Privacy Policy

Our Commitment

Tree of Africa™ is committed to protecting your privacy. We collect only what we need, use it only to serve you, and never sell, rent, or trade your personal information to any third party — ever.

Information We Collect

• Order information — name, shipping address, email, and phone number when you place an order.
• Payment information — processed securely by Stripe. We never see or store your full card number, CVV, or banking details.
• Contact form submissions — your name, email, and message when you reach out to us.
• Cart data — stored locally in your browser (localStorage) only. It never leaves your device until checkout.
• Usage data — standard server logs (IP address, browser type, pages visited) used solely for security and performance monitoring.

How We Use Your Information

• To process and fulfill your orders.
• To communicate with you about your order status or your inquiries.
• To improve our website and product offerings.
• To comply with legal obligations.

We do not use your data for advertising profiles, behavioral targeting, or any form of data brokering.

Third-Party Services

We use a small number of trusted services to operate our store:

Each provider is bound by their own privacy policy and applicable data protection law. We do not authorize any of them to use your data for their own marketing.

Data Retention

Order records are retained for up to 7 years to comply with tax and accounting regulations. Contact form submissions are retained for up to 12 months. You may request deletion at any time (see below).

Your Rights

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request erasure of your personal data (subject to legal retention obligations).
• Opt-out — we do not send marketing emails without your explicit consent. To unsubscribe from any communication, reply with "unsubscribe."

To exercise any of these rights, email us at support@treeofafrica.com.

Security

Our website uses HTTPS (TLS encryption) for all data in transit. Payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified — the highest level of payment security available. We apply security headers, rate limiting, and input validation on all form submissions.

Cookies

We use only functional cookies required to operate the site (session management). We do not use advertising cookies, tracking pixels, or third-party analytics. Your cart is stored in localStorage, not cookies.

Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with their information, contact us and we will promptly delete it.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance of the updated policy.