Privacy Policy

This Privacy Policy explains how Dabog Inc. (“Boga”, “we”) collects, uses, shares and protects personal information when you visit www.bogaclub.com, use the Boga Club member application, or interact with us by email or SMS (together, the “Platform”). It is part of our Terms of Service.

Boga operates the Platform. Grant awards are made by [Boga Foundation] (the “Grant Fund”), the non-profit entity or fiscal sponsor that holds the grant pool. Boga and the Grant Fund share the information needed to run grant cycles, verify recipients and make payouts; both follow this Policy for that information. Boga is the contact point for every privacy request.

The Platform is designed for people in the United States. We do not knowingly offer it to, or collect information from, anyone under 18 (Section 11).

2.1 Information you give us

• Account. Name, email address, U.S. mobile phone number, a password (stored only as a salted hash), your chosen handle, and whether you opted in to marketing email. If you sign in with Google we receive your Google account email and basic profile.
• Profile and business. Avatar, bio, location, website and social links, and optional business details (business name, stage, industry, team size, founding year).
• Content you publish. Ventures (name, description, category, logo, links), pitches (video, cover photo, problem, solution, milestones and budget), posts, comments, likes, saves, community posts and reactions, directory listings (including a business contact email, phone and address), event registrations, and investor showcase profiles (firm, focus, check size, LinkedIn).
• Votes. Which ballot entry you voted for in each cycle. Your individual vote is private; only aggregate tallies are shown.
• Membership and payments. Plan, price, billing period, subscription status and history. Card details are entered directly with Stripe or in the Fiserv CardPointe hosted frame; we receive and keep only a payment token, card brand, last four digits, expiry month/year, the timestamp of your consent to keep the card on file, and transaction outcomes.
• Grant recipient information (only if your pitch wins): government ID images and legal name (and, if you provide it, date of birth) for identity verification; an IRS Form W-9 including your taxpayer identification number (TIN/EIN), entity type and mailing address; payout details (bank account, PayPal or check information); your electronic acceptance of the Grant Agreement; milestone evidence; and messages with the grants team. TINs and payout details are encrypted at rest (Section 9).
• Contributions. Amount, fund, whether you chose to be anonymous, and Stripe’s transaction identifiers.
• Reports, appeals and support. Anything you include when you report content, contact support, or appeal a decision.
• Pre-launch waitlist. Email address and the optional pitch idea you enter on the landing page.

2.2 Information collected automatically

• Session and security data. IP address, browser/device (user agent), sign-in times and outcomes, active sessions, password-reset and verification attempts — used to keep accounts secure and to enforce rate limits.
• Usage data. Pages and pitches viewed, profile views (which power the Free plan’s weekly view allowance), searches, feed interactions, notifications sent and read.
• Audit trail. When you or an Admin take a significant action (billing change, moderation, payout, settings edit) we record who did it, when, from which IP address and browser, and what changed.
• Signature metadata. When you accept a Grant Agreement or submit a W-9 we record the time, IP address and browser as evidence of your electronic signature.
• Cookies and similar technologies — one sign-in cookie, a theme preference, payment-provider security cookies at checkout, and analytics and ad-measurement tags on public marketing pages only. Full list in the Cookie Policy.

2.3 Information from others

Payment processors tell us whether a charge succeeded and, for Stripe Identity, whether a verification passed. Other Members may mention you in content or reports. We do not buy personal information from data brokers.

We use personal information to:

• Run the Platform — create and secure your account, verify your phone, show your profile and content, deliver the feed, ballots, search and notifications, and enforce plan entitlements such as the Free plan’s view allowance and venture slots.
• Bill you — process subscriptions, renewals, upgrades, failed-payment retries, listing fees and contributions; keep our financial ledger; issue invoices and receipts.
• Run grant cycles and grants — build ballots, count votes, confirm winners, verify recipients (KYC, W-9), evaluate milestone evidence, approve and release payouts, and meet tax-reporting duties such as Form 1099.
• Keep the community safe — review submissions before they go live, handle reports, detect fraud, vote manipulation, duplicate accounts and abuse, apply rate limits, and take moderation actions.
• Communicate — send transactional email and SMS (verification, receipts, renewal and dunning notices, cycle results, moderation notices, grant messages), in-app notifications, and marketing email if you opted in.
• Improve and measure — understand how the public site is used (aggregate analytics), measure whether our advertising works, fix bugs, and develop new features.
• Comply with law and protect rights — meet legal, tax, accounting and audit obligations, respond to lawful requests, enforce our Terms and Grant Agreements, and protect Boga, the Grant Fund, Members and the public.

We do not use automated decision-making that produces legal or similarly significant effects about you without human review; grant awards, moderation actions and payouts are decided by people.

Boga Club is a community, so some of what you do is visible to other Members and — for ventures and pitches that are live — to anyone on the internet, including search engines.

• Public: your handle, display name, avatar, bio, location, links and business details; your ventures, pitches, posts and their engagement counts; comments and replies (with your handle); directory listings; investor showcase profiles (to approved Members); grants you have won; event registrations where the host shows attendees.
• Private: your email address and phone number, your individual votes and saves, your membership plan and payment history, profile-view counts, all grant recipient materials (ID, W-9, payout details, evidence, messages), reports you file, and anonymous contributions. Admins and, for grant matters, Non-Profit Admins can see private information as needed to operate the Platform; every admin action is audited.

