Privacy Policy

This policy explains what personal information Africafe collects when you visit africafe.us or place an order, how we use it, who we share it with, and the choices you have. We keep the list of the companies that process data on our behalf accurate and current — if that list changes, this policy changes with it.

Who we are

Africafe (trading as Africafe.us) is the business responsible for your information. You can reach us at info@africafe.us, (713) 364-3230, or 5829 W. Sam Houston Pkwy N, Ste 306, Houston, TX 77041, United States.

What we collect

• Information you give us: your name, email address, shipping and billing address, phone number, and the contents of your order. If you contact us, we keep your message and our reply.
• Payment information: your card details are entered directly into Stripe’s hosted checkout. We never see or store your full card number — we receive only a confirmation of payment and the last four digits and card type from Stripe.
• Information collected automatically: when you browse the site we and our hosting providers record standard technical data such as your IP address, browser type, the pages you visit, and the date and time — used to serve the site, keep it secure, and diagnose errors.

How we use your information

• To process, ship, and confirm your orders, and to handle returns and refunds.
• To send you transactional messages about your order (confirmation, shipping, delivery, refunds) and to answer your questions.
• To calculate and remit sales tax, keep financial records, and meet our legal obligations.
• To detect and prevent fraud, abuse, and security incidents.
• To send marketing email only if you have opted in — every marketing email has a one-click unsubscribe, and unsubscribing never affects the transactional messages about your orders.

Who we share it with

We do not sell your personal information for money. We share it only with the service providers that make the store run, and only with the data each one needs to do its job. They act on our instructions and may not use your information for their own purposes.

• Stripe — processes payments, calculates tax, and screens for fraud. Receives your name, email, billing and shipping address, and order amount; card details are entered directly with Stripe.
• Resend — sends order and account emails. Receives your name, email, and order details.
• Shippo — buys shipping labels and provides tracking. Receives your name, shipping address, and the package contents and weight.
• Vercel — hosts and serves the website. Receives technical request logs and your IP address.
• Neon — our database; stores orders and account records. Receives your order and account data.
• Cloudflare — serves images and protects the site. Receives technical request data and your IP address.
• Upstash — rate-limiting and abuse prevention. Receives your IP address and request metadata.
• Sentry — error monitoring, so we can find and fix bugs. Receives technical error data, which can include an IP address.
• Google Analytics — measures site traffic and how pages are used, so we can improve the store. Receives a truncated (anonymized) IP address, a cookie identifier, and the pages and actions you view. On by default; you can switch it off in one click on the Your Privacy Choices page, and it never loads when your browser sends a Global Privacy Control signal.

We may also disclose information if the law requires it, to enforce our terms, or in connection with a sale or reorganization of the business — in which case we will require the recipient to honor this policy.

Cookies and tracking

We group cookies and similar technologies into four categories. The first two are always on: the store cannot work without one, and the other records how you arrived. The last two are on by default, and you can switch them off at any time — see “How to switch them off” below.

• Strictly necessary (always on): the cookies that keep your cart and session working, remember your cookie choices, record whether your browser sends a Global Privacy Control signal and whether you are visiting from the United Kingdom, the European Economic Area or Switzerland — both of which decide which cookies we may set at all — and sign administrators in. The site cannot function without these, so they do not require consent and cannot be switched off.
• How you arrived (always on): one first-party cookie, kept for 90 days, records how you reached the store — the page you landed on, the site that referred you, whether you were on a phone or a computer, and any advertising click identifier that was in the link you followed — so we can tell which advertising and which partners actually bring us customers. Your browser cannot read it and no advertising service is sent it while advertising cookies are off. It is set when you arrive and the switches described below do not remove it; to clear it, delete this site’s cookies in your browser or email us and we will erase the record.
• Analytics (on by default): we use Google Analytics to understand how the store is used — which pages are visited and where visitors run into trouble — so we can improve it. We ask Google to anonymize your IP address.
• Marketing (on by default): advertising and measurement pixels that help us reach and understand our audience. The services we may use are listed under “Advertising and measurement services” below; we keep that list current, and any service we have not enabled sets no cookies and sends no data.

How to switch them off

Analytics and advertising cookies go off in one click on the Your Privacy Choices page, which is linked from the footer of every page on this site. We record your choice and keep it, so you only need to make it once per browser, and you can change it again as often as you like. If your browser sends a Global Privacy Control (GPC) signal we treat that as a refusal of analytics and marketing cookies and do not load them — automatically, with nothing for you to click, and regardless of any earlier choice.

Visitors in the United Kingdom, the European Union and the wider European Economic Area, and Switzerland are asked first: there, analytics and advertising cookies stay off until you accept them in the consent banner we show on arrival, and that banner offers two equally legible one-click buttons, side by side, so refusing is exactly as easy as accepting.

