Privacy policy

1. Our roles

For organisers, their team members and creators, we decide how your account data is used, so we are its controller. The same applies to the data we receive from the social accounts you connect.

For buyers and attendees, the organiser of the event decides what to collect and how to use it, and we process that data on the organiser’s behalf. Questions about how an organiser uses your data should go to the organiser first.

We are also a controller of the payment, fraud prevention and financial records we keep ourselves, including when we collect a payment as merchant of record.

2. What we collect

Account data: name, email address, password (stored as a secure hash), language, time zone, and two-factor settings.

Creator data: display name, bio, country, city, languages, content categories, creator code, the offers and campaigns you join, your posts, and your earnings, reversals and payouts.

Payout data: the mobile money or bank account you add, stored encrypted and shown only in masked form, and the account holder name returned when the account is checked.

Order data: buyer name, email address, tickets bought, amounts paid, the code or link used, and the answers to any questions the organiser asks.

Payment data: the payment provider handles card and mobile money details. We receive a payment reference and status, never the full card number.

WhatsApp data: when you write to an event on WhatsApp, your WhatsApp number, the messages you exchange with the event, your language, your consent to the service and any request to stop messages.

Technical data: IP address, browser, device and pages visited, used to keep the service secure and working.

3. Data from connected social accounts

Creators and organisers can connect social accounts to Tikeza. You sign in on the network’s own page and choose what to allow. We only ask for the permissions listed below, and Tikeza shows you why it needs each one before you connect.

For every network, we store the access tokens the network gives us, encrypted, and the account’s ID, name, username and picture so you can see which account is connected. We publish only the posts you approve. We do not read your private messages, we do not post on your behalf without your approval, and we do not sell this data or use it for advertising.

Facebook Pages: the list of Pages you manage, including through a business portfolio; publishing the posts, videos, Reels and Stories you approve; your Page’s followers and follower history; the views, reach, watch time, reactions, comments and shares of your posts; and a sample of comments on campaign posts.

Instagram: your profile, follower count and posts; publishing the posts, Reels, carousels and Stories you approve; the views, reach, likes, comments, shares, saves and watch time of your posts; follower demographics (country, city, age range and gender, as totals); and a sample of comments on campaign posts. If you connect Instagram through Facebook, we also read the Facebook Page linked to your Instagram account.

Threads: your profile and posts; publishing the posts, videos and carousels you approve; the views, likes, replies, reposts and quotes of your posts; follower demographics; and a sample of replies to campaign posts.

TikTok: your account ID, display name, username and profile picture; your follower, following, like and video counts; your posting settings (privacy options, whether comments, Duet and Stitch are allowed, and maximum video length); publishing the videos you authorise; and the views, likes, comments and shares of your videos.

YouTube: your channel and its subscriber count; uploading the videos you authorise, with their title, description, tags and thumbnail; the views, likes and comments of your videos and a sample of comments on campaign videos; and, from YouTube Analytics, watch time, audience retention, shares, new subscribers and viewer country, age and gender for your videos and channel.

X: your profile and follower count; publishing the posts you approve; and the metrics of the posts Tikeza published for you, such as impressions, likes, replies, reposts and quotes.

LinkedIn: for a personal profile, your name and photo, publishing the posts you approve, the impressions, reach, reactions, comments and reposts of your posts, and your follower count. For a LinkedIn Page, the Pages you administer, publishing the posts you approve, the Page’s follower count, follower demographics and post statistics, its images, videos and video views, and a sample of comments on campaign posts.

Pinterest: your profile, follower count and account analytics; your boards, so you can choose where each Pin goes; publishing the Pins you approve; and the analytics of the Pins Tikeza published for you.

Telegram: the Tikeza bot joins your channel as an administrator. It reads the channel name and subscriber count and the messages you post while connecting, and posts the messages you approve.

We use this data to show you which account is connected, publish what you approve, measure the results of event posts and campaigns, calculate creator rewards, show organisers a creator’s audience size and audience profile when the creator applies to their campaign, and check that engagement is genuine. Account insights are read about once a day, and post metrics while a post is being measured.

Comment samples are used only to check that engagement is genuine. The IDs of commenters are replaced with a one-way hash, and comment text is deleted after a short retention period. The figures that a creator’s earnings are based on are kept as evidence after the account is disconnected.

4. Google and YouTube data

Tikeza’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use YouTube data only to provide the features described above. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and our staff do not read it except with your permission, for security, or to comply with the law.

Tikeza uses YouTube API Services. YouTube data is used in accordance with the YouTube Terms of Service and the Google Privacy Policy. You can remove Tikeza’s access to your Google account at any time from the Google security settings page.