Think before you post: content you publish may be copied or shared by others, and pitch videos may be shown in marketing about Boga Club and its winners as described in the Terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• With the Grant Fund — everything needed to administer cycles, verify and pay recipients, and meet its own legal duties.
• With service providers who process data on our behalf under contracts that restrict their use of it (table below).
• With other Members and the public as described in Section 4.
• For legal reasons — to comply with law, subpoenas, court orders or government requests; to enforce our Terms and Grant Agreements; to detect and prevent fraud, abuse or security threats; or to protect the rights, property or safety of Boga, the Grant Fund, Members or others. Tax information is reported to the IRS where required.
• In a business transfer — if Boga or the Grant Fund is involved in a merger, acquisition, financing, reorganization or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
• With your direction or consent — for example when you ask us to share something, or connect with an investor.

Service providers we use

Aggregated or de-identified information that cannot reasonably identify you (for example “how many pitches were submitted this cycle”) may be shared freely, including in the public ledger and impact reports.

We use a single first-party sign-in cookie, browser storage for your theme preference and access token, payment-provider security cookies at checkout, and — on the public marketing pages and the pre-launch landing page only — Google Analytics 4 and the OpenAI ads pixel. No analytics or advertising tags run inside the signed-in member app. The Cookie Policy lists every technology, its purpose and duration, and how to control it, including our handling of Global Privacy Control signals.

We keep personal information for as long as needed for the purposes above, and then delete or anonymize it — except where the law, our financial controls, or an ongoing dispute require us to keep it longer. Typical periods:

Backups are rotated on a fixed schedule, so deleted data may persist in backups for a short period before being overwritten.

We use technical and organizational safeguards appropriate to the sensitivity of the data:

• All traffic to the website and API is encrypted in transit (TLS).
• Passwords are stored only as Argon2 hashes; sessions use short-lived access tokens plus rotating, single-use refresh tokens with reuse detection.
• Taxpayer identification numbers and payout details are encrypted at rest with AES-256-GCM under a key held separately from the database; only the last four digits are shown to staff, and revealing full values is limited to super-admins and audited.
• Card numbers never touch our servers — they are handled by Stripe or tokenized in Fiserv’s hosted frame.
• Administrative access is role-based (Admin, Super Admin, Non-Profit Admin), payouts above a threshold require two distinct approvers, and every administrative action is written to an append-only audit log.
• Rate limiting and login-attempt monitoring protect against credential stuffing and abuse.

No system is perfectly secure. If we learn of a breach affecting your personal information we will notify you and regulators as required by law. Help us by using a unique password and reviewing your active sessions.

• Profile and business details can be edited any time in Settings → Profile. To change the email address or phone number on your account, contact support@bogaclub.com.
• Content you posted can be edited or deleted from the venture, pitch, post or comment itself.
• Marketing email: opt in or out in Settings → Notifications or via the unsubscribe link in any marketing email. Transactional messages continue while your account is open.
• SMS: we send only verification codes; reply STOP to any message to stop, but note that an unverified phone limits what your account can do.
• Sessions: sign out of other devices in Settings → Security.
• Analytics and ads: see the Cookie Policy for browser controls and Global Privacy Control.
• Closing your account: go to Settings → Account → Delete account. Your content is hidden at once, subscriptions are cancelled, and after a 30-day grace period (during which you can sign in to restore the account) your personal information is deleted or anonymized, keeping only the records described in Section 7. You can also email support@bogaclub.com from your account address.

Depending on where you live — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws — you may have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, our purposes, and the categories of third parties we share it with, and to receive a portable copy.
• Correct inaccurate personal information.
• Delete personal information we collected from you, subject to exceptions (for example, records we must keep for tax, audit, security or legal reasons).
• Opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information as those terms are defined by these laws, and we honor Global Privacy Control signals as an opt-out.
• Limit the use of sensitive personal information. We use sensitive information (government ID, TIN, financial account details, precise identity data) only to provide the grant you were awarded and to meet legal duties — never for advertising.
• Not be discriminated against for exercising these rights.

How to exercise them

Email privacy@bogaclub.com with the subject “Privacy request”, or write to Dabog Inc., Attn: Privacy, [Street address, City, State ZIP, USA]. Tell us which right you are exercising. We will verify your identity by confirming control of the email address on your account (and, for sensitive requests, additional details), and respond within 45 days, extendable once by 45 days where permitted. An authorized agent may submit a request on your behalf with your signed permission; we may still verify your identity directly. If we deny a request you may appeal by replying to our decision; we will answer the appeal within the period your state’s law requires and tell you how to contact your state attorney general if you disagree.

California disclosures

In the preceding 12 months we collected the categories of personal information described in Section 2 (identifiers, customer records, commercial information, internet activity, geolocation at the city level, audio/visual content you upload, professional information, and — for grant recipients — sensitive information such as government ID and TIN) for the purposes in Section 3, and disclosed them for business purposes to the categories of recipients in Section 5. We have not sold or shared personal information. We do not knowingly collect personal information from anyone under 16. California’s “Shine the Light” law permits residents to request information about disclosures to third parties for their direct marketing; we make no such disclosures.

The Platform is for adults. We do not knowingly collect personal information from anyone under 18 and we delete accounts we learn belong to minors. If you believe a minor has an account, email privacy@bogaclub.com.

Boga Club is offered to people in the United States and our systems are hosted there. If you access the Platform from elsewhere you do so on your own initiative, your information will be transferred to and processed in the United States, and U.S. law will apply. We do not currently offer memberships or grants to people outside the U.S.

Ventures, listings and profiles link to founders’ own websites and social media; pitch videos may be hosted through our media provider; checkout runs on Stripe or in Fiserv’s hosted frame. Those services have their own privacy practices, which we do not control. Content other Members post about you is their responsibility; use the Report control if it breaks our rules.

We will revise this Policy as the Platform evolves — for example when we add a feature that collects new information or start using a new provider. We will post the revised Policy here with a new “last updated” date and, for material changes, notify you by email or in the app before they take effect. Your continued use after the effective date means you accept the revised Policy.

