Privacy & Cookies Policy

1. Who is responsible for your information?

NomadRocks is a small independent T-shirt venture operated by Teddy Mworia in Thika, Kenya. For the purposes of this policy, “NomadRocks”, “we”, “us” and “our” mean the person and business responsible for deciding how your personal information is used.

If you have a privacy question or want to exercise a right described below, email [email protected]. Please use the subject line Privacy request and include enough information for us to identify the relevant order or interaction safely.

2. Information we collect

We collect information you choose to give us and information generated while you use the Shop. The exact information depends on what you do.

Information you provide

• Order and contact details: your name where supplied, email address, phone number, Telegram details, chosen delivery station, receipt contact method, notification choices and package message.
• Order details: the rocks, sizes, finishes, quantities, delivery selection, order number and status information connected with your order.
• Payment proof: when you submit or paste an M-Pesa confirmation, it can contain a transaction code, payer name and phone number, amount, time and other text included in the confirmation message. We use it to match and confirm the correct payment. We do not collect or store card numbers through the Shop.
• Messages and contributions: support messages, Emmy chat messages, order reviews and any images or other material you submit with a review. Review text is checked during submission. Customer photos are moderated separately; rejected photos stay private and are not served on the public Reviews page.
• Verification information: the verification codes or links, and the status of email, SMS or Telegram contact verification. Telegram may also provide a Telegram user ID, chat ID, username and the contact number you choose to share through the bot.

Information generated when you use the Shop

• Shop identifiers and activity: an NMD customer identifier, Rocks Cart, Pouch selection and order continuity information, selected size, viewed product and checkout state.
• Technical and security information: information normally sent by a browser or generated by website infrastructure, such as IP address, device/browser details, requested pages, date and time, and security or error logs.
• Cookies and browser storage: the small files and browser-storage entries described in section 7 below.

3. How and why we use information

We use personal information only where there is a clear purpose. In particular, we use it to:

• show the Shop, remember your selected size and keep your Rocks Cart, Pouch selection and order journey working;
• create, administer, fulfil and support an order, including arranging delivery to the station you select;
• verify a contact method, send a receipt, and send the order updates you choose in your notification preferences;
• receive, screen and reconcile M-Pesa payment proof, investigate duplicate or suspicious payment claims, and protect customers and NomadRocks from fraud;
• answer questions and provide Emmy, our AI-assisted Shop helper;
• publish or moderate reviews and comments, where the relevant Shop feature makes them visible;
• maintain security, troubleshoot errors, prevent misuse and improve the reliability of the Shop; and
• meet legal, tax, accounting, regulatory and record-keeping obligations.

We generally process information because it is needed to provide a service or take steps you request, because we have a legitimate operational or security need that does not override your rights, because we must meet a legal obligation, or because you have given consent. We ask for consent where it is required, including before sending optional new-design updates. You can withdraw consent at any time; this will not affect processing already carried out lawfully before withdrawal.

4. Emmy and AI-assisted chat

When you use Emmy, the Shop sends your chat messages, current Shop page and relevant Shop context to our server so Emmy can answer in context. Emmy is powered using OpenAI services, so that information may be sent to OpenAI to generate a response. NomadRocks associates one persistent OpenAI conversation with your pseudonymous NomadID so Emmy can continue the same conversation across later Shop visits. The local chat display also keeps a short recent transcript in your browser session.

Clearing the NomadID cookie and local storage breaks this browser’s association with that conversation; it does not itself erase the server-side mapping or the conversation stored by OpenAI. A later order import can replace a temporary NomadID with the imported NomadID. Where both identifiers already have conversations, the imported NomadID’s conversation remains the active one and the histories are not merged.

Please do not use Emmy to send passwords, national ID numbers, card details or other information that is not needed for your question. M-Pesa confirmation text should only be shared when the Shop asks you to provide it for payment proof. Automated suggestions from Emmy are not final payment, delivery or stock confirmations; the Shop’s verified order records control those outcomes.

