Chefy (“we”, “us”) connects customers with independent chefs who cook and deliver weekly meal plans. This policy explains what personal data we collect, why we collect it, and the choices you have. It applies to our website and to the ordering pages we host for chefs.
Who is responsible for your data
Chefy operates the platform and is the data controller for your account and order data. Each chef you order from receives the details needed to cook and deliver your order, and is responsible for how they use that information in their own kitchen.
What we collect
When you place an order
- Contact details: your name, email address and phone number.
- Delivery details: your delivery address, any notes you add, and the precise latitude/longitude of the drop-off point you select on the map.
- Order details: the meals you chose, the amount charged, and the order's status history.
We use your location coordinates to calculate the delivery fee by road distance from the chef's kitchen, and to show your driver where to go.
If you run a kitchen
- Your name, email, phone number and password (stored only as a salted hash, never in readable form).
- Your kitchen's name, tagline, contact details, and the kitchen location you pin on the map.
- Any profile or cover image you upload.
If you deliver orders
- Your name, email and phone number.
- Live GPS location, but only while you have switched location sharing on. It is shared with the customer whose order you are delivering, so they can watch your progress on a map. Switching sharing off stops the collection immediately.
Automatically
- Essential cookies. A signed, HTTP-only session cookie keeps you logged in, plus a small non-sensitive cookie recording whether you are a customer, chef or driver so we show the right screens. We do not use advertising or cross-site tracking cookies.
- Usage analytics. We use Vercel Analytics to count page views and understand which pages are used. It is privacy-focused and does not use cookies to follow you across other websites.
Payments
Card and mobile-money payments are processed by Paystack. Your card details are entered on Paystack's systems and are never sent to or stored by Chefy. We keep only the payment reference, the amount and whether the payment succeeded.
Who we share data with
We share only what each provider needs to make the service work:
- The chef you ordered from: your name, contact details, delivery address and order.
- Your delivery driver: your name, address and phone number for that delivery.
- Paystack: to take payment.
- Google Maps: address search, map display and road-distance calculation.
- Ably: to deliver live driver location to your tracking page.
- Resend (email) and TextSMS (SMS): to send order and delivery updates.
- Neon and Vercel: database and application hosting.
We do not sell your personal data, and we do not share it for advertising.
How long we keep it
Order records are kept while your account is active and afterwards for as long as we need them for accounting and tax purposes. Driver GPS coordinates are transient. We keep only the most recent position, and it stops updating when sharing is switched off.
How we protect it
Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies that page scripts cannot read. Access to each kitchen's data is scoped so one chef can never see another chef's orders or customers, and a driver can only see the deliveries assigned to them. Traffic is encrypted in transit.
Your rights
Under Kenya's Data Protection Act, 2019 you may request a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Contact us using the details below and we will respond within the period the Act requires. You also have the right to complain to the Office of the Data Protection Commissioner.
Children
Chefy is not intended for children under 18, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date at the top of this page, and tell you directly where the change is significant.
Contact us
Questions about your data, or want to exercise any of the rights above? Email us at privacy@nairobifeast.com.