Privacy Policy

Balemual Marketing ("Balemual", "we", "us", "our") operates a creator-performance platform that connects content creators and influencers with marketing campaigns. We provide campaign management, content submission and verification, sales attribution through promo codes and referral links, reward settlement in Ethiopian Birr (ETB), and a storefront that also operates through Telegram.

• This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights you have.
• It applies to visitors of our websites and pages, account holders (influencers, marketing staff and administrators), customers who shop through the Balemual storefront or Telegram store, and anyone else who interacts with our Platform.
• We collect and handle personal data only for the purposes described in this Policy. We do not sell personal data.
• By using the Platform you agree to the practices described in this Policy. It forms part of our Terms of Service.

We collect information you give us directly, information generated as you use the Platform, and information we receive from the services you connect.

• Account information: name, email address, phone number, password (stored only as a secure hash), account role and registration date.
• Creator profile information: your social handle, primary platform, follower count, content category, avatar or uploaded photos, promo code, and the bank or mobile-money details you add for payouts (for example, CBE, Awash, Dashen, Abyssinia or Telebirr account numbers).
• Campaign activity: the campaigns and tasks you join, the content URLs and links you submit, notes and screenshots you upload, and any engagement metrics you report.
• Verification data (TikTok): when you connect your TikTok account we store a stable TikTok account identifier (open_id), your public TikTok username, display name and avatar, the scopes you authorised, and encrypted access tokens that allow us to run automatic verification on your own videos. We may store a snapshot of public metrics — such as view and like counts and creation time — for the specific videos you submit for a campaign.
• Store and referral data: customer name, phone number and delivery address for orders; the promo code or referral link used; referral events tied to a Telegram chat identifier; and technical referral data such as the IP address and browser user-agent of the click that opened a referral link.
• Technical and usage data: session tokens and cookies, CSRF tokens, the pages you visit, dates and times of access, device and browser information, IP addresses used for security and rate limiting, and aggregated analytics about Platform usage.

• To operate the Platform: create and manage accounts, show relevant campaigns, accept submissions and keep audit records.
• To verify content: identify the TikTok account you connect, confirm ownership of videos you submit, check posting dates against campaign windows and read public metrics, so that qualifying content is recognised and abuse is deterred.
• To measure performance and settle rewards: attribute sales to the correct creator through promo codes and referral links, evaluate campaign conditions, produce payment records and pay rewards to your registered account.
• To run the storefront and fulfil orders: process customer orders placed on the website or through Telegram, manage delivery, and keep order histories.
• To communicate: send account notifications, campaign updates, payment confirmations and legal notices by email, in-app messages or Telegram.
• To secure and improve the Platform: detect fraud, abuse, bot activity, self-referrals and fake engagement; prevent attacks; debug issues; and improve our services and analytics.
• To comply with law: keep records where we have a legal, accounting or tax obligation.

We process personal data on one or more of the following lawful bases, depending on the context:

• Performance of a contract — for example, to run your account, process submissions and pay rewards you have earned.
• Consent — for example, when you choose to connect your TikTok account or agree to receive marketing messages. You can withdraw consent at any time.
• Legitimate interests — for example, to prevent fraud and abuse, keep the Platform secure, measure campaign performance and improve our services, provided your interests and rights are balanced against those purposes.
• Legal obligation — for example, keeping records required by accounting, tax or other law.

We only share personal data with the parties needed to operate the Platform, and always under appropriate safeguards:

• Service providers: hosting and database providers that store and process Platform data on our behalf, email and notification providers, and payment or banking processors used to settle rewards.
• Product brands and campaign operators: aggregated and campaign-specific performance information (for example, submissions, attributed sales and reward outcomes). Brand teams never receive your bank account numbers or passwords, and only see limited profile information where it is needed for a campaign.
• Telegram: when you use the Balemual store or notifications through Telegram, we share the necessary message content and chat identifier with Telegram to deliver the service, subject to Telegram's own terms and privacy policy.
• TikTok: when you connect a TikTok account or submit a TikTok video for automatic verification, we exchange the data required by the official TikTok OAuth and Display APIs (for example, your authorised scopes and the video IDs you submit). This is governed by TikTok's terms and privacy policy as well as this Policy.
• Authorities: where required by law, regulation, court order or a lawful government request, or where disclosure is necessary to protect the rights, safety or property of Balemual, our users or the public.
• Corporate events: if Balemual is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, with notice where reasonably possible.

