Privacy Policy

    Last updated: July 15, 2026

    1. Who we are (Data Controller)

    StreetChaos, operator of streetchaoss.space, is the data controller for personal data collected through this website.

    Contact: okelojnr@acyn.world
    Location: Nairobi, Kenya

    2. What we collect

    You give us

    • Name, email, phone number (account, bookings, shipping).
    • Shipping address (merch orders).
    • Payment details are handled by Pesapal — we never see or store card numbers.
    • Profile info you add (bio, avatar).

    Collected automatically

    • Auth session cookie, cookie-consent preference, UI preferences.
    • Server logs (IP, user-agent, timestamps) for security and abuse prevention.

    We do not run advertising trackers, analytics pixels, or third-party marketing scripts unless you opt in via the cookie banner. Today none are configured — the opt-in is a future-proof gate.

    3. Why we use it & legal basis

    PurposeLegal basis (GDPR)
    Provide the account, fulfil beat/merch/studio ordersContract (Art. 6(1)(b))
    Send order/booking confirmation emails & SMSContract (Art. 6(1)(b))
    Newsletter / marketing updatesConsent (Art. 6(1)(a)) — opt-in only, revocable anytime
    Security, fraud, abuse prevention, server logsLegitimate interest (Art. 6(1)(f))
    Accounting / tax recordsLegal obligation (Art. 6(1)(c))
    Outbound brand partnership pitches (B2B)Legitimate interest (Art. 6(1)(f)) — every message has a working unsubscribe

    4. Automated processing

    We operate automated agents that (a) plan content, (b) research publicly listed brand contacts, and (c) draft outbound partnership emails. No decision made by these agents has a legal or similarly significant effect on you as an individual. You can opt out of any pitch at any time via the unsubscribe link in the email.

    5. Who we share it with (Processors)

    • Supabase — database, authentication, storage. Data may be processed in the EU/US under appropriate safeguards (SCCs).
    • Pesapal (Kenya) — payment processing.
    • Resend (US) — transactional email delivery, under SCCs.
    • TalkSasa (Kenya) — SMS delivery.

    We do not sell or rent your personal data.

    6. International transfers

    Some processors are outside Kenya/EU. Where required, transfers rely on Standard Contractual Clauses (SCCs) or equivalent safeguards provided by the processor.

    7. How long we keep it

    DataRetention
    Account & profileUntil you delete your account
    Orders, invoices, purchases7 years (Kenyan tax law)
    Server & auth logs90 days
    Newsletter subscriptionUntil you unsubscribe
    Brand outreach opt-outsKept indefinitely so we never re-contact you

    8. Your rights

    Under Kenya's Data Protection Act 2019 and (where it applies) the EU/UK GDPR, you can:

    • Access the personal data we hold about you.
    • Correct inaccurate data.
    • Request deletion ("right to be forgotten").
    • Restrict or object to processing.
    • Receive your data in a portable format.
    • Withdraw consent (marketing) at any time.
    • Lodge a complaint with a supervisory authority.

    Exercise any right by emailing okelojnr@acyn.world with the subject "Privacy request". We reply within 30 days.

    Complaints: Kenya — Office of the Data Protection Commissioner (ODPC). EU/EEA — your local Data Protection Authority.

    9. Security

    All traffic uses HTTPS. Authentication uses secure session tokens. Card details never touch our servers — Pesapal handles them under PCI DSS.

    10. Cookies

    Details in our Cookie Policy. You can change your choice any time from the "Cookie settings" link in the footer.

    11. Children

    streetchaoss.space is not directed at children under 13. We do not knowingly collect their data.

    12. Changes

    We'll update the date at the top when this policy changes and re-prompt for consent if the change is material.

    ← Back to Home