Advertising and measurement services

Depending on which advertising or audience-measurement services we have turned on, we may use the providers below. They load by default, and when they load they may set their own cookies and receive your device and browsing information to measure advertising and build audiences. None of them loads — and none sets a cookie or sends any data — while we have not enabled it, after you switch advertising off on the Your Privacy Choices page, or when your browser sends a Global Privacy Control (GPC) signal. For visitors in the United Kingdom, the European Union and the wider EEA, and Switzerland, none of them loads until you accept. Google Analytics, listed above, is an analytics service and loads under the analytics category instead.

• Meta Pixel — measures advertising performance and builds audiences for Meta (Facebook and Instagram) advertising.
• Pinterest Tag — measures conversions and builds audiences for Pinterest advertising.
• Google Ads — measures conversions and builds remarketing audiences for Google advertising.
• TikTok Pixel — measures conversions and builds audiences for TikTok advertising.
• Microsoft UET — the Microsoft Advertising (Bing) conversion and remarketing tag.
• LinkedIn Insight Tag — measures conversions and builds audiences for LinkedIn advertising.
• Snap Pixel — measures conversions and builds audiences for Snapchat advertising.
• Reddit Pixel — measures conversions and builds audiences for Reddit advertising.

Unless you have switched advertising off, some of these services act as advertising partners with whom your information may be “shared” for cross-context behavioral advertising, as those terms are defined by California and Texas law. We never receive money for it. You can stop it at any time on the Your Privacy Choices page, which switches analytics and advertising cookies back off in one click, or by sending a Global Privacy Control (GPC) signal, which we honor.

Measuring a purchase

When an order is paid we report the sale to the advertising services above, so we can tell which advertising actually works. It happens two ways, and the second is the one worth being plain about:

• From your browser. On the order-confirmation page the Google Ads tag reports the order total, the currency and the order number. Any other tag that is enabled records that page view the same way it records any other page. Switching advertising off, or sending a Global Privacy Control signal, stops this the same way it stops every other tag.
• From our server. We may also report the sale to Meta directly from our own server, which means blocking cookies in your browser does not by itself stop it. We keep that report to the minimum needed to match the sale: the order total and currency, a one-time order reference used to avoid counting the same sale twice, and your email address hashed — converted into an irreversible string of characters — so Meta can match an existing customer record of its own without us handing over your actual email address. We do not send the contents of your order, your address, or any payment details.

The server-side report is governed by exactly the same switch as everything else on this page: it is not sent if you switched advertising off on the Your Privacy Choices page, nor if your browser sent a Global Privacy Control (GPC) signal, nor for a visitor in the United Kingdom, the European Union and the wider EEA, or Switzerland who has not accepted. We read that switch at the moment you check out and store the answer with the order, so the report reflects what was true when you bought.

Your privacy choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and get a copy of it;
• correct information that is wrong;
• delete your information (we may keep anonymized order and tax records we are legally required to retain);
• opt out of any sharing of your information for targeted advertising.

To make a request, email info@africafe.us or use the Your Privacy Choices page. We respond within 45 days. We will never treat you differently for exercising these rights. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of sharing for advertising.

California and Texas residents

California (CCPA/CPRA) and Texas (TDPSA) residents have the rights described above, including the right to opt out of the “sale” or “sharing” of personal information. We do not sell your personal information for money. We do share it for targeted advertising by default: the advertising and measurement services listed under “Cookies and tracking” above are on unless you turn them off, and that sharing is what California and Texas law call “sharing” for cross-context behavioral advertising. You can opt out at any time, free and without creating an account, in one click on the Your Privacy Choices page — linked from the footer of every page — or by sending a Global Privacy Control (GPC) signal, which we recognise as a universal opt-out mechanism and honor automatically. We never treat you differently for opting out. You may exercise your rights through the same contacts above, and you may designate an authorized agent to act for you.

How long we keep information

We keep your account and order information for as long as your account is active or as needed to provide the store. Financial and order records are kept for at least four years to meet tax and accounting obligations. When you ask us to delete your information, we remove or anonymize it except where we are required to retain a record.

How we protect it

We use encryption in transit, restrict access to the people and services that need it, protect the administrator console with two-factor authentication and an audit log, and keep card handling out of our own systems by using Stripe’s hosted checkout. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

Children

The store is intended for adults. We do not knowingly collect personal information from children under 13, and we will delete it if we learn we have.

Visitors outside the United States

We are based in the United States and process information here. If you order from another country, you understand that your information will be handled in the United States, and we will honor access and deletion requests wherever you live.

Changes to this policy

If we change this policy we will update the date shown at the top of this page, and for material changes we will give notice on the site. Continuing to use the store after a change means you accept the updated policy.

Contact us

Questions about your privacy? Email info@africafe.us or call (713) 364-3230.