5. When we share information

We do not sell, rent or trade personal information, and we do not use the Shop for behavioural advertising. We share information only when it is reasonably necessary for the purposes above, including with:

• providers that host, secure, maintain or support our website and records;
• OpenAI, when you use Emmy;
• Mailtrap for email delivery and email-verification messages, and Mobitech for SMS delivery and verification;
• Telegram, if you choose Telegram as a receipt contact method and use our Telegram bot;
• Jumia and other delivery partners as needed to fulfil delivery to the station you select;
• professional advisers, insurers or debt/fraud-prevention parties where necessary to protect rights, safety or property; and
• government authorities, regulators or law enforcement where disclosure is required by law or necessary to establish, exercise or defend a legal claim.

Service providers may use information only to provide their service to us or to you, subject to their own applicable terms and privacy notices. We share the minimum information reasonably required for the task.

6. International transfers

Some service providers, including AI, messaging, email, hosting or support providers, may process information from locations outside Kenya. Where this happens, we will make the transfer only as permitted by applicable data-protection law and use appropriate safeguards for the nature of the transfer. You can ask us about the relevant category of recipient by contacting us using the details above.

7. Cookies and similar technology

Cookies are small text files saved by your browser. Browser storage has a similar role but is managed by the browser rather than sent with every request. NomadRocks currently uses these tools to make the Shop function, remember choices, prevent repetitive interface prompts and measure aggregated daily use of the website. The current Shop code does not load NomadRocks advertising or third-party analytics cookies.

You can clear or block cookies and browser storage through your browser settings. Blocking essential cookies or storage can stop parts of the Shop, checkout, receipt contact or order continuity from working correctly. Because the current storage is necessary for Shop operation rather than optional advertising or analytics, there is no separate cookie-preferences switch. If we introduce optional cookies in future, we will update this policy and provide an appropriate choice before using them.

8. How long we keep information

We keep information only for as long as it is reasonably needed for the purpose for which it was collected. This includes keeping order, payment, delivery, customer-service and notification records for the time needed to fulfil the order, handle questions, prevent fraud, resolve disputes and meet applicable tax, accounting and legal obligations.

We retain reviews while they remain relevant to the Reviews feature, unless they are removed or a longer period is justified. Emmy conversations are retained to provide continuing assistance across Shop visits while their NomadID mapping remains active. Browser-session display information is generally removed when the session ends, but ending a browser session or clearing browser storage does not itself delete the server-side Emmy conversation. When information is no longer needed, we will delete it, anonymise it or securely isolate it where retention is required by law.

9. Security

We use reasonable administrative, technical and organisational measures designed to protect information from unauthorised access, loss, misuse, alteration or disclosure. Access is limited to people and service providers who need it for the purposes in this policy. No internet, email, mobile-network or storage system is completely secure, so we cannot promise absolute security. Please contact us promptly if you believe information connected with NomadRocks has been compromised.

10. Your privacy rights and choices

Subject to applicable law, including Kenya’s Data Protection Act, 2019, you may ask to:

• be told whether we hold personal information about you and receive access to it;
• correct information that is inaccurate, incomplete, misleading or out of date;
• delete information that is false, misleading, unnecessary or excessive, where the law permits;
• object to, or ask us to restrict, certain processing, including direct marketing;
• withdraw consent for optional processing, such as new-design updates; and
• receive personal information you provided in a structured, commonly used, machine-readable form where the law gives that right.

To make a request, email [email protected]. We may ask for proportionate information to verify that the request is genuinely yours before we act on it. We will respond within the period required by applicable law, and explain if we cannot fully comply because we must keep information for a lawful reason.

If you are unhappy with how we handle your information, please contact us first. You may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner (ODPC).

11. Children’s privacy

The Shop is not designed to knowingly collect personal information from children without the involvement of a parent or guardian. If you believe a child has provided personal information to us without appropriate authority, contact us and we will review the information and take appropriate action.

12. Changes to this policy

We may update this policy when our Shop, data practices or legal requirements change. We will publish the revised version on this page and update the “Last updated” date. For material changes, we will take additional steps where required by law.