5. Tracked links

Creators and organisers share short tracked links. When someone opens one, we record the time, the link and a visitor fingerprint made from a salted one-way hash of the IP address and browser user agent. We do not store the raw IP address.

We use these records to count clicks, remove duplicates, filter out bots and link previews, and attribute ticket orders to the right creator.

6. Fraud and quality checks

We run automatic statistical checks on clicks, orders, post metrics, audience data and comment samples to detect fraud and artificial engagement. When a check flags a result, the related reward is held and a person reviews it before any final decision.

Creators can see a hold in the app and appeal it. Confirmed fraud can lead to rewards being reversed and a creator profile being closed.

7. AI features

Tikeza uses the Anthropic API to suggest captions for event and campaign posts, to help the WhatsApp sales assistant understand buyers’ messages, and to check new events for spam.

Caption prompts contain the event’s facts and the campaign brief, not buyers’ personal data and not data from connected social accounts. You always review a caption before anything is published.

For the WhatsApp assistant, we send the event’s facts and the text of the buyer’s latest message, which may contain details the buyer chooses to type, such as a name or email address. We do not send the buyer’s phone number or order history.

Anthropic’s commercial terms do not allow it to train its models on the data we send through its API.

8. How we use it

To run the service: create accounts, process orders, send tickets and messages, check people in, publish approved posts, measure campaigns and pay organisers and creators.

To keep it safe: prevent fraud, artificial engagement and spam, secure accounts and investigate misuse.

To meet legal duties: keep financial records and answer lawful requests.

To improve Tikeza: understand how features are used, in aggregate.

9. Legal bases

Contract: to provide the account, orders, payouts, campaigns and features you ask for, including connecting and publishing to your social accounts.

Legitimate interests: to keep Tikeza secure, prevent fraud and artificial engagement, check comment samples and improve the service, balanced against your rights.

Consent: where the law requires it, for example for optional messages. You can withdraw consent at any time, without affecting what was done before.

Legal obligation: to keep financial and tax records and answer lawful requests from authorities.

10. Who we share it with

The organiser of an event receives the data of its buyers and attendees. An organiser whose campaign a creator applies to sees the creator’s profile, audience size and audience profile.

Payment providers: Stripe for cards, and Fincra and MooniePay for mobile money and bank collections and payouts.

Meta, for WhatsApp Business messaging, and the social networks you connect (Meta, TikTok, Google/YouTube, X, LinkedIn, Pinterest and Telegram), which receive the posts you approve and the requests we make on your behalf.

Anthropic, for the AI features described above.

Hosting, file storage, email delivery, bot protection and error monitoring providers who help us run Tikeza.

These providers may use the data only to provide their service to us, or, for the networks and payment providers, under their own privacy policies. We share data with authorities when the law requires it. We do not sell personal data.

11. International transfers

Our providers, including the social networks, Stripe and Anthropic, may store or process data outside your country, for example in the United States or the European Union. When they do, we use contracts and safeguards that the applicable data protection law requires.

12. How long we keep it

We keep account data while your account is open. When you ask to delete your account, it is deactivated straight away and deleted or anonymised after a 30-day period during which you can cancel.

We keep social account tokens until you disconnect the account or the network ends our access, and then delete them. Comment text from comment samples is deleted after a short retention period.

We keep order, payment, payout, commission and campaign records, and the post figures that earnings are based on, for as long as required by applicable law and for as long as needed to handle refunds, disputes and claims. We then delete or anonymise them.

13. Your rights

Depending on where you live, including under the Nigeria Data Protection Act, Cameroon’s law on personal data protection and other African and international data protection laws, you can ask to see, correct, delete or export your data, object to some uses, and withdraw consent.

Organisers and creators can delete their account from settings. Buyers can ask the organiser, or write to us and we will pass the request on. You can also complain to your national data protection authority.

14. Removing Tikeza’s access

In Tikeza, open Social accounts in your creator or organiser workspace and choose Disconnect. We delete our access tokens and, where the network supports it, ask the network to revoke them; for Facebook, Instagram, Threads and Pinterest, also remove Tikeza in the network’s own settings. Posts already published stay on the network until you delete them there.

You can also remove Tikeza in each network’s own settings. Our user data deletion page explains how for each network and how to delete your account.

15. Security

We encrypt data in transit, encrypt social account tokens and payout details at rest, limit staff access, support two-factor sign-in and keep card data with the payment provider. No system is perfectly secure, so please tell us at once if you think your account has been misused.

16. Children

Tikeza is not meant for children to use on their own, and creators must be old enough to form a binding contract where they live. Organisers who collect data about children at their events must have a parent’s or guardian’s permission where the law requires it.

17. Changes

We will post any changes on this page and update the date at the top. Significant changes will be sent to organisers and creators by email.