Privacy policy

1. Who we are

PhinCart is operated by Phincart E-commerce LTD, a company registered in Uganda (registration number 80043862694344), based in Ntinda, Nakawa Division, Kampala, Uganda. We are responsible for your personal data under the Data Protection and Privacy Act, 2019.

2. What we collect

• Order details: your name, phone number, email address (optional), delivery area, landmark and delivery notes, the items you order and how you pay.
• Your account, if you sign in with Google: your name and email address from Google, your saved address and your wishlist. We never see your Google password.
• Call-back requests: your name, phone number, the best time to call and your question, sent only when you ask us to call you.
• Payments: Mobile Money and card payments are handled by Pesapal, our licensed payment provider. We receive the payment result, never your PIN or full card number.
• App notifications: if you allow notifications in the PhinCart app, a code from your phone that lets us send them. You can turn them off at any time in your phone's settings.
• Technical data: your IP address and the type of browser or phone you use, to protect the shop from abuse (for example, too many requests in a short time) and to find and fix errors.

3. Why we use it

• To process, deliver and track your orders, and contact you about them.
• To send order updates by email when you give an email address, and as app notifications if you allow them.
• To decide whether cash on delivery is available for your account and phone number, based on your earlier deliveries.
• To answer your questions and call-back requests.
• To prevent fraud and misuse, and to meet our legal and tax obligations.

We do not sell your personal data, and we do not send marketing messages without your consent.

4. Who we share it with

We share only what each service needs to do its job for us:

• Our riders: your name, phone number and delivery address, to deliver your order.
• Pesapal, our licensed payment provider, to take Mobile Money and card payments: your name, phone number, email address (if you give one) and the amount to pay.
• Supabase (database and sign-in) and Railway (website hosting), which store and run the shop.
• Cloudflare, which protects the shop from attacks and helps pages load quickly. Every visit passes through Cloudflare, which sees your IP address and the pages you open. It also counts visits and measures page speed for us, without cookies.
• Sentry, which tells us when something breaks on the website or in the app. It receives the error, the page, the type of browser or phone and your IP address, but never your name, phone number or address.
• Resend, which sends our order emails, and Hostinger, which hosts our email inbox ([email protected]).
• Expo, Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), which deliver PhinCart app notifications to your phone if you allow them.
• Google, when you choose to sign in with Google.
• WhatsApp, when you choose to message or call us there.
• Authorities, when the law requires it.

Some of these services store or process data on servers outside Uganda, for example in Singapore, Germany and the United States. We use providers that protect data to a standard at least equal to Ugandan law.

5. Google sign-in data

You can create a PhinCart account by signing in with your Google account. This section explains exactly how we handle the data Google shares with us.

• What we receive: only your basic profile: your name, your email address and a link to your Google profile picture. We do not request access to your Gmail, contacts, calendar, Drive files or any other Google data, and we never see your Google password.
• How we use it: to create your PhinCart account, sign you in, show your name in your account, and send order updates to your email address. We don't use your profile picture.
• Who we share it with: nobody, except Supabase, which stores our accounts and handles sign-in for us. We never sell Google user data, and we never use it for advertising or to build advertising profiles.
• How long we keep it: as long as you have a PhinCart account. Delete your account yourself in My account (or ask us, see section 11) and we delete your Google profile data, keeping only order records the law requires.
• Removing access: you can disconnect PhinCart at any time from your Google account at myaccount.google.com/connections.

PhinCart's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and data on your device

When you sign in, a cookie keeps you signed in. Your cart, wishlist and recently viewed products are saved in your browser on your device. Google's sign-in button may set its own cookies when you use it. We don't use advertising cookies.

7. How long we keep it

We keep order records for as long as Ugandan tax and accounting law requires, and delete call-back requests once they are no longer needed (within 12 months). If you close your account, we delete your account details but keep your order records for that legal period.

8. Your rights

Under the Data Protection and Privacy Act, 2019, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or out of date;
• delete your data, where we don't have to keep it by law;
• stop using your data for a purpose you object to.

Contact us and we will reply within 30 days. If you are not happy with our answer, you can complain to the Personal Data Protection Office.

9. Keeping your data safe

The shop uses encrypted connections (HTTPS). Only our staff who need your details to run your order can see them, each with their own sign-in. We will never ask for your Mobile Money PIN or card PIN.

10. Children

We sell children's clothing to adults. The shop is not meant for children under 18, and we don't knowingly collect their personal data.

11. Contact and changes

For privacy questions or requests, WhatsApp or call +256 786 322 408 or email [email protected]. We may update this policy; the date below shows the latest version. See also our Terms.

Last updated 30 October 2026.