form another service can read.
• Withdraw consent where consent is what we relied on.

Ask at the address above, once it is set. We will answer within 30 days. We will not charge you, and we will not treat you differently for asking.

If you are not satisfied with how we handle it, you can complain to the Office of the Data Protection Commissioner in Kenya, at odpc.go.ke.

Keeping it safe

Traffic to the site is encrypted. Passwords are stored hashed, by our authentication provider, and are not readable by us. Access to the database is limited by rules that tie each row to the account that owns it, so one customer’s orders are not reachable by another.

An email address is only linked to past guest orders once the address has been confirmed by clicking a link we sent to it — so signing up as someone else does not get you their order history.

No system is perfect. If there is a breach that puts you at risk, we will tell you and the Commissioner, as the Act requires.

Children

PrintSap is not for children under 18. We do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

Changes to this policy

If we change it in a way that matters, we will tell account holders by email before it takes effect. The date it came into effect is at the top of this page.

Contact

Data questions: address to be set. Everything else: address to be set, or the contact page.

In effect from 30 September 2026.