BomaPrivacy policy
Last updated: 26 September 2026
This policy explains what personal data the Boma app and website (getboma.org) collect, why, and the choices you have. Boma processes personal data in line with Tanzania’s Personal Data Protection Act, 2022.
Data we collect
- Account details: your name, email address, phone number and password (stored only as a secure hash).
- Host verification (hosts only): identity and business documents you upload, such as a NIDA card, passport, business registration or TIN certificate, plus your payout mobile-money number.
- Listings: the address, map location, photos, prices and descriptions hosts publish.
- Bookings and payments: trip dates, guests, prices, cancellations and refunds. Payments are processed by our payment provider, AzamPay. We receive the payment status and reference; we never see or store your card number or mobile-money PIN.
- Messages and reviews: messages between guests and hosts, and the reviews you write.
- Device data: a push-notification token if you allow notifications, and basic technical logs (IP address, request times, errors) used to keep the service secure.
- Location: if you allow it, your approximate location is used on the device to show nearby stays. We do not store your location.
How we use it
- To create your account, run bookings and payments, and let guests and hosts contact each other.
- To verify hosts and listings, and to prevent fraud and misuse.
- To send booking updates, payment reminders and, if you allow them, push notifications.
- To handle support requests, refunds and disputes, and to meet legal and tax obligations.
We do not sell your personal data, and we do not use it for third-party advertising.
Who we share it with
- The other party to a booking: hosts see a guest’s name, trip details and messages; guests see the host’s name, listing and check-in details.
- Service providers: AzamPay (payments), Expo/Apple/Google (push notifications) and our hosting provider, each only for the service they provide.
- Authorities: when the law requires it.
Host verification documents are stored privately and are seen only by Boma staff who review them.
How long we keep it
We keep your data while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law, such as booking, payment and tax records, which we keep for the period the law requires and then delete.
Your rights
You can see and edit your profile in the app, ask us for a copy of your data, ask us to correct it, and delete your account at any time (how to delete your account). You may also complain to the Personal Data Protection Commission of Tanzania.
Security
Data is sent over encrypted connections (HTTPS). Passwords are hashed, verification documents are kept outside public storage, and access to personal data is limited to staff who need it.
Children
Boma is not intended for anyone under 18, and we do not knowingly collect data from children.
Changes and contact
If we change this policy we will update the date above and, for significant changes, tell you in the app. Questions: support@getboma.org.