We do not sell personal data, and we do not share personal data with unrelated third parties for their own marketing purposes.

• We use a session cookie to keep you signed in. The cookie is httpOnly so scripts cannot read it, and it expires when you sign out or after its session lifetime.
• We use a CSRF protection cookie to help prevent cross-site request forgery.
• We may store lightweight values in your browser's local storage to remember preferences or interface state.
• We do not use third-party advertising cookies, and we do not currently use cross-site tracking for advertising.
• You can clear cookies and site data through your browser, but this may sign you out or affect how some parts of the Platform work.

We apply organisational and technical safeguards appropriate to the sensitivity of the data we hold:

• Passwords are stored only as strong, salted hashes and are never stored or logged in plain text.
• TikTok access and refresh tokens are encrypted at rest using AES-256-GCM, and are never exposed to browsers or shown in logs.
• Session identifiers are stored in httpOnly cookies; sensitive actions are protected against CSRF; and role-based access controls limit who can view what inside the Platform.
• Inputs are validated and rate-limited to reduce the risk of automated abuse, and security headers are applied on responses.
• Access to production data is limited to personnel who need it for their role, and we review access and activity records.
• No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee its absolute security. If you suspect a security issue, please contact us immediately.

• Account information is kept while your account is active and deleted or anonymised within a reasonable period after you ask us to close it, unless we must keep it longer for legal reasons.
• Payment and reward records, verification audit snapshots and order records are retained as long as needed for accounting, tax, dispute resolution and anti-fraud purposes.
• TikTok connection tokens are kept only while the connection is active and are cleared when you disconnect your account or when the connection expires. Verification snapshots that were already recorded for submitted content remain part of the submission audit trail.
• Referral and technical logs (such as IP addresses and user agents) are kept for a limited period and used mainly for security, fraud prevention and troubleshooting.
• Where we no longer need personal data for the purposes described in this Policy, we delete or anonymise it.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Ask us to correct inaccurate or incomplete data in your profile or account.
• Ask us to delete your personal data where it is no longer needed or where you withdraw the consent you gave.
• Object to, or ask us to restrict, processing that is based on our legitimate interests.
• Receive your data in a structured, machine-readable format where processing is based on consent or contract (data portability).
• Withdraw consent at any time where processing relies on consent — for example, disconnecting TikTok or opting out of marketing messages.

You can update much of your profile data yourself inside the Platform (for example, bank details, contact details and your TikTok connection). To make any other request, email us at admin@balemual.com. We may ask you to verify your identity before acting on a request, and we will respond within the period required by applicable law (normally within 30 days). We may keep limited data where we have a legal obligation or a legitimate need to do so.

The Platform is intended for adults who are at least 18 years old. We do not knowingly collect personal data from children under the age of 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

• Our websites and pages may link to third-party websites and services, including social platforms such as TikTok, Instagram, YouTube and Facebook, and messaging services such as Telegram. Those services operate under their own privacy policies, which we encourage you to read.
• When you connect a TikTok account, both our Privacy Policy and TikTok's privacy policy apply to that connection. You can manage or remove the connection at any time from your Balemual profile.
• Customers who order through Telegram should also review Telegram's privacy policy, since Telegram processes messages and chats on its own infrastructure.

Balemual operates in Ethiopia. The technical providers we use (for example, for hosting, databases, email and messaging) may store or process data in jurisdictions outside Ethiopia. Where personal data is transferred internationally, we rely on appropriate and lawful safeguards, such as contracts that require the recipient to protect the data to standards comparable with applicable law. By using the Platform you understand that your data may be processed in this way.

• We may update this Privacy Policy from time to time to reflect changes in our services, technology or legal obligations. The "Last updated" date at the top of this page will always show when it was last changed.
• If we make material changes, we will notify you through the Platform or by email where reasonably practicable before they take effect. Your continued use of the Platform after changes take effect confirms your acceptance of the updated Policy.
• If you have questions, concerns or complaints about this Policy or how we handle personal data, please contact us at admin@balemual.com. We will do our best to resolve your concern, and you may also have the right to complain to the relevant data protection authority in Ethiopia.