Privacy policy

Who we are

Simply Art Creative ("we", "us") is a creative and digital marketing agency in Harare, Zimbabwe, run by Tinotendashe Mananga. We are the controller of the personal data described in this policy.

Contact for anything about privacy: tinomananga@gmail.com, or WhatsApp +263 77 857 0266.

What we collect

When you contact us. Your name, phone number, email address, business name and whatever you write to us on WhatsApp, by email or by phone.

When you are our client. Contact and billing details, briefs, brand files, photographs, videos and other material you give us, and the content we make for you.

When you connect a social media account to our publishing tool. With your permission, the platform sends us:

• your account's basic profile: account ID, name, username and profile picture;
• access tokens that let us act on the account within the permissions you granted;
• the posts, videos and captions we prepare and publish for you, and their publishing status;
• where you allow it, performance data for the account and its posts (views, reach, likes, comments, shares and follower counts).

We do not receive your social media passwords, and we only request the permissions needed to plan, publish and report on your content.

When you visit this website. This website has no sign-up, no cookies, no analytics and no advertising trackers, and its server does not keep a log of visits. The "Work with us" form does not send anything to us: it opens your own WhatsApp or email app with a message for you to send.

How we use it and our legal bases

• To answer your enquiry and send quotes: steps you asked for before a contract (GDPR Article 6(1)(b)).
• To deliver our services, including making content, publishing it to your accounts and reporting on results: performance of our contract with you (Article 6(1)(b)).
• To connect to your social media accounts through each platform's API: your consent, given when you authorise the connection (Article 6(1)(a)). You can withdraw it at any time.
• To invoice, keep accounts and meet tax and legal duties: legal obligation (Article 6(1)(c)).
• To keep our systems secure and to show finished work in our portfolio where you have agreed to it: our legitimate interests (Article 6(1)(f)), balanced against your rights.

We do not sell personal data, use it for advertising profiles, or make decisions about you by automated means that have legal or similarly significant effects.

Data from TikTok, Meta, Google and other platforms

When you connect an account from TikTok, Facebook, Instagram, Threads, YouTube, LinkedIn, X, Pinterest or another platform, we use the data the platform provides only to publish the content you approved, show you its status and report on its performance. We follow each platform's developer terms and policies, and:

• we only access the accounts you connect, and only within the permissions you granted;
• we never post, edit or delete content without your instruction or approval;
• we do not sell, rent or share platform data with data brokers or advertisers, or use it to build profiles of the people who interact with your content;
• we do not use platform data to train artificial intelligence or machine-learning models;
• we keep access tokens on our own server and never share them.

TikTok. We use TikTok's Login Kit and Content Posting API to publish videos and photos to the TikTok accounts you connect, with the permissions you grant. You can remove our access at any time in the TikTok app, in the app-permissions section of Settings and privacy. TikTok's own handling of your data is described in the TikTok Privacy Policy.

Meta (Facebook, Instagram, Threads). You can remove our access in Facebook under Settings and privacy, then Apps and websites, or in Instagram under Settings, then Website permissions. See the Meta Privacy Policy.

Google and YouTube. Our publishing tool uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy. You can remove our access at any time on your Google security settings page. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

LinkedIn, X, Pinterest and others. You can remove our access in each platform's settings for connected or authorised apps. Each platform's own privacy policy applies to its handling of your data.

Who we share it with

We share personal data only with people and companies that help us provide our services, and only as much as they need:

• Social media platforms you ask us to publish to, which receive the content and instructions we send through their APIs.
• Hetzner Online GmbH, which hosts this website and our publishing tool on servers in the European Union (Finland).
• Communication providers you choose to contact us through: WhatsApp (Meta) and Google (Gmail).
• Our team and freelancers, such as designers and photographers working on your project, who are bound to keep it confidential.
• AI tools we may use to help draft content or reports for you, such as Anthropic's Claude. We only share what the task needs, and these providers do not use it to train their models under their business terms. Data from Google APIs is never shared with AI tools for training.
• Authorities, where the law requires it.

If we change who we share data with in a way that matters to you, we will update this policy.

International transfers

We are based in Zimbabwe, outside the European Economic Area, and the data we hold is stored in the EU and accessed by our team in Zimbabwe. Zimbabwe does not have an adequacy decision from the European Commission. Where we receive personal data from the EEA or the UK, we protect it with the European Commission's Standard Contractual Clauses where they apply, or rely on the transfer being necessary to perform our contract with you or to take steps you requested (GDPR Article 49(1)(b)). Some of the providers above also process data in other countries under their own safeguards.

How long we keep it

• Enquiries that don't lead to work: up to 12 months after our last contact.
• Client project files and correspondence: for the length of our work together and up to 3 years after it ends, so we can answer questions and reuse approved material when you ask.
• Social media access tokens and platform data: until you disconnect the account or our contract ends, then deleted within 30 days. Published posts stay on the platform under your control.
• Invoices and accounting records: as long as tax law requires.

When the period ends we delete the data or make it anonymous.

Deleting your data

You can ask us to delete your personal data, including all data we received from TikTok, Meta, Google or any other platform, at any time:

• email tinomananga@gmail.com or send a WhatsApp message to +263 77 857 0266 with the subject "Delete my data" and the accounts concerned;
• or remove our access in the platform's own settings (see "Data from TikTok, Meta, Google and other platforms" above) and tell us, so we delete what we already hold.

We will confirm and delete the data within 30 days, except for anything the law requires us to keep, which we will tell you about.

Your rights

Under the GDPR, the UK GDPR and Zimbabwe's Cyber and Data Protection Act, you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it, including use based on our legitimate interests;
• receive data you gave us in a portable format;
• withdraw your consent at any time, without affecting what we did before you withdrew it.

To use any of these rights, contact us as above. We answer within one month. You can also complain to the data protection authority where you live or work (in the EU, see the list of EU authorities), or in Zimbabwe to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority.

Security

This website and our publishing tool are served over encrypted connections (HTTPS). Server access is limited to our team using key-based logins, and we only give people the access their work needs. No system is perfectly secure; if a breach puts your data at risk we will tell you and the relevant authority as the law requires.

Children

Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18, and our publishing tool must not be connected to an account belonging to a child.

Changes to this policy

We will update this page when our practices change and change the date at the top. If a change affects how we use data you already gave us, we will tell our clients directly.