Privacy Policy

1. What we collect

When you use rushburgers.co.ke or create a My Rush account, we may collect:

• Account information: name, email address, phone number, birthday (optional), and — if you sign in with Google — your Google profile picture.
• Order information: items ordered, delivery address, payment method, order history, and the kitchen timings attached to your order's status updates.
• Device information: browser type, device type, operating system, IP address.
• Usage data: pages visited, time spent, clicks, referral source.
• Push tokens: if you enable push notifications, we store the device subscription needed to deliver them (you can turn this off anytime in settings).
• Location data: approximate delivery area (from your provided address, not GPS tracking).

2. How we use it

• To process and deliver your orders.
• To create and manage your My Rush account and Rush Club membership.
• To send order confirmations, delivery updates, and receipts.
• To send birthday rewards (if you provided your birthday) and leaderboard updates.
• To send promotional emails and campaign messages (only if you have opted in via notification preferences).
• To improve our menu, service, and website experience.
• To measure and improve preparation and delivery times — we aggregate this per delivery area (never GPS), so ETAs and service get honest instead of guessed.
• To detect and prevent fraud, abuse, or multiple-account violations.
• To comply with legal obligations.

3. Email notifications

We send transactional emails (order confirmations, delivery notices) that are essential to your order. These cannot be opted out of while you have an active account.

Marketing emails (promotions, new offers, birthday reminders, leaderboard updates) are optional. You can manage your preferences at any time in My Rush → Settings → Email notifications.

4. Push notifications

Push alerts (order updates, offers) are fully optional and off until you turn them on. Enabling them stores only the device subscription token needed to deliver the alert — tied to the contact you registered with. Turning the toggle off in My Rush settings removes the subscription from our system.

5. Data sharing

We do not sell your personal data. We may share limited data with:

• Delivery partners: your name, phone, and delivery address to complete your order.
• Payment processors: to handle M-PESA and card payments securely.
• Infrastructure providers: hosting, email delivery, and analytics services that help us operate the platform.
• Law enforcement: when required by law, court order, or to protect our rights.

6. Data storage & security

Your data is stored on secure cloud infrastructure (Supabase, hosted on AWS). We use industry-standard encryption for data in transit (TLS) and at rest. Access to your personal data is restricted to authorised personnel only.

We retain your data for as long as your account is active. When you delete your account, we remove your personal information within 30 days, except where we are legally required to retain certain records (e.g., financial transactions for tax purposes).

7. Cookies & local storage

We use local storage on your device to remember your bag, your saved contacts, and your login session — these are essential for the shop to work and do not require consent.

With your permission (the cookie banner — Accept all), we also record anonymous product views and bag adds to improve our menu. These events carry a random session id only: no name, phone, email, or account is attached. Choose Essentials only and nothing analytical is ever recorded. You can change your mind anytime by clearing this site's storage in your browser, which resets the banner.

We do not use third-party advertising trackers.

8. Your rights

• Access: you can view your profile data in My Rush → Settings.
• Update: you can edit your name, phone, email, area, and birthday at any time.
• Delete: you can delete your account from My Rush → Settings → Forget me. This is permanent.
• Opt out: you can disable marketing emails in My Rush → Settings → Email notifications.
• Data request: to request a copy of all data we hold about you, email inforushburgers@gmail.com.

9. Birthday data

Your birthday is entirely optional. If provided, it is used solely to send you a birthday reward once per calendar year. You can change or remove your birthday at any time in settings, unless the birthday reward for the current year has already been claimed. We do not share birthday data with third parties.

10. Children's privacy & age

Our service is for customers aged 18 and above. Customers under 18 may only use rushburgers.co.ke with the permission and supervision of a parent or guardian, who is responsible for any data shared. In line with the Kenya Data Protection Act, 2019, we do not knowingly collect personal data directly from children. If you believe a child has provided us with personal data without the required consent, contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the website. Continued use of the service after changes constitutes acceptance.

12. Contact

For privacy-related questions or data requests, contact us at inforushburgers@gmail.com or WhatsApp +254 793 598 945.