Privacy Policy

1. Who we are

Muthoni's Bake House is a bakery business based in Nairobi, Kenya, operating this website and an AI order assistant to help customers browse our cakes, get pricing, and place orders. For the purposes of the Data Protection Act, 2019, Muthoni's Bake House is the data controller responsible for your personal data.

We are registered with the Office of the Data Protection Commissioner (ODPC), Kenya. Our registration details are available on request by emailing privacy@muthonibakehouse.co.ke.

2. What personal data we collect

We collect personal data in a few specific ways:

• AI order assistant & WhatsApp orders: the messages you send our chat assistant, and — once you confirm an order and are handed off to WhatsApp — your name, phone number, delivery address, and order details (cakes, sizes, quantities) as you share them with us there.
• Newsletter sign-up: your name, email address, birthday (day and month only), and favourite treat, if you sign up for our newsletter. This is sent to and stored by Mailchimp on our behalf.
• Website usage data: basic, aggregated analytics about how visitors use our site (e.g. pages viewed, general device/browser type), collected via Vercel Analytics. We do not use invasive third-party advertising trackers.
• Communications: any messages, enquiries, or feedback you send us directly, by WhatsApp, email, or social media.

We do not currently process online payments through this website. Orders are confirmed and paid for directly with us via WhatsApp (e.g. cash or M-Pesa arranged at that time). If we introduce in-site payments in future, we will update this policy before that feature goes live.

3. Our AI order assistant

When you chat with our AI order assistant, your messages are sent to Anthropic PBC, a United States-based AI provider, to generate a response. Anthropic processes this content on our behalf as a data processor and does not use it to train their models on our behalf. We only ask the assistant to look up our cake catalogue, pricing, and categories, and to prepare a WhatsApp order summary when you confirm one — it does not make any binding decisions about you, and every order it prepares still requires your final confirmation via WhatsApp before it is accepted.

4. Why we process your data (our lawful basis)

• To fulfil your order — performance of a contract with you, once you place an order.
• To respond to enquiries — our legitimate interest in providing customer service, or your consent where you contact us voluntarily.
• To send our newsletter — your consent, given when you sign up. You can withdraw this at any time (see Section 7).
• To operate and improve our website and AI assistant — our legitimate interest in running a functioning, secure, and useful service.
• To comply with the law — e.g. tax and accounting record-keeping obligations.

5. Who we share your data with

We share personal data only with the service providers (data processors) who help us run the business, and only as needed for the purposes above:

• Sanity — hosts our product catalogue and site content.
• Anthropic — processes your AI order assistant conversations to generate responses (see Section 3).
• Mailchimp (Intuit) — manages our email newsletter list.
• Vercel — hosts this website and provides basic analytics.
• WhatsApp / Meta— used for order communication, subject to WhatsApp’s own privacy policy once a conversation moves there.

We do not sell your personal data to anyone, and we do not share it with third parties for their own marketing purposes.

6. International data transfers

Some of the service providers listed above are based outside Kenya, principally in the United States. Where we transfer personal data outside Kenya, we do so on the basis permitted by Section 48 of the Data Protection Act, 2019 — including where the transfer is necessary for the performance of a contract with you (e.g. generating an AI assistant reply or sending a newsletter you signed up for), or with your consent, and we choose service providers who maintain appropriate contractual and technical safeguards for personal data.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

• be informed of how your personal data is used (this policy);
• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• object to or restrict processing, and request erasure of your data, including unsubscribing from our newsletter at any time (every newsletter email includes an unsubscribe link);
• request a copy of your data in a portable format; and
• object to any processing that could cause you unwarranted damage or distress, or that involves solely automated decision-making with legal or similarly significant effects on you (our AI assistant does not make such decisions — see Section 3).

To exercise any of these rights, email us at privacy@muthonibakehouse.co.ke. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya, at odpc.go.ke if you believe we have not handled your data properly.

8. How long we keep your data

We keep order-related personal data for as long as needed to fulfil your order and, after that, for up to seven years where needed for accounting and tax record-keeping under Kenyan law. Newsletter data is kept until you unsubscribe or ask us to delete it. AI order assistant conversations are used only to generate a response and are not retained by us beyond what is needed to complete your order.

9. Cookies and similar technologies

We use Vercel Analytics to understand overall site traffic in an aggregated, privacy-conscious way. We do not currently use third-party advertising cookies or cross-site tracking.

10. Children’s privacy

Our services are intended for adults placing bakery orders. We do not knowingly collect personal data from children, and if we become aware that we have, we will delete it.

11. Data security

We use reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS) between your browser and our website, restricted access to the systems that store your data, and keeping API keys and credentials out of our public source code.

12. Changes to this policy

We may update this policy from time to time, for example as our services change. The “Last updated” date at the top of this page reflects the most recent version, and we will highlight any material changes here.

13. Contact us

For any questions about this policy or your personal data, contact us at privacy@muthonibakehouse.co.ke or via WhatsApp at +254 714 207 074.