TrioCraft Brands Ltd (“TrioCraft,” “we,” “us,” “our”) provides branding, printing, design, and production services through triocraft.org and the Production Marketplace (together, the “Service”). This policy explains what personal information we collect, why, how we use and share it, and the choices and rights you have.

It applies to visitors to our website, people who submit a brief or contact us, and registered marketplace accounts — both retail and corporate/B2B.

Information We Collect

Account information. When you register — with an email and password, or by signing in with Google — we collect your name and email address. If you set up a corporate account, we also collect your company name, phone number, KRA PIN (for tax-compliant invoicing), and the credit-account details we verify before extending payment terms.

Google sign-in. If you choose “Continue with Google,” our authentication provider, Clerk, handles the sign-in with Google and shares your name and email address with us so we can create or recognize your account. We never receive your Google password, and we only request the minimum information needed to identify you.

Order and brief information. When you place an order, request a quote, or submit a custom brief, we collect the details you provide — product specifications, quantities, delivery instructions, deadlines, and any text or files describing what you want produced.

Brand Vault uploads. Logos, brand guidelines, artwork, and other files you upload so we — and, where relevant, the production partner fulfilling your order — can use them to complete your work.

Payment information. We do not collect or store your M-Pesa PIN, mobile money PIN, or full card details. Mobile money and bank transactions are processed directly by Safaricom (M-Pesa), MTN Mobile Money, or Airtel Money; we receive only a transaction reference, phone number, amount, and status, which we use to confirm and reconcile your payment.

Communications. Messages you send us through our contact form, WhatsApp, or email, including anything you tell us in them.

Technical information. Our website uses one cookie that isn’t optional: a session cookie that keeps you signed in. We don’t use third-party advertising or analytics trackers. We do load Google Fonts from Google’s servers to display our typography, which means your browser makes a request to Google when you visit — Google’s own privacy policy covers that request.

How We Use Your Information

To create and manage your account, process and fulfil orders, generate quotations and tax-compliant invoices, communicate with you about your order (including via WhatsApp and email), verify and administer corporate credit accounts, detect and prevent fraud or abuse, and improve the Service.

If you use AI Assist on the Custom Brief form, the text you type is sent to Anthropic’s Claude API to help structure it into a clearer brief. We don’t send this to Anthropic for anything beyond that one-time request, and it’s processed under Anthropic’s own data-handling terms, acting as a processor on our instructions.

Who We Share Information With

We share personal information only where it’s needed to run the Service:

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Google User Data — Limited Use Disclosure

Information we receive via Google Sign-In is used solely to create and maintain your TrioCraft account and to let you sign in. We do not use it to serve ads, and we do not transfer it to any party except as described in this policy, or as required to provide and improve the Service, comply with the law, or with your consent. TrioCraft’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention

We keep account and order records for as long as your account is active, and for the period required by Kenyan tax and company law afterward (generally seven years for financial/tax records). Brand Vault files are kept for as long as your account exists, or until you ask us to delete them, whichever is sooner. You can ask us to close your account and delete your personal information at any time — see “Your Rights” below.

International Transfers

Some of the providers above — Clerk, Google, Anthropic, Meta — may process your data on servers outside Kenya. Where this happens, we rely on those providers’ own contractual and security safeguards to protect your information consistently with Kenya’s Data Protection Act, 2019.

Your Rights

Under Kenya’s Data Protection Act, 2019, you have the right to know what personal data we hold about you and why; access a copy of it; have inaccurate data corrected; request deletion or restriction of your data; object to certain processing; receive your data in a portable format; and withdraw consent at any time where we rely on it. To exercise any of these, email us at [email protected] or message us on WhatsApp at +254 111 206 420. If you’re unhappy with how we’ve handled your data, you also have the right to lodge a complaint with Kenya’s Office of the Data Protection Commissioner (odpc.go.ke).

Children’s Privacy

The Service is intended for businesses and individuals old enough to enter a binding contract. We don’t knowingly collect personal information from children.

Security

We use industry-standard safeguards — encrypted connections (HTTPS), hashed passwords, and access controls — to protect your information. No system is completely secure, and we can’t guarantee absolute security.

Changes to This Policy

We may update this policy as our services or legal obligations change. We’ll update the “last updated” date above, and for material changes, we’ll let registered users know by email.

Contact Us

Questions about this policy or your data: [email protected] · WhatsApp +254 111 206 420 · TrioCraft Brands Ltd, Nairobi, Kenya.