Skip to main content

Hamba Privacy Policy

Last updated: 24 October 2026

Hamba ("Hamba," "we," "us," or "our") runs a creator marketplace for hotel and travel stays at joinhamba.com (the "Platform"). Creators can receive hosted stays in exchange for agreed content, with an optional performance bonus only where the collaboration terms provide one. Hotels can review applicants and see supported social-content performance. During the private pilot, booking or revenue results are recorded only when a hotel reports them.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. It applies to creators, hotels, and anyone who visits joinhamba.com or applies to join. It also applies to people whose details a hotel or agency adds to Hamba, as section 8 explains, and to people at businesses Hamba contacts directly, as section 9 explains.

1. Who this applies to

This policy covers everyone who uses the Platform: creators who apply and take stays, hotels that list stays and receive content, and general visitors to our website. It also covers people a hotel or agency adds to its contact list on Hamba before they have an account (see section 8), and people at businesses Hamba emails directly (see section 9). Where a section is specific to creators or hotels, we say so.

2. Information we collect

Information you give us directly. When you apply, create an account, or take part in a collaboration, we collect:

Account information. When you create an account we collect your name, email address, phone number, role on the Platform (creator, hotel, or brand), acceptance of our legal terms, and your optional marketing preference.

Connected social accounts (creators). If you are a creator and you connect a TikTok or Instagram account through their OAuth flow, we collect, with your authorization:

We use these to build your reach and performance profile. You choose whether to connect an account, and you can disconnect at any time.

OAuth tokens. When you connect a social account we receive access tokens from TikTok or Instagram so we can read the profile and metrics above. These tokens are stored server side only. They are never exposed to your browser, to hotels, or to brands.

Connected social accounts (hotels). A hotel may connect Instagram or TikTok for the hotel organization or a particular property. We collect the account handle, follower count, provider identifier, connection date, granted permissions, and the OAuth tokens needed to refresh that information. Hotel tokens are server side only and are not shown to creators or other hotels.

Connected Gmail (hotels and agencies). A hotel or PR agency may connect its Gmail account to organise contacts it has already emailed with. We ask Google for read-only access (the gmail.readonly permission): we cannot send, change, or delete any Gmail email. With the account owner's authorization we read message headers, subject lines, previews, and a few recent message bodies where a closer classification is needed. We distinguish what the contact wrote from the owner's outgoing messages. If the account uses a Jotform form for creator sign-ups, we also read the sign-up emails Jotform sends it, and add the creator who filled in the form with what they wrote there: name, email address, social handles, city, how they describe themselves, their niche, and whether they have a manager or agency. The account's private contact list may retain names, email addresses, explicitly stated phone numbers, public social handles and links, stated follower counts and rates with their dates, role labels, confidence, classifier version and a short explanation written from fixed signals. These are extracted facts, not verified current profiles. We do not retain email bodies or evidence quotations on the contact list. Manual role corrections and exclusions are kept so later scans respect them. Agency workspaces can organise hotels separately from creators; hotel contacts do not receive creator access. We email no one found this way until the account chooses to invite them. After it invites a creator, we send that creator one follow-up 4 days later if they have not joined (section 8). The refresh token is encrypted and stored server side only.

Collaboration and performance history. We keep the links creators submit, revisions to those links, the account used for the accepted collaboration, supported performance snapshots, hotel reports, and the binding terms accepted by both sides. This protects both parties, supports accurate historical reporting, and prevents a later link or account change from rewriting an earlier agreement.

Messages. We store the messages you send through Hamba and the application notes you write. Authorised Hamba staff may review them for safety, fraud prevention, dispute resolution, and to enforce our Terms. We do not include message text in notification emails. When our automatic message check is on, the text of each message and application note is also sent to Anthropic, whose AI reads it once to say whether it tries to arrange payments or extras outside the agreed terms (section 4).

Content you deliver. We store the files you upload for a collaboration in a private Google Workspace Shared drive under Hamba's own account. These files are never shared publicly. The host of that booking can view the files you submit, only through Hamba. We do not delete these files automatically. We also store the host's review notes, with each note on a video stamped with the time in the video, and the submission and approval records for each delivery.

