Privacy

This describes how Mori Electronics handles your information. We have tried to write what actually happens rather than what sounds reassuring.

What we collect

If you buy something

• Your name, phone number and delivery address.
• What you ordered, what it cost, and when.
• A record of the payment. For M-Pesa that is the receipt number and the paying phone number; for a card it is a reference from our payment processor.

Delivery details are copied onto the order at the time you place it. Editing your saved address later does not change where a past order was sent — a receipt has to keep saying what actually happened.

If you make an account

• Your email address and, if you give one, your name.
• Your saved addresses and your wishlist.
• Your order history.

Automatically

• A cart cookie (mori_cart) so your basket survives a page reload before you sign in.
• A discount-code cookie (mori_coupon) if you enter one.
• Your light or dark preference, kept in your browser only. It never reaches us.
• Sign-in cookies, set by our authentication provider, that keep you signed in.
• A count of failed sign-in attempts, so an account cannot be attacked by guessing. This records attempt counts and times, not the passwords tried.

What we never see

• Your card number. Card payments happen on our processor’s own page. The number never touches our servers.
• Your M-Pesa PIN. You approve the prompt on your phone. We only learn that it succeeded.
• Your password. It is handled by our authentication provider and stored only as a hash. We cannot read it, and nobody here can tell you what it is.

When you choose a password we check it against a public list of passwords exposed in known breaches. We do this by sending only the first five characters of a hash of it and comparing the results here — the service on the other end cannot work out your password, or even whether we found a match.

Who else sees your information

• Safaricom — for M-Pesa payments. They see the amount and the paying number, as they must to move the money.
• Our card processor — for card payments, if you use one.
• Our hosting and database providers — they store the data on our behalf and do not use it for anything else.
• Couriers — the name, address and phone number needed to deliver a parcel, and nothing more.

We do not sell your information. We do not share it for advertising. If we are ever legally compelled to hand something over, we will comply with the law and tell you where we are allowed to.

How long we keep it

Orders are kept as long as we may need them for tax, accounting and warranty purposes. Abandoned baskets, expired payment attempts and sign-in attempt counters are cleared automatically by a routine that runs daily. Ask us to delete your account and we will, except where we are required to keep a record of a completed sale.

Your rights

Under Kenya’s Data Protection Act 2019 you can ask us to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete it, subject to the records we must legally keep.
• Stop using it for a particular purpose.

Ask, and we will act on it. There is no form and no fee.

Changes

If this changes materially we will update the date at the top. Continuing to use the shop after a change means you accept it.

Asking us about this

See contact for every way to reach us. Privacy questions get a real answer from a person, not a template.