Privacy policy.

SHINA is a small, independently-run business based in Nairobi, Kenya, not yet formally registered as a company. Until it is, the individual trading as SHINA is the data controller for anything covered on this page — reachable at hello@shina.co.ke. This page will be updated with the registered company name if and when that changes.

The site itself collects nothing by default — there's no account system and no checkout form. What we do hold is whatever you send us directly when you place an order or ask a question: your name, phone number, delivery address, and the content of your message, shared with us over WhatsApp, Instagram, or email.

Separately, if you accept the analytics banner shown on this site, Google Analytics collects your approximate location (from your IP address, which isn't stored), your device and browser type, the pages you view, and specific actions — clicking through to WhatsApp, our email address, or one of our social pages. If you decline or ignore the banner, none of this runs and nothing is collected. See Cookies & analytics below for the full detail.

To confirm your order, arrange delivery, and answer what you've asked — nothing more. We don't use it to build a marketing profile, and we don't add you to a mailing list without you asking to be on one.

We keep order details for up to 24 months from your order date, then remove them from our own records — long enough to handle a follow-up question or a returns conversation, not indefinitely. You can ask us to delete your details sooner at any time; see Your rights below.

Your order details stay between you and SHINA. We don't sell, rent, or share your information with third parties, and we don't hand it to advertisers.

If you accept analytics, the anonymised traffic data described below is processed by Google outside Kenya — that's a standard part of how the service works, not something specific to you, and it's covered in more detail in the next section.

We use Google Analytics to understand which pages are useful and which links people actually follow — nothing loads, and no cookie is set, until you click "Accept" on the banner shown on your first visit. Decline or ignore it and Google Analytics never runs for you; that choice is remembered on your device so you won't be asked again.

If you accept: Google Analytics sets a cookie and records the pages you view, your approximate location (derived from your IP address, which Google doesn't retain), your device and browser type, and three specific events we track directly — clicking a WhatsApp link, our email address, or a link to one of our social pages. We've turned off Google Signals, the feature that would otherwise link this to ad personalisation or a cross-device profile, so this data is used for our own analytics only, never for advertising. It's kept for a maximum of 2 months before Google deletes it.

Under Kenya's Data Protection Act, 2019, you can ask what personal data we hold about you, ask us to correct it, or ask us to delete it. Email hello@shina.co.ke and we'll respond directly, generally within two weeks. If you're not satisfied with how we've handled a request, you're entitled to complain to the Office of the Data Protection Commissioner (ODPC), Kenya's data protection regulator.

We take reasonable, proportionate steps to protect what you share with us — limiting who can see order messages, and relying on the security built into WhatsApp, Instagram, and email themselves for the conversation in transit. No system is perfect, and we can't promise more than that in good faith.

If this policy changes, we'll update the date at the top of this page. We won't make a change that expands what we collect without saying so here first.