Information we collect automatically. When you use the Platform we collect basic technical and usage data, such as your IP address, device and browser type, pages viewed, and how you move through the site. See the Cookies and analytics section below.

We do not intentionally collect sensitive categories of data (such as health, race, or religion). Please do not send us this information.

3. How we use your information

We use your information to:

We rely on your consent to connect a social account and read its data, on the performance of our agreement with you to run collaborations and payouts, and on our legitimate interest in operating and improving a safe Platform. For contacts a hotel or agency adds, we rely on that account's legitimate interest, and ours, in letting it organise and invite the people it already works with; the account is responsible for having its own lawful basis to share their details with us (section 8). Where local law requires a specific legal basis, we apply the one that fits.

4. How we share your information

We share information in these situations:

With hotels and brands in the context of a campaign. When a creator applies to a campaign, the hotel or brand running that campaign can see the creator's performance and reach data that is relevant to the decision: handle, follower count, and the reach and engagement metrics we compute from the creator's connected account. This sharing happens only in the context of a campaign the creator has applied to. Creators see the hotel and stay details they need to take part. We do not share your OAuth tokens with anyone.

With service providers (processors) who process data for us. We use trusted third parties to run the Platform. They only process data to provide their service to us, under contract. These currently are:

For legal reasons. We may share information to comply with the law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of Hamba, our users, or the public.

In a business transfer. If Hamba is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that deal. We will let you know if your data becomes subject to a different privacy policy.

We do not sell your personal information.

5. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Platform secure, and measure product usage through PostHog. This may include page views, button interactions, device and browser information, and diagnostic events. We do not give PostHog OAuth tokens, hotel booking credentials, or payment-card information. You can control cookies through your browser settings, though some parts of the Platform may not work properly if you block them.

6. Data retention and deletion

We keep your personal information for as long as your account is active and for as long as we need it for the purposes described in this policy. After that, we keep certain records for longer where we need them to meet legal, tax, or accounting obligations, resolve disputes, or enforce our agreements. When we no longer need information, we delete it or anonymize it.

Connected social accounts. If you disconnect a social account, or remove Hamba from your Instagram or TikTok settings, we delete the active connection and its OAuth tokens and stop collecting new information from that account. We may retain limited historical connection identity, submitted links, performance snapshots, and accepted collaboration records where needed to preserve an agreement, investigate misuse, resolve a dispute, maintain accurate historical reporting, or meet legal and accounting obligations. Historical records are not treated as a currently connected account and are not used to keep accessing the provider after disconnection.

Connected Gmail. While a Gmail scan runs, the headers, subject lines, and previews it reads, our working assessments of each person (their category and role, a fit score and tags, whether they work with a hotel that has rooms, where past conversations stand, and whether they asked not to be contacted), and the facts we note about each person (name, organisation, role, who they represent, social handles, follower counts, and quoted rates) are kept in temporary storage for at most 7 days; they are deleted as soon as the scan finishes, when the hotel disconnects Gmail, and in any case after 7 days. We never keep quotes or summaries of the email text. The text of the few messages we read in full is used for that one step and never stored; only the facts above are kept. So a later scan of the same hotel's Gmail does not need to look at someone again, we keep, for that hotel only, a one-way hash of each address we sorted with only our label (for example creator, talent manager, brand, guest, or automated sender), whether the hotel should still check it, a public social handle we found, and the date ("saved labels"); and, for each person we read more closely, our answer (creator, not a creator, or not sure), how likely we judged them to be a creator, and a short reason we write ourselves from fixed signals (for example "sent a media kit"), never their words, saved as each part of a scan is sorted so a paused or interrupted scan never loses them; never the address in clear and never any email text. So a later scan reads only the mail that arrived since the last finished one began, we also keep a one-way hash of the hotel's Gmail address and Gmail's marker (a number) for that point. Saved labels are never used for another hotel. Disconnect (or our switching the feature off) immediately asks Google to revoke our access, stops any running scan, and deletes the encrypted token and the temporary scan data; the contacts already added, their derived context and manual corrections stay on the account's private lists, and the saved labels (including those the hotel should still check), those answers, that marker, the exclusions, and our record of what the hotel's scans spent stay. Exclude from future scans removes a creator from the hotel's list and keeps their name, email address, and Instagram and TikTok handles, so no later scan adds them again; the hotel sees them under Excluded and can restore them at any time. Saved labels, those answers, that marker, private contact lists, manual corrections and exclusions are deleted when the account is deleted. When a hotel removes someone it added from Gmail or says Yes to a Check entry, or our closer read moves a Check entry to Excluded (the hotel can restore it there), we keep an internal record (who was removed: their name, email address, and Instagram and TikTok handles; our label; whether it was flagged Check; the Gmail account; and when) to improve how we classify; a removal alone does not stop a later scan adding them again. We keep this record for 2 years, then delete it. Hotels and creators cannot see it.

