Blyss
Legal

Privacy Policy

Privacy Policy

Last updated: 26 May 2026

This Privacy Policy explains how Blyss Limited ("Blyss", "we") collects, uses, stores, and shares your personal information when you use blyss.co.ke and our related services. We've written it in plain English. If something here is unclear, email [email protected] and we'll explain.

Blyss is operated from Nairobi, Kenya. We comply with the Kenya Data Protection Act, 2019, and where it applies, the EU GDPR.

1. What we collect

When you create an account, we collect:

  • Your email address
  • A name (yours or your store's)
  • A password hash if you use email + password (we never see your password)
  • OAuth profile info (name, email, avatar) if you sign in with Google

When you list products as a Seller, we collect:

  • Identity verification documents (national ID, KRA PIN, business registration where relevant)
  • Linked phone number for M-Pesa payouts
  • Bank account details if you payout via card networks
  • Tax information where required by law

When you make a purchase as a Buyer, we collect:

  • Email address
  • Payment instrument metadata (last 4 digits of card, M-Pesa phone number, transaction reference) — we never store full card numbers; Paystack handles that
  • IP address and approximate location (for fraud prevention)
  • Order history

Automatically when you visit the site, we collect:

  • IP address, browser type, device type, referrer URL
  • Pages visited, time on page, clicks (via PostHog analytics)
  • Error and crash reports (via Sentry)
  • Cookies — see Section 5

2. Why we collect it

We use your data to:

  • Operate the platform: authenticate you, take payments, deliver products
  • Comply with legal obligations (KYC, tax, anti-money laundering)
  • Detect and prevent fraud, spam, and abuse
  • Improve the product (anonymized analytics)
  • Send transactional emails (receipts, payout notifications, support replies)
  • Send product updates and marketing emails — only if you opt in, and you can unsubscribe at any time

We do not sell your personal information. Ever.

3. Who we share it with

We share data only with:

  • Payment processors (Paystack, M-Pesa via Safaricom) to process transactions
  • Email infrastructure (Resend) to send transactional emails
  • Analytics providers (PostHog) to understand product usage in aggregate
  • Error monitoring (Sentry) to fix bugs
  • Hosting (Cloudflare, Oracle Cloud Infrastructure) for site delivery
  • Government authorities and regulators when legally required

Sellers and Buyers see each other's first name and store name in connection with a transaction. Buyers' email addresses are shared with the Seller they purchase from, so the Seller can fulfil and support the order.

4. How long we keep it

  • Active account data: as long as your account is open
  • Transaction records: 7 years after the transaction (tax law requirement)
  • KYC documents: 5 years after account closure
  • Marketing email lists: until you unsubscribe
  • Server logs: 30 days
  • Backups: rotated out within 90 days

You can request deletion of personal data that isn't required by law to retain — see Section 6.

5. Cookies

We use cookies for:

  • Session management (polar_session) — required to keep you logged in
  • Analytics (distinct_id) — anonymized PostHog ID, opt-out via cookie banner
  • Cart state — stores your local shopping cart

Cookies marked "required" cannot be disabled because the site won't work without them. Optional analytics cookies can be declined via the cookie banner on first visit.

6. Your rights

If you're in Kenya or in a jurisdiction with comparable data protection law, you have the right to:

  • Access the personal data we hold about you
  • Correct anything that's wrong
  • Delete your data (subject to legal retention requirements)
  • Port your data to another service in a machine-readable format
  • Object to processing for marketing
  • Withdraw consent for any optional data use, at any time

To exercise these rights, email [email protected] from the address on your account. We respond within 30 days.

If you're unhappy with how we handled your request, you can lodge a complaint with the Office of the Data Protection Commissioner in Kenya: odpc.go.ke.

7. Security

We protect your data with:

  • TLS 1.3 for all connections
  • Hashed passwords (bcrypt)
  • Encrypted database backups
  • 2FA available on all accounts (recommended for Sellers)
  • Regular dependency updates and security patches
  • Restricted internal access on a need-to-know basis

No system is perfectly secure. If a breach affects you, we'll notify you within 72 hours of confirming it, as required by Kenyan law.

8. Children

Blyss is not intended for anyone under 18. We don't knowingly collect data from children. If you believe a minor has created an account, email [email protected] and we'll remove it.

9. Cross-border transfers

Some of our service providers (Resend, Sentry, Cloudflare) operate from outside Kenya. When we send your data to them, we use providers with appropriate data protection commitments (Standard Contractual Clauses, certifications). Your data primarily stays on Oracle Cloud Infrastructure in Frankfurt or our Kenyan partners.

10. Changes to this policy

We may update this Privacy Policy as Blyss evolves. Material changes will be emailed to all account holders at least 14 days before they take effect.

Contact

[email protected] — Privacy questions and rights requests [email protected] — Security issues and disclosures [email protected] — General support

Blyss Limited Nairobi, Kenya