Hamba Privacy Policy

Last updated: 25 August 2026

Hamba ("Hamba," "we," "us," or "our") runs a creator marketplace for hotel and travel stays at joinhamba.com (the "Platform"). Creators can receive hosted stays in exchange for agreed content, with an optional performance bonus only where the collaboration terms provide one. Hotels can review applicants and see supported social-content performance. During the private pilot, booking or revenue results are recorded only when a hotel reports them.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to creators, hotels, and anyone who visits joinhamba.com or applies to join.

1. Who this applies to

This policy covers everyone who uses the Platform: creators who apply and take stays, hotels that list stays and receive content, and general visitors to our website. Where a section is specific to creators or hotels, we say so.

2. Information we collect

Information you give us directly. When you apply, create an account, or take part in a collaboration, we collect:

• Your name, email address, and phone number.
• Your social media handles (for example Instagram, TikTok, YouTube).
• Your follower range and audience niche.
• Content you submit or link to us, including photos, videos, captions, and drafts created for a stay.
• Booking data tied to your collaborations, such as booking codes, redemption activity, dates, and property.
• For hotels: property details, contact details, listing information, booking links, promotional codes, booking-system information, and the terms of stays you offer.
• For guests using Hamba Passport: name, email address, phone number, marketing choice, the creator and offer followed, and redirect or redemption activity.
• Any messages you send us or information you provide in support requests.

Account information. When you create an account we collect your name, email address, phone number, role on the Platform (creator, hotel, or brand), acceptance of our legal terms, and your optional marketing preference.

Connected social accounts (creators). If you are a creator and you connect a TikTok or Instagram account through their OAuth flow, we collect, with your authorization:

• Your connected account's public profile: handle, follower count, avatar, and bio.
• Recent video metrics for that account: views, likes, comments, and timestamps.

We use these to build your reach and performance profile. You choose whether to connect an account, and you can disconnect at any time.

OAuth tokens. When you connect a social account we receive access tokens from TikTok or Instagram so we can read the profile and metrics above. These tokens are stored server side only. They are never exposed to your browser, to hotels, or to brands.

Connected social accounts (hotels). A hotel may connect Instagram or TikTok for the hotel organization or a particular property. We collect the account handle, follower count, provider identifier, connection date, granted permissions, and the OAuth tokens needed to refresh that information. Hotel tokens are server side only and are not shown to creators or other hotels.

Collaboration and performance history. We keep the links creators submit, revisions to those links, the account used for the accepted collaboration, supported performance snapshots, hotel reports, and the binding terms accepted by both sides. This protects both parties, supports accurate historical reporting, and prevents a later link or account change from rewriting an earlier agreement.

Information we collect automatically. When you use the Platform we collect basic technical and usage data, such as your IP address, device and browser type, pages viewed, and how you move through the site. See the Cookies and analytics section below.

We do not intentionally collect sensitive categories of data (such as health, race, or religion). Please do not send us this information.

3. How we use your information

We use your information to:

• Review applications and decide whether a creator or host is a fit for the Platform.
• Compute a creator's projected reach and brand match from their connected account's public profile and recent video metrics.
• Show creators their own insights, so they can see how their reach and performance look on the Platform.
• Let hotels and brands see the performance relevant reach of creators who apply to their campaigns.
• Match creators with stays and campaigns, and manage collaborations end to end.
• Verify supported social-content performance and record separately any booking or revenue result a hotel reports.
• Administer any manually agreed performance bonus and keep related payment records.
• Communicate with you about your account, stays, and collaborations.
• Send service messages through Resend, including application decisions, stay reminders, content reminders, Passport offers, and other transactional notices. We send editorial or promotional messages only where the recipient has made the relevant marketing choice.
• Measure product usage and diagnose errors using PostHog so we can improve onboarding, reliability, and conversion.
• Operate, secure, debug, and improve the Platform.
• Produce aggregated or anonymized statistics about how the Platform performs.
• Meet legal, tax, and accounting obligations.

