Privacy Policy

When you shop with Mahakhu we collect the details needed to take and deliver your order: your name, phone number, email address (if provided), delivery address, order contents and payment information such as the payment method and transaction ID.

If you create an account we also store your login details and order history. Phone numbers are accepted in local format and may be stored in normalized form — both refer to the same number on your account.

We use strictly necessary cookies to keep you signed in and remember your bag. These sign-in cookies are httpOnly, which means they cannot be read by page scripts — that is a deliberate security choice.

We also use website analytics and advertising measurement (including Google Analytics and Meta Pixel where enabled) to understand which pages and products are popular. You can block non-essential cookies in your browser, but sign-in and checkout may stop working without the necessary ones.

We use your information to process and confirm orders, send OTP verification codes by SMS, arrange delivery, verify payments, prevent fraud, and support you when you message us about an order.

With your consent we may also send offers or new-drop updates. Every promotional message includes a way to opt out, and opting out never affects order or delivery messages.

We share only what is needed to fulfil your order: the courier delivering it (name, phone, address), the payment provider processing it, and the SMS service sending your OTP codes. We never sell your personal data.

Payment screenshots you upload as proof are visible only to our order-support team for verification. Analytics providers receive aggregated, pseudonymous usage data — not your order contents.

We keep order records for as long as needed for delivery, returns, accounting and legal obligations — typically while your account is active plus a reasonable period afterwards.

You can ask for a copy of your data or request deletion of your account and marketing data at any time (see contact below). Some records, such as completed invoices, may be retained where the law requires it, and we will tell you when that applies.

Sign-in uses httpOnly cookies, passwords are stored hashed, and sensitive actions are verified with expiring OTP codes. OTP sending and verification are rate-limited, so repeated requests briefly pause before you can retry.

Never share your OTP or password with anyone — Mahakhu staff will never ask for them. If you suspect misuse of your number or account, message us immediately so we can lock it down.

You have the right to see the personal data we hold about you, correct anything inaccurate, and ask us to delete data we no longer need to keep. You can also object to marketing at any time.

To exercise any of these rights, message us with your account phone number so we can verify it is really you before sharing or changing anything.

Mahakhu is intended for shoppers aged 18 and over, or younger shoppers buying with a parent or guardian. We do not knowingly collect data directly from children.

If this policy changes, the updated version appears on this page with a new “last updated” date. Material changes that affect how we use order data will be highlighted here.

For access, correction or deletion requests — or any privacy question — reach us on WhatsApp 01515 627 598 or through our contact page. Please include the phone number on your account so we can verify your request.