Privacy Policy

This Privacy Policy describes how the Easybox × Zucchini WhatsApp ordering service (the "Service") collects, uses, and shares your information when you place an order through our WhatsApp business number or visit our web surfaces at mantlepos.co.ke. The Service is operated by Zucchini as a prototype for digitally-enabled grocery fulfilment in Nairobi, Kenya.

If anything here is unclear, contact us — see Contact below.

1. Information we collect

We collect the minimum information needed to take and fulfil your order:

• Your WhatsApp identity — your phone number and the profile name WhatsApp shares when you message us.
• Order content — the items you add to your cart, quantities, language preference (English or Swahili), and any notes you send the bot.
• Delivery details — the delivery address or location pin you share so the rider can find you, plus optional delivery notes.
• Payment metadata — confirmation of payment status (paid / failed / refunded). We never see, store, or transmit your card number, CVV, or M-Pesa PIN — those stay between you and the payment processor.
• Service logs — timestamps and request IDs are recorded so we can debug issues. Server logs redact tokens, card data, signatures, and cookies before storage.
• Ratings — if you choose to rate an order after delivery, we store the star rating and any comment you submit.

2. How we use it

• To take your order and walk you through cart, checkout, and delivery.
• To assign your delivery to a rider and let you track the rider in real time on mantlepos.co.ke/o/<token>.
• To charge or refund you through your chosen payment method.
• To send you order status updates over WhatsApp (accepted, dispatched, en route, delivered, refund issued, etc.).
• To improve the catalogue and service quality based on aggregated patterns.

3. Who we share it with

We do not sell your information. We share strictly what each partner needs to complete your order:

• WhatsApp / Meta Platforms, Inc. — to deliver messages between you and the Service. Subject to WhatsApp's Privacy Policy.
• Safaricom (M-Pesa Daraja) — when you pay via M-Pesa, the transaction is processed by Safaricom. We send them the amount, your phone number, and a reference; they handle the STK Push and notify us of the result.
• Paystack — when you pay by card, you are redirected to Paystack's PCI-compliant hosted page. Your card details go to Paystack directly; we only receive the success/failure result.
• Easybox — for delivery dispatch and live rider tracking. We share your name, phone number, delivery address, and the order summary so the rider can complete the drop-off.
• DigitalOcean — our infrastructure provider; data is stored on servers they operate.

We do not share data with advertising networks.

4. Retention

We retain order records and their audit trail for as long as you remain an active customer, plus a reasonable period afterwards for accounting and dispute resolution. WhatsApp session data (cart, conversation state) lives in Redis with a rolling 24-hour TTL — it expires automatically if you stop interacting.

5. Your rights

You can ask us at any time to:

• Send you a copy of the data we hold about you.
• Correct anything that's wrong.
• Delete your account and order history.
• Stop sending you WhatsApp notifications.

Email us at levikangogo19537@gmail.com with the request. We respond within 30 days.

6. Security

We use TLS (HTTPS) for every connection between you, our servers, and our payment and dispatch partners. Webhooks from Meta, M-Pesa, Paystack, and Easybox are verified with cryptographic signatures before we trust them. Staff access to the operations dashboard requires authentication, with short-lived access tokens that can be revoked at any time.

7. Children

The Service is not directed at children under 13, and we do not knowingly collect information from them.

8. Changes to this policy

We may update this policy occasionally. If we make a material change we'll update the effective date above and, where appropriate, message you on WhatsApp.

9. Contact

Questions, data requests, or account deletion: email levikangogo19537@gmail.com.