Google user data (Limited Use). Hamba's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to build and manage the connecting account's own private contact lists. It is never used for advertising, never sold, never transferred except to the processors listed above to provide this feature, never read by people except with the hotel's permission, for security, or to comply with law, and never used to train generalized AI or machine learning models.

Passport leads and email records. We retain guest offer requests, attribution events, email delivery events, suppression records, and consent choices for as long as needed to deliver the requested offer, measure the collaboration, respect opt-outs, prevent repeated unwanted email, and meet legal obligations.

Delivered content. We keep the files you upload with no automatic deletion. If you ask us to delete your data, we delete your personal information as described below, and we keep delivered content only while a host's license to it is active or a dispute about it is open.

Deleting your data. You can delete your data at any time. See our Data Deletion page for how to make a request and what happens next. Requests made through Meta's data deletion flow are honored the same way. We complete verified deletion requests within 30 days, keeping only what we are required or permitted to retain. For any question about deletion, email us at hello@joinhamba.com.

7. Your rights and choices

Depending on where you live, you may have the right to:

To exercise any of these, email us at hello@joinhamba.com. We will respond within the time required by applicable law. Creators can also disconnect a social account at any time to stop us reading its data going forward.

8. If someone added you to Hamba

This section is for people whose details a hotel, PR agency or other account on Hamba added before they had an account of their own.

Where your details came from. A hotel or agency you have dealt with gave them to us. It typed them in, uploaded them in a spreadsheet, or connected its Gmail account so we could find the people it has already emailed with, and the creators who signed up through its Jotform sign-up form (see "Connected Gmail" in section 2). We did not collect them from you.

What we hold. What that account gave us: usually your name and email address, and sometimes your phone number, your Instagram and TikTok handles, and the account's own notes, rates, tags and lists about you. For contacts found in Gmail we also hold the facts described under "Connected Gmail" in section 2. For an address typed in or uploaded, we check whether it can receive mail: we look up its domain, and MillionVerifier may check the address itself. We also record which emails we sent you for that account and when, and whether you unsubscribed. Only that account, its team members on Hamba and authorised Hamba staff can see this record. Other accounts cannot.

Why we hold it. So that the account can organise the people it already works with, and so that we can send you the emails it chooses to send: an invitation to join Hamba, an invitation to apply for one of its stays, or a request to fill in details it is missing. These emails are sent in the account's name "via Hamba", show its postal address, and replies go to the account. If you were invited as a creator and have not joined after 4 days, we send you one follow-up. The account can also choose to send you a reminder, no more than once every 4 days.

Our legal basis. We rely on legitimate interests: the account's interest in organising and inviting the people it already works with, and ours in running Hamba. The account is responsible for having a lawful basis, and any consent the law requires, to share your details with us and for us to contact you on its behalf. Our Terms require it to confirm this. It confirms it each time it adds, uploads or imports contacts, where a short notice says so. We record who confirmed it, when, and which version of the Terms applied.

Stopping invitations. Every one of these emails has a one-click unsubscribe link. Using it stops all further emails of this kind from that account to your address, even if the account removes you and adds you again. The page that opens also lets you stop invitations from every account on Hamba to that address. If you have a Hamba account, the unsubscribe link in Hamba's own marketing emails offers the same.

How long we keep it. Your details stay on the account's private list until the account removes you, the account is deleted, or you ask us to delete them. We do not delete them automatically after a set time. Once they are removed we keep only what we need to keep honouring your choices and to prevent repeated email: your address on any unsubscribe list, and a record of which address each email went to and when.

Your rights. You can ask us for a copy of what we hold about you, ask us to correct or delete it, or object to our using it, by emailing hello@joinhamba.com from the address the account used. We complete verified deletion requests within 30 days, as described in section 6. Deleting your details does not stop an account adding you again later. To make sure no account on Hamba invites you, use the stop all invitations option on the unsubscribe page; we keep your email address on that list so that we can keep honouring it.

If you join. Once you create a Hamba account you are a user, and the rest of this policy and our Terms apply to you like anyone else. When you sign up as a creator through an invitation link, we link your new account to the contact records accounts hold for you that match your confirmed email address or an Instagram or TikTok account you have connected. An account that added you can then see that you joined, the Instagram and TikTok handles you connected, your profile photo, your category and whether you applied to its stays, but not your account's email address. When a hotel signs up through an agency's invitation, we record that the agency invited it, and the agency can see that it joined.

Team invitations. If a hotel's owner invites you to join its team on Hamba, we send you one email at once with a link that expires after 7 days; it has no unsubscribe link and we send no reminders, but the owner can invite you again.

9. If Hamba contacted your business

Hamba emails hotels and other businesses directly to offer them Hamba. If we emailed you this way, this section explains what we hold about you and how to stop our emails.

We use two outreach tools. Our main outreach sends a series of emails. Our second tool researches hotels and writes short email sequences, and our team approves its emails before they are sent. The two tools work separately, so each can email different people at the same business.

Where your details came from.

Where no address is published, we may use a general address such as info@, sales@ or marketing@, or try the usual formats at your business's email domain, such as first.last. We check most addresses with MillionVerifier before we use them; some are checked only by the services Clay uses.

What we hold.

How we use it. Only to offer Hamba to your business. We rely on our legitimate interest in business to business outreach. Our emails come from lev@syndicate11.co, the address of our founder, Levi Lomey.

Who processes it for us.

Stopping our emails. Our emails do not have an unsubscribe link. To stop them, reply from the address we emailed and say so. An AI reads your reply, and when it reads a request to stop, your address goes on our do-not-contact list automatically, whichever of our two tools emailed you. If you ask our main outreach to stop contacting your whole business, the business goes on the list too. Both tools check the list before each automatic email; our second tool checks a copy that is updated every few minutes.

Our main outreach does not pass every message to the AI. An out-of-office or other automatic reply pauses its emails to you until we decide what to do. A reply that reads like instructions to our software is not answered by software and goes to our team instead. Any reply to our second tool, automatic or not, cancels the rest of its emails to you.

If you write from a different address, or want to be sure, email hello@joinhamba.com, and we add you to the list by hand.

How long we keep it. We do not delete these details after a set time. If you ask, we stop contacting you and remove your details from our outreach lists, keeping only your address on the do-not-contact list so that we do not email you again. Copies of our emails with you stay in our email account and in our backups, and Clay keeps the history of its earlier campaign.

Our team also keeps a list of hotels from public sources such as OpenStreetMap (name, address, website and map location only) and records when it contacts each one.

10. International transfers

Hamba and our service providers may store and process your information in countries other than the one you live in, including countries whose data protection laws differ from yours. When we transfer personal information across borders, we take steps to protect it in line with this policy and applicable law, including using appropriate safeguards such as standard contractual clauses where required.

11. Security

We use reasonable technical and organizational measures to protect your information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Please keep your account credentials confidential and tell us right away if you think your account has been compromised.

12. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you. Continuing to use the Platform after changes take effect means you accept the updated policy.

14. Contact us

If you have questions about this policy or your personal information, email us at hello@joinhamba.com.

Back to Hamba