Privacy Policy

1.Who We Are

MarieChic is a luxury ecommerce platform operated in Nairobi, Kenya.

Where we engage third-party service providers to process data on our behalf, they act as data processors under our instruction and are bound by appropriate data processing agreements.

2.What Data We Collect

Account & Identity Data

When you register or sign in, we collect:

• Full name and email address
• Authentication method (email/password or Google OAuth)
• Google profile data via OAuth: name, email, and Google account ID only if you choose Sign in with Google
• Account creation date and last login timestamp

Order & Transaction Data

When you place an order, we collect:

• Billing name and address
• Shipping name and delivery address
• Items ordered, quantities, and prices
• Order status and fulfilment history

Communication & Newsletter Data

• Email address provided at subscription
• Subscription preferences and opt-in timestamp
• Email engagement metadata (delivery, open status) via our email provider
• Content of messages you send to our support team

3.How We Collect Your Data

We collect personal data through the following means:

• Directly from you when you create an account, place an order, contact support, or subscribe to our newsletter
• Via Google OAuth Google shares limited profile data as authorised by your Google account permissions
• Automatically through session cookies set by Supabase Auth on login, and server-side logs when you interact with the platform

4.How We Use Your Data

We only use your personal data for specific, legitimate purposes. Each activity has a defined legal basis under the Kenya Data Protection Act (2019):

5.Authentication & Session Data

Supabase Auth

Our authentication system is powered by Supabase Auth. When you log in, Supabase issues a secure session token stored as an HTTP-only cookie. This cookie cannot be accessed by JavaScript, protecting against cross-site scripting (XSS) attacks. Sessions expire automatically after inactivity.

Supabase processes your authentication data on our behalf as a data processor. More information: supabase.com/privacy

Google OAuth

If you sign in with Google, we receive only your name, email address, and Google account identifier. We do not receive your Google password and do not access any other Google services — Drive, Gmail, Contacts, or otherwise.

You can revoke our access at any time via myaccount.google.com/permissions. Revoking access will not delete your MarieChic account, but you will need to set a password to continue logging in.

6.Cookies & Session Handling

You can control or delete cookies through your browser settings at any time. Disabling authentication cookies will prevent you from staying logged in.

7.Email Communications

Transactional Emails

We send essential transactional emails as part of operating your account: order confirmations, shipping notifications, payment receipts, password reset emails, and security alerts. These are required to provide the Service and cannot be opted out of while your account is active.

All emails are delivered via Resend. More: resend.com/privacy

Marketing Emails & Newsletter

We send marketing emails only with your explicit consent. You may withdraw consent at any time by clicking Unsubscribe in any marketing email, updating your account preferences, or emailing privacy@mariechicke.com.

8.Third-Party Service Providers

9.Data Retention

10.Security Measures

• Passwords are hashed, plain-text passwords are never stored
• Session tokens use HTTP-only, secure, SameSite cookies to prevent XSS and CSRF
• All data in transit is encrypted via TLS (HTTPS)
• Database access is controlled via Supabase Row Level Security (RLS)
• Password reset tokens are time-limited and single-use

11.Your Rights

Under the Kenya Data Protection Act (2019), you have the following rights regarding your personal data:

To exercise any right, contact privacy@mariechicke.com. We will respond within 21 days.

12.Account Deletion

You may delete your account at any time by:

• Emailing privacy@mariechicke.com from your registered address

On a verified deletion request, we will:

• Delete your profile and authentication credentials within 30 days
• Remove you from all marketing lists immediately
• Retain order records for 7 years as required by law

13.Changes to This Policy

When we make material changes, we will update the effective date, send a notification to registered account holders, and display a prominent notice on the platform. Your continued use of the Service constitutes acknowledgement of the updated policy.

14.Contact Us