We rely on your consent to connect a social account and read its data, on the performance of our agreement with you to run collaborations and payouts, and on our legitimate interest in operating and improving a safe Platform. Where local law requires a specific legal basis, we apply the one that fits.

4. How we share your information

We share information in these situations:

With hotels and brands in the context of a campaign. When a creator applies to a campaign, the hotel or brand running that campaign can see the creator's performance and reach data that is relevant to the decision: handle, follower count, and the reach and engagement metrics we compute from the creator's connected account. This sharing happens only in the context of a campaign the creator has applied to. Creators see the hotel and stay details they need to take part. We do not share your OAuth tokens with anyone.

With service providers (processors) who process data for us. We use trusted third parties to run the Platform. They only process data to provide their service to us, under contract. These currently are:

• Supabase for our database and account authentication (hosted in the United States).
• Vercel for website hosting and delivery (hosted in the United States).
• Resend for transactional and opted-in marketing email delivery, bounce handling, and delivery events.
• PostHog for product analytics, aggregated usage measurement, and error diagnosis.
• Social platform APIs (TikTok and Instagram) to read the public profile and video metrics of accounts creators connect.

For legal reasons. We may share information to comply with the law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of Hamba, our users, or the public.

In a business transfer. If Hamba is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that deal. We will let you know if your data becomes subject to a different privacy policy.

We do not sell your personal information.

5. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Platform secure, and measure product usage through PostHog. This may include page views, button interactions, device and browser information, and diagnostic events. We do not give PostHog OAuth tokens, hotel booking credentials, or payment-card information. You can control cookies through your browser settings, though some parts of the Platform may not work properly if you block them.

6. Data retention and deletion

We keep your personal information for as long as your account is active and for as long as we need it for the purposes described in this policy. After that, we keep certain records for longer where we need them to meet legal, tax, or accounting obligations, resolve disputes, or enforce our agreements. When we no longer need information, we delete it or anonymize it.

Connected social accounts. If you disconnect a social account, or remove Hamba from your Instagram or TikTok settings, we delete the active connection and its OAuth tokens and stop collecting new information from that account. We may retain limited historical connection identity, submitted links, performance snapshots, and accepted collaboration records where needed to preserve an agreement, investigate misuse, resolve a dispute, maintain accurate historical reporting, or meet legal and accounting obligations. Historical records are not treated as a currently connected account and are not used to keep accessing the provider after disconnection.

Passport leads and email records. We retain guest offer requests, attribution events, email delivery events, suppression records, and consent choices for as long as needed to deliver the requested offer, measure the collaboration, respect opt-outs, prevent repeated unwanted email, and meet legal obligations.

Deleting your data. You can delete your data at any time. See our Data Deletion page for how to make a request and what happens next. Requests made through Meta's data deletion flow are honored the same way. We complete verified deletion requests within 30 days, keeping only what we are required or permitted to retain. For any question about deletion, email us at hello@joinhamba.com.

7. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Delete your account and personal information.
• Object to or restrict certain uses of your information.
• Receive a copy of your information in a portable format.
• Withdraw consent where we rely on it.

To exercise any of these, email us at hello@joinhamba.com. We will respond within the time required by applicable law. Creators can also disconnect a social account at any time to stop us reading its data going forward.

8. International transfers

Hamba and our service providers may store and process your information in countries other than the one you live in, including countries whose data protection laws differ from yours. When we transfer personal information across borders, we take steps to protect it in line with this policy and applicable law, including using appropriate safeguards such as standard contractual clauses where required.

9. Security

We use reasonable technical and organizational measures to protect your information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please keep your account credentials confidential and tell us right away if you think your account has been compromised.

10. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you. Continuing to use the Platform after changes take effect means you accept the updated policy.

12. Contact us

If you have questions about this policy or your personal information, email us at hello@joinhamba.com.