Privacy Policy

Last updated: 2026-10-29

GSM KOYA Boost (boost.gsmkoya.net) is operated by GSM KOYA, Koya, Kurdistan Region, Iraq. This policy explains what we collect, why, and how we protect it.

Information we collect

• Account: name, mobile number, and password (stored only as a one-way hash).
• Sponsorship requests: the TikTok Spark Ads authorization code, video link, budget, duration, target location, gender and age range, and any notes.
• Video data from TikTok: when we verify a code, TikTok returns the video ID, caption, cover image and account display name.
• Payment: payment method, transaction reference and an optional receipt image. We do not collect card or bank account numbers.
• Ad results: campaign metrics from TikTok (views, impressions, clicks, spend, engagement).
• Technical: a session cookie to keep you signed in. We use no advertising or tracking cookies.

How we use it

To verify your video, create and manage the ad in GSM KOYA's TikTok ad account, confirm payment, show you campaign results, and contact you about your request. We do not sell your data or use it for any other purpose.

Sharing

We share with TikTok only what is needed to create and run your ad, via the TikTok Marketing API; TikTok's use of it is governed by TikTok's Privacy Policy. Data is stored by our hosting provider. We disclose data to authorities only when legally required.

Your TikTok account

A Spark Ads code only authorizes that one video to be used as an ad. It does not give us access to your account, messages or password. You can revoke it anytime in the TikTok app (Ad settings).

Retention and security

Account and request data are kept while your account is active. Technical API logs are deleted after 60 days. All traffic uses HTTPS; receipts are visible only to you and GSM KOYA admins; TikTok credentials stay on our server.

Your rights

You may request access, correction, or deletion of your account and all associated data by emailing support@gsmkoya.net. We respond within 30 days.

Children

This service is for users aged 18 and over. We do not knowingly collect data from children.

Changes

If this policy changes, we will update the date above.