Privacy Policy

In short: we collect what we need to cut, print and deliver your puzzle. We never sell your data and we never publish your photos.

This policy explains what we collect, why we collect it, who we share it with and the choices you have. It applies to everything you do on Jigsaw — browsing, playing, generating a puzzle and checking out.

1. Who we are

Jigsaw is the data controller for the information described here. We are based in Kenya and process personal data in line with the Data Protection Act, 2019.

2. What we collect

Account details

Your name, email address, phone number and password (stored hashed). If you sign in through a social provider we receive only the profile details you approve.

Order details

The puzzles you buy, the piece counts and cut styles you choose, your delivery address and your order history.

Payment references

M-Pesa transaction codes or PayStack references so we can match a payment to an order. We never receive your card number, CVV or M-Pesa PIN.

Images you upload

The photos and artwork you turn into puzzles, plus the generated puzzle files. These stay private to your account and to our production team.

Technical information

IP address, browser type, pages visited and security logs. This helps us keep the shop running and spot abuse.

3. How we use it

to create your account and keep you signed in;
to generate, print, deliver and support your order;
to confirm payments and prevent fraud;
to reply when you contact us;
to send order updates — and, only if you opt in, occasional shop news;
to understand which puzzles and pages are popular so we can improve the shop.

We do not use your images to train AI models, and we do not sell or rent personal data to anyone.

4. Why we are allowed to use it

We rely on three grounds: performing our contract with you (orders, delivery, support), our legitimate interests (security, fraud prevention, improving the shop), and your consent (marketing emails and non-essential cookies). You can withdraw consent at any time.

5. Who we share it with

We share only what is necessary, and only with:

Safaricom for M-Pesa payment confirmation;
PayStack for card processing;
our courier partners, who receive the name, phone number and address needed to deliver;
our hosting and email providers, who process data on our instructions;
law enforcement or regulators, where the law requires it.

Some of these providers operate outside Kenya. Where that happens we rely on contractual safeguards to protect your data.

6. Your images

Uploaded images are stored in private storage, never in a public folder. Only the production team can open them, and only to prepare your puzzle. We keep the source image for as long as you keep the puzzle on your account so you can re-order it; you can delete it whenever you like.

7. Cookies

We use a small set of cookies to keep you signed in, remember your cart and understand how the site is used. The cookie policy lists them and explains how to manage them.

8. How long we keep it

Account data stays for as long as your account is open. Order records are kept for seven years to meet tax and accounting rules. Images and generated puzzles are deleted when you delete them or close your account, unless an order is still in production. Security logs are kept for 12 months.

9. Your rights

You can ask us to:

show you a copy of the personal data we hold about you;
correct anything that is wrong or out of date;
delete your account, images and generated puzzles;
stop sending you marketing messages;
restrict or object to certain processing.

Write to us through the contact page and we will respond within 30 days. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner.

10. Security

We use HTTPS everywhere, hash passwords, encrypt payment traffic and limit staff access to order data. No system is perfectly secure, but we work hard to keep your information safe and will tell you if a breach affects you.

11. Children

The shop is intended for adults. Children may enjoy the puzzles, but an adult should place any order. We do not knowingly collect data from children under 18.

12. Changes to this policy

If we change how we handle data we will update this page and its "last updated" date. Significant changes will be announced on the site or by email.

13. Contact

For any privacy question, use the contact page and mention "privacy" so it reaches the right person quickly.