Privacy policy

Last updated: 28 September 2026

This policy explains what personal data the Boma mobile app and the website getboma.org (together, “Boma”) collect, why we collect it, and the choices and rights you have.

1. Who we are

Boma is owned and operated by NASEEHA DIGITAL HEALTH LIMITED, a company registered in the United Republic of Tanzania (“Naseeha”, “we”, “us”). Naseeha is the data controller for the personal data described here and processes it in line with Tanzania’s Personal Data Protection Act, 2022 and its regulations. For any privacy question or request, email support@getboma.org.

2. Data we collect

• Account details: your name, email address, phone number and password (stored only as a secure hash), and optional profile details such as a photo, bio, languages, work, school and where you live.
• Host verification (hosts only): identity and business documents you upload, such as a NIDA card, passport, business registration or TIN certificate, and your payout mobile-money number.
• Listings: the address, map location, photos, prices, rules and descriptions hosts publish.
• Bookings and payments: trip dates, number of guests, prices, cancellations, refunds and payouts. Payments are processed by AzamPay. We receive the payment status, amount and reference; we never see or store your card number or mobile-money PIN.
• Messages and reviews: messages between guests, hosts and our support team, and the reviews and ratings you write.
• Device and usage data: a push-notification token if you allow notifications, your app language, and technical logs (IP address, device type, app version, request times and errors) used to run and secure the service.
• Location: if you allow it, your device’s location is used on the device to show stays near you on the map. We do not store your location.
• Waitlist: if you join our launch list on getboma.org, your email address and the details you choose to give.

3. Why we use it (and our legal basis)

• To create your account, run bookings and payments, pay hosts, and let guests and hosts contact each other (to perform our contract with you).
• To verify hosts and listings, prevent fraud and misuse, and keep Boma secure (our legitimate interests and legal obligations).
• To send booking confirmations, payment reminders, account and security messages, and push notifications if you allow them.
• To handle support requests, refunds and disputes, and to keep records required by tax and other laws (legal obligations).
• To send launch news or offers by email, only where you asked for them or agreed; you can unsubscribe at any time (consent).

We do not sell your personal data, and we do not use it for third-party advertising.

4. Who we share it with

• The other party to a booking: hosts see a guest’s name, profile photo, trip details and messages; guests see the host’s name, profile, listing and check-in details. Public profiles and reviews can be seen by other Boma users.
• Service providers who act on our instructions: AzamPay (payments and payouts), Resend (email delivery), Expo, Apple and Google (app updates, push notifications and maps), and our cloud hosting provider.
• Authorities and others where required: when the law, a court order or a regulator requires it, or to protect the safety or rights of our users, the public or Naseeha.
• A future owner: if Boma or Naseeha is reorganised, merged or sold, the data may be transferred to the new owner under this policy.

Host verification documents are stored privately and are seen only by the Naseeha staff who review them.

5. Transfers outside Tanzania

Some of our service providers (for example email, push-notification and map services) process data on servers outside Tanzania. When that happens we use providers that protect data under their contracts with us, and we transfer only what the service needs, as permitted by the Personal Data Protection Act.

6. How long we keep it

We keep your data while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law, such as booking, payment and tax records, which we keep for the period the law requires (usually up to 7 years) and then delete. Technical logs are kept for a short time, normally no more than 90 days.

7. Your rights

You can see and edit your profile in the app. You also have the right to ask us for a copy of your data, to correct it, to object to or restrict certain uses, to withdraw consent you have given, and to have it deleted. You can delete your account at any time in the app (Profile › Account settings › Login & security) or on our account deletion page. To make any other request, email support@getboma.org; we will reply within 30 days. If you are unhappy with our answer, you may complain to the Personal Data Protection Commission (PDPC) of Tanzania.

8. Security

Data is sent over encrypted connections (HTTPS). Passwords are hashed, sign-in tokens are kept in your device’s secure storage, verification documents are kept outside public storage, and access to personal data is limited to staff who need it. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

9. Children

Boma is not intended for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

10. Changes to this policy

If we change this policy we will update the date above and, for significant changes, tell you in the app or by email before they take effect.

11. Contact

NASEEHA DIGITAL HEALTH LIMITED (operator of Boma), United Republic of Tanzania. Email: support@getboma.org.