Privacy Policy

When you order: your name, phone number, delivery address and, if you give it, your email. When you create an account: your email and a password we never see in plain text. When you subscribe: your email.

Automatically: the pages you visit, roughly where you are (country/city level) and basic device information, used to keep the site working, measure how it's used and see which of our adverts bring people here. See "Cookies and storage" below for what runs only with your consent.

To deliver your order and tell you where it is. To send a receipt and order updates. To answer your questions. To email offers only if you've subscribed — every email has an unsubscribe link.

We don't sell your data. We share it only with the companies we need to run the shop: our delivery partners, our payment providers (Safaricom M-Pesa and Pesapal), our hosting and database providers (Vercel and Supabase), our email sender (Resend), and — if you accepted them — Google Analytics and Meta. Some of these store data outside Kenya.

Card details never touch our servers — they're handled entirely by the payment provider. For M-Pesa we store the phone number you paid from and the transaction reference so we can match your payment to your order.

Essential storage, always on: a small amount of browser storage keeps your cart, wishlist and recently-viewed items, plus a session cookie if you sign in. Nothing here is shared with anyone.

Measurement, always on: Vercel Web Analytics counts page views and measures loading speed. It sets no cookies, doesn't follow you between sites and doesn't identify you.

Analytics and advertising, only with your consent: if you choose "Accept all" on the cookie notice, we may load Google Analytics (how the site is used) and the Meta pixel (whether our Instagram and Facebook ads work). Choose "Essential only" and neither loads at all.

You can change your mind at any time: use the button at the bottom of this page, or clear this site's data in your browser.

Order records stay for 7 years, because tax law requires it. Newsletter subscriptions stay until you unsubscribe. If you ask us to remind you about an unfinished checkout, we keep that saved cart (your name, phone, email and items) for 30 days and then delete it. Account data stays until you ask us to delete the account.

Under Kenya's Data Protection Act, 2019 you can ask what we hold about you, correct it, have it deleted, object to how we use it, or ask for a copy. Email support@evafit.co.ke and we'll action it within 14 days, free of charge.

If you're not happy with how we've handled your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

EVΛFIT, Nairobi, Kenya. support@evafit.co.ke.