Privacy Policy

1. Who controls your data

The Boga website at tryboga.com, the Boga waitlist and the future Boga service are operated by Celulax Telecommunication Company Tanzania Limited (“Boga”, “we”, “us”). Boga is a product of Celulax Telecommunication Company Tanzania Limited. We are the controller of the personal data described in this policy.

Legal entity: Celulax Telecommunication Company Tanzania Limited
Address: Mikocheni, Block 31, Dar es Salaam, Kinondoni 3339, Tanzania
Phone: +255 718 101 874
Email: [email protected]
Website: tryboga.com

For privacy questions or requests, email [email protected].

2. Scope of this policy

This policy applies to:

the tryboga.com website and its pages;
the Boga waitlist and the emails we send to people on it;
the future Boga web application, once it launches;
support and contact conversations with us; and
connections between Boga and Instagram professional accounts and TikTok accounts, which are available now; and
connections to Facebook and YouTube, once they are available.

Social platforms you connect to Boga have their own privacy policies. We encourage you to read them.

3. Data we collect

Today, through the website and waitlist

Your name, email address and, if you choose to give it, your phone number.
Your business or brand name, role, country, the platforms you use, how many brands you manage, the plan you are interested in, your current scheduling approach and your main challenge, where you provide them.
Your consent choices, the version of the consent wording you accepted and when you accepted it.
Where you came from: the page you signed up on, the referring page and campaign (UTM) parameters, plus your browser language.
Messages you send us through the contact form or by email.
Technical data such as IP address, browser and device type, and security logs. IP addresses used for rate limiting are converted into keyed hashes and held briefly in memory.

When you connect an Instagram account

Your Instagram professional account ID, username, display name and account type (Business or Creator).
The permissions you granted, and an access token issued by Instagram, stored encrypted, with its expiry date.
The posts you schedule in Boga: captions, links to the images or videos you provide, post type, the scheduled time, and publishing results (status, error messages, the ID of and link to the published post).
Notifications Meta sends to our webhook about connected accounts.

We do not collect your Instagram password, followers, direct messages, comments or insights.

When you connect a TikTok account

Your TikTok account’s ID for Boga (open ID), display name and username. Your profile picture is shown from TikTok when you use Boga and is not stored.
The permissions you granted, and the access and refresh tokens issued by TikTok, stored encrypted, with their expiry dates.
The videos you schedule in Boga: captions, the video you upload or the link to it, your privacy, interaction and commercial content choices, the scheduled time, and publishing results (status, error messages and the ID of the published video).

Videos you upload are kept in private storage until they are posted, then deleted; uploads that are never scheduled are deleted after 24 hours. We do not collect your TikTok password, followers, messages, comments, analytics or the videos already on your profile.

In the future, as the Boga service grows

Account and profile details that other connected platforms (Facebook, YouTube) share with us when you authorize them, such as account name, ID, profile picture and account type.
OAuth access and refresh tokens issued by those platforms, stored encrypted.
Content you create or upload: captions, media, schedules, publication status and workspace activity.
Billing and transaction references. Card details will be handled by our payment provider and, where feasible, never stored by Boga.

4. How we collect data

Directly from you, when you join the waitlist, contact us or, later, use the service.
Automatically, when your browser talks to our servers (for example, IP address and request logs).
From platforms you authorize, such as Instagram, only within the permissions you grant.

5. How we use data

To run the waitlist, confirm your signup and invite you to early access.
To send the product updates you asked for.
To provide the service, including publishing content to your connected accounts when and how you instruct us.
To answer support requests and other messages.
To keep Boga secure, prevent abuse and spam, and investigate problems.
To understand, in aggregate, how the website is used and improve it.
To meet legal, tax and accounting obligations.
To send general marketing, only if you separately opted in. You can opt out at any time.

6. Legal bases

Where the law requires a legal basis for processing, we rely on:

Consent — for waitlist updates, optional marketing and optional analytics. You can withdraw consent at any time.
Contract — to take steps you request, such as providing the service you sign up for.
Legitimate interests — to secure our systems, prevent fraud and improve Boga, balanced against your rights.
Legal obligation — where the law requires us to keep or disclose information.

Instagram

You can connect an Instagram professional (Business or Creator) account using Instagram’s official login. Boga asks Instagram for two permissions only:

instagram_business_basic — to read your account ID, username, name and account type, so Boga can show which account is connected and publish to the right one.
instagram_business_content_publish — to publish the image posts, reels and carousels you create and schedule in Boga, at the time you choose, and to show you the link to the published post.

Boga publishes only content you created and scheduled, and you can cancel a scheduled post before it is published. We use Instagram data only to provide these features. We do not sell it, use it for advertising, or share it with anyone other than the service providers listed below who host Boga. Our use of data received from Meta follows the Meta Platform Terms and Developer Policies.

TikTok

You can connect a TikTok account using TikTok’s official login. Boga asks TikTok for two permissions only:

user.info.basic — to read your open ID, display name and profile picture, so Boga can show which account is connected and which account a video will be posted to.
video.publish — to post the videos you create and schedule in Boga to your TikTok account, at the time you choose and with the privacy, interaction and disclosure settings you selected, and to show you the result.

Boga posts only videos you created and scheduled, and you can cancel a scheduled video before it is posted. We use TikTok data only to provide these features. We do not sell it, use it for advertising, or share it with anyone other than the service providers listed below who host Boga. Disconnecting a TikTok account in Boga revokes Boga’s access at TikTok and deletes the stored tokens.

Commitments for every platform

These apply to Instagram and TikTok today and to Facebook and YouTube when they launch:

We connect accounts only through each platform’s official authorization (OAuth) flow. Boga never asks for or stores your social media password.
We request only the permissions needed for the features you use, and explain why before you are redirected.
Access tokens are encrypted at rest (AES-256) and never placed in browser storage or logs.
We use platform data only to provide the features you request, such as showing your connected account, publishing your scheduled content and reporting its status.
Connecting an account does not transfer ownership of that account, or its content, to Celulax Telecommunication Company Tanzania Limited.
You can disconnect an account in Boga, or revoke access in the platform’s own settings, at any time. Either way, we delete the stored access token.
We follow the developer policies of Meta, TikTok and Google.

Boga’s use and transfer of information received from Google APIs, including the YouTube API Services, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. By connecting a YouTube account you will also be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

8. Service providers

We share personal data only with providers that help us run Boga, and only as much as they need:

Cloud hosting (a virtual private server provider) for our website, application and database.
Cloudflare, for DNS, content delivery, security, and storage of encrypted backups.
An email delivery provider, to send confirmation and update emails.
A privacy-friendly analytics provider, only if analytics is enabled and you consent.
An error monitoring provider, if enabled, configured to remove personal data.
Payment providers, once paid plans launch.
Social platforms you connect, to publish content at your instruction.

We may also disclose data where required by law, to protect rights and safety, or as part of a merger or sale of our business, in which case this policy will continue to protect your data.

9. No sale of personal data

We do not sell personal data. We do not share it with third parties for their own advertising or for purposes unrelated to Boga.

10. International transfers

Boga is based in Tanzania, but some of our providers operate internationally. Your data may therefore be processed in other countries. Where required, we use appropriate safeguards, such as contractual protections, and choose providers with strong security practices.

11. How long we keep data

Waitlist data: until launch and then for up to 24 months of inactivity, or until you unsubscribe or ask us to delete it.
Support messages: up to 24 months after the conversation ends.
Security logs: up to 90 days.
Rate-limiting data: keyed hashes held in memory for no more than one hour.
Backups: encrypted backups roll off within 35 days.
Connected-account access tokens: until you disconnect the account in Boga or remove Boga in the platform’s settings, then deleted straight away.
Connected-account details and scheduled posts: while you use Boga. They are deleted immediately when Meta sends us a data deletion request on your behalf, or within 30 days of a verified request to us.
Platform webhook notifications: up to 30 days.

12. Security

We use encryption in transit (HTTPS), restricted and logged production access, encrypted secrets and tokens, encrypted backups and monitoring. No system is perfectly secure, but we work to protect your data and will tell you and the relevant authorities about a breach where the law requires. Read more on our Security page.

13. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct inaccurate data;
delete your data;
object to or restrict certain processing;
receive your data in a portable format; and
withdraw consent at any time, without affecting earlier processing.

To use these rights, email [email protected]. We will verify your request without asking for passwords. Every waitlist email also has an unsubscribe link.

14. Deleting your data

Our Data Deletion page explains exactly how to ask us to delete your data. You can also email [email protected] directly.

15. Cookies and analytics

We keep cookies and tracking to a minimum. See our Cookie Policy for details, and use “Cookie preferences” in the website footer to change your choice at any time.

16. Children

Boga is designed for adults and businesses. You must be at least 18 to join the waitlist or create an account. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

17. Changes to this policy

We will update this policy as Boga develops. When we make material changes, we will update the date at the top and tell waitlist members and customers by email or in the product before the changes take effect.

18. Contact and complaints

Questions or concerns? Email [email protected], call +255 718 101 874, or write to Celulax Telecommunication Company Tanzania Limited, Mikocheni, Block 31, Dar es Salaam, Kinondoni 3339, Tanzania.

If you are not satisfied with our response, you may have the right to complain to the data protection authority in your country. In Tanzania, this is the Personal Data Protection Commission.