Privacy Policy

Rojly ("we", "us", "our") is a social media advertising management platform operated from Iraq, helping advertisers create and manage ad campaigns on Meta (Facebook, Instagram) and TikTok. This policy explains what information we collect, how we use it, and your rights.

The Rojly application (App ID 925656943702305 on Meta Platforms) is owned and operated by Jaffer Muddaffar Trading. Contact: privacy@rojly.app.

We collect the following types of information:

• Account information: name, phone number, email, business name, and city when you sign up.
• Advertising assets you provide: ad images, captions, calls-to-action, target audiences, budgets, landing page content, and form fields.
• Facebook / Instagram data: when you connect your Facebook Page to Rojly, we receive the Page ID, Page name, and access permissions necessary to publish and report on ads from your Page.
• TikTok data: if you connect a TikTok Business account, the authorization code you provide and the resulting advertiser ID.
• Campaign performance data: impressions, clicks, spend, conversions, and other metrics returned by Meta and TikTok APIs in connection with ads we run on your behalf.
• Lead information: data submitted to your landing pages by your customers (e.g., name, phone, address). You are the data controller for these leads; we are a processor on your behalf.
• Wallet and transaction data: top-ups, ad spend deductions, commission charges, and subscription status.
• Device and usage data: device identifiers, Firebase Cloud Messaging tokens for push notifications, IP addresses on landing-page lead submissions, and basic app usage telemetry for stability and security.

• To create, manage, and report on ad campaigns you authorize.
• To bill the wallet, calculate commission, and process subscription access (Plus tier).
• To deliver landing pages and forward submitted leads to you.
• To send transactional notifications (low balance, ad status changes, lead notifications) via push notifications and Telegram (only when you opt in).
• To prevent abuse, comply with applicable law, and improve service quality.

We use data accessed through Meta APIs solely to operate the Rojly service for you. Specifically:

• We do not sell, lease, or otherwise transfer Meta data to third parties for advertising or analytics.
• We do not use Meta data to enrich profiles or build advertising audiences outside of campaigns you explicitly create.
• We retain Meta data only as long as needed to operate your active campaigns and produce reports, after which it is deleted or anonymized.
• We comply with the Meta Platform Terms and Developer Policies, including all data handling and security requirements.

We share information only with:

• Meta Platforms, Inc. — to create and manage ads on your Page through the Meta Marketing API.
• TikTok — when you have connected a TikTok account, to manage TikTok ad campaigns.
• Google Cloud / Firebase — our hosting, authentication, database, and push-notification infrastructure providers.
• Telegram — only the lead summary text you opt to forward to your own Telegram chat.
• Google Sheets — only the lead rows you opt to mirror into a spreadsheet you own.
• Iraqi payment processors (Zain Cash, Qi Card, FIB, FastPay) — when you initiate a wallet top-up.
• Authorities — when required by valid legal process under Iraqi law.

We never sell personal data. We do not share with advertisers, analytics networks, or data brokers.

Data is stored in Google Cloud (Firestore, Cloud Storage) primarily in the europe-west4 region. Sensitive credentials (API tokens, payment gateway keys) are stored in Google Secret Manager and encrypted at rest. Transport between your device and our servers is encrypted with TLS.

Access to production data is restricted to designated administrators and is audited.

We retain account information for as long as your account is active and for up to 24 months after closure for accounting and dispute purposes. Lead and campaign performance data is retained for up to 24 months unless you request earlier deletion. Backups may persist for up to 90 days after deletion.

You may at any time request to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your account and associated data (see Section 9 — Account & Data Deletion below).
• Export your leads and campaign data.
• Disconnect any connected Meta or TikTok account at any time.

To exercise these rights, email privacy@rojly.app. We respond within 30 days.

You can request deletion of your Rojly account and the data associated with it at any time, free of charge.

How to request deletion

1. Send an email to support@rojly.app from the email address registered to your Rojly account.
2. Use the subject line "Account Deletion Request" and include the phone number used to sign up.
3. We verify your identity by replying to your registered email or sending a one-time code to your registered phone number.
4. Deletion is completed within 14 calendar daysof verification. You receive a confirmation email when it's done.

What gets deleted

• Account profile (name, phone, email, business details).
• Wallet balance — refunded to you (or, with your written consent, donated) before account closure.
• Landing pages you created and all leads collected through them.
• Stored credentials and tokens for your connected Facebook, Instagram, and TikTok accounts. Rojly's access to those accounts is revoked.
• Saved ad creatives, captions, targeting presets, and draft campaigns.
• Push notification tokens and device identifiers.

What may be retained

A limited set of records is retained only where required by law or to protect Rojly against fraud:

• Financial transaction records (top-ups, ad-spend deductions, refunds, commission charges) — retained up to 7 years for Iraqi tax and bookkeeping compliance, in anonymized form where possible.
• Operational and security logs — retained up to 90 days in the ordinary course, then deleted.
• Encrypted backups — purged from active systems immediately, and removed from rotating backups within 30 days.

Deleting your Rojly account also revokes Rojly's access to any Facebook Page or TikTok Business account you previously connected, but does not delete those accounts on Meta or TikTok's platforms — those are managed by you separately on those services.

A standalone version of these instructions is also available at rojly.app/delete-account.

Rojly is intended for businesses and adults aged 18+. We do not knowingly collect data from children under 13.

Some of our processors (Google, Meta, TikTok, Telegram) may store and process data outside Iraq, including in the EU and the US. By using Rojly you consent to such transfers, which are protected by the standard contractual safeguards published by those providers.

We will post any changes to this policy on this page and update the "last updated" date. Material changes will be communicated via in-app notification or email.

For privacy questions, complaints, or data access requests:
Email: privacy@rojly.app
Address: Baghdad, Iraq.