YOUR INFORMATION
Privacy policy
Effective date: 2026-09-08
Last updated: 2026-10-14
Kien Luxury Brands Private Limited
5 Lomagundi Drive, Avondale, Harare, Zimbabwe
info@kienapp.com
Who is responsible
This policy covers the Kien website and iPhone and Android apps. Kien Luxury Brands Private Limited, 5 Lomagundi Drive, Avondale, Harare, Zimbabwe, is responsible for your personal information. Contact info@kienapp.com, addressed to Kelly Karanda, for privacy enquiries. We fulfil purchases only in Zimbabwe; someone overseas may buy for a recipient in Zimbabwe.
Information we collect and why
Account details: your name, email, account identifier and authentication information let us create and secure your account. Supabase handles password authentication. Google sign-in supplies the account information you authorise Google to share; Kien does not receive your Google password. Our basis for necessary account processing is providing the service you request.
Purchases: we record purchased items, quantities, prices, payment references and statuses, and contact and delivery details. We use these to take and fulfil your order, provide support and handle returns or disputes. Required transaction records are also kept to meet legal obligations. Paynow collects payment credentials on its own checkout; Kien does not collect card numbers or payment PINs.
Recipients: when you buy for another person, you provide their name, phone number and destination. Give them this policy and provide only details you are entitled to share. We use recipient details to arrange delivery or collection and related support. Our legitimate interest is completing the requested delivery; recipients may contact us directly about their information.
Enquiries: we process your name, email and message to answer you and keep necessary correspondence. This supports your requested service and our legitimate interest in handling enquiries. Please do not send passwords, payment credentials or sensitive personal information in messages.
Security and operation: hosting, authentication and security providers process network addresses, device/browser information, timestamps and request or delivery logs. We use limited security counters and audit records to prevent abuse, investigate problems and protect accounts. Our basis is our legitimate interest in a reliable, secure service. We do not use customer information for advertising, sell personal information or build advertising profiles.
Providing account and checkout details is necessary for those services. You can browse and save a bag or wishlist without signing in. We do not request a date of birth, identity document or your device’s GPS location as part of ordinary shopping.
Apple sign-in and account deletion
On iPhone, you may choose Sign in with Apple. Apple provides an account identifier and the name and email you choose to share. If you choose Hide My Email, we receive an Apple relay address instead of your personal email, and Apple forwards messages sent to that address. Apple processes authentication and relay communications under its own privacy policy. We do not receive your Apple password or biometric data. We use this information to provide the sign-in service you request.
To disconnect Apple authorization when you delete your account, we exchange a one-time Apple authorization code on our server and keep an encrypted Apple refresh token linked to your customer identifier. Access is restricted to backend services; these credentials are excluded from customer data downloads and are never used for advertising. We retain a hash of the authorization code to recognise retries, not the code itself. This processing supports account security and the deletion service you request.
Account deletion triggers an attempt to revoke the Apple token. If Apple or the network is unavailable, the Kien account can still be deleted while the encrypted token and the identifiers needed to revoke it remain in a restricted retry queue. Trigger.dev retries through our daily privacy job; the credential record is erased when revocation succeeds. For an older sign-in without a stored token, deletion still completes, but you may need to remove Kien in your Apple Account’s Sign in with Apple settings. Deleting Kien does not delete your Apple Account.
Agreement records
We record the terms and privacy policy versions you accept, the time, the entry method and the platform used. Account agreement records are removed when the account is deleted. The version and acceptance time attached to an order follow that order’s retention period. These records help administer our contract and demonstrate the choices made; they are not advertising consent.
Service providers and other recipients
Supabase stores accounts, catalogue and order data and supplies authentication. Our Supabase database is hosted in the United States (US East). Vercel hosts the website and API. Upstash Redis holds short-lived security counters and deduplication identifiers. Cloudflare provides Turnstile security checks.
Resend sends account, contact and order emails. Namecheap hosts the info@kienapp.com mailbox and its correspondence. Trigger.dev runs background email delivery, payment checks and retention cleanup; scheduled commerce tasks receive record identifiers and fetch the data needed for their task. Database email queues temporarily contain recipients and message content.
Google provides optional sign-in and address suggestions; address lookup sends your search to Google, and route calculations help determine Harare delivery charges. We retain the destination and agreed delivery instructions, not Google route coordinates in the order. Paynow processes payments and supplies transaction references and statuses under its own privacy terms.
Authorised Kien staff and delivery or collection partners receive the information needed to serve you. We may disclose relevant information when legally required, to resolve a dispute or protect rights and security. A business transfer may involve records under appropriate confidentiality safeguards and any required notice. Service providers may have subprocessors and their own legal duties.
International processing
Although fulfilment is in Zimbabwe, providers may process information in the United States and other countries where they and their subprocessors operate. Those countries’ privacy laws and government access powers may differ from yours. A database region does not mean that every service, support operation or log remains in that region.
Where applicable law requires international-transfer safeguards, the relevant provider agreements and legally available safeguards must apply, including standard contractual clauses where appropriate. Contact us for information about the safeguards relevant to your data. We do not describe Zimbabwe as having an EU or UK adequacy decision, and using the service is not blanket consent to otherwise unlawful transfers.
How long information is kept
Accounts: we keep your profile while your account remains open. Deleting it removes the customer sign-in and the account’s shopping data on the device making the request. Deletion does not automatically erase records needed for an outstanding delivery, payment issue, dispute or legal obligation.
Delivery details: completed orders normally lose recipient names, phone numbers, addresses, place identifiers and free-form delivery notes after 90 days. Account deletion brings this cleanup forward for completed orders. Unpaid cancelled, expired or failed orders lose identifying details after 90 days, or earlier following account deletion, once no stock or payment issue remains.
Core transaction details: purchase history, transaction amounts, dates and the purchaser’s email may remain for six years after the end of the year in which the paid order was completed, subject to a longer unresolved dispute or documented legal hold. We then remove the account link and identifying details from our operational order records. Internal accounting procedures are maintained separately.
Email copies: database copies of sent emails are removed after 30 days; undelivered copies are kept for no more than one year for follow-up. Our mailbox retention standard is 12 months after an enquiry is resolved, unless correspondence is needed for an ongoing case or required transaction record. Resend’s standard email and log retention is 30 days. Copies already received by you or another recipient are outside our control.
Other records: security rate counters expire within their short configured windows, and contact deduplication identifiers expire after 24 hours. Completed background-job records are removed after 30 days; staff account-management audit events after one year. Unresolved security, delivery or payment cases and documented legal holds are reviewed separately before deletion.
Cleanup runs daily, so removal may occur on the next daily run after a period ends. Provider-managed backups and operational logs expire under the relevant service’s retention cycle and legal requirements; individual records may not be removable from an existing backup immediately. Backups are restricted to recovery, and applicable deletion and retention rules must be reapplied after restoration. Export downloads are generated on request without a public download link; you control copies you save or share.
Your choices and privacy rights
Our Delete account page at www.kienapp.com/delete-account lets you request account and associated data deletion without signing in or reinstalling the app. Requests are emailed to Kien and acknowledged by email. We verify ownership before acting; submitting the form does not automatically delete an account. The retention periods and exceptions above still apply.
In Account, you can edit your profile, change your password, delete your account and download account and order data, including shopping data saved on the device making the export. The download does not include information stored only on other devices or all correspondence and security records. You can request those separately.
Email info@kienapp.com to request access, a copy, correction or deletion, or to raise an objection, request restricted processing, withdraw consent where relevant or ask about portability. You do not need an account or a special form. We also recognise requests received through our other contact channels. Provide enough information to locate your records; we ask for further identity checks only where reasonably necessary and send information securely.
We aim to respond within 30 days and within one calendar month where GDPR requires it, or sooner where applicable law requires. If an extension or an exception applies, we explain the reason and applicable timing. Requests are normally free. We will explain any lawful refusal or restriction, available appeal and complaint routes. Withdrawing consent does not affect earlier lawful processing or processing on another lawful basis.
You can ask Kelly Karanda at info@kienapp.com to review our response. We do not discriminate against you for exercising privacy rights. If you are a delivery recipient, have closed your account or cannot sign in, use the same email route. Account deletion is not a promise to erase every legally retained transaction immediately.
Customers in other countries
Depending on which law applies, EEA and UK residents may have GDPR rights including access, correction, erasure, objection, restriction and portability, and the right to complain to their competent data protection authority. We do not make solely automated decisions producing legal or similarly significant effects; automatic security checks and delivery-price calculations may be queried through our contact address.
Canadian customers may request access and correction and challenge our handling of information. We explain relevant purposes and overseas service processing, and seek meaningful consent where required. You may complain to the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including Québec, British Columbia or Alberta, as applicable.
US residents may have rights to access, correct, delete or obtain portable information, and to appeal a refusal, under applicable state law. California disclosures include identifiers and contact details, account credentials, commercial purchase records and internet/device activity described above. Sources are you, the purchaser arranging your delivery, sign-in/payment providers and service operation. We do not sell personal information, share it for cross-context behavioural advertising or use sensitive information to infer characteristics about you. An authorised agent may contact us; reasonable proof of authority and identity may be required. State-law rights depend on the law’s applicability and exceptions.
In Zimbabwe, privacy enquiries and complaints may also be directed to POTRAZ as the Data Protection Authority.
Adults only
Accounts and purchases are for people aged 18 or older. Please do not create an account or place an order if you are under 18. If you believe a child has supplied personal information, contact info@kienapp.com so we can investigate and remove it where appropriate. Buying children’s products does not require providing a child’s personal details.
Security and changes
We use encrypted connections, access controls, account verification and limited staff access to protect information. No system can guarantee absolute security. We assess incidents and notify affected people and authorities when required by applicable law.
We update this page when our practices change. The effective date identifies the current version; material changes will be brought to your attention where required, and any required new consent will be sought before the new use. This is the same policy opened from the website and both mobile apps.
Useful privacy contacts
EEA authorities · UK ICO · Canada OPC · California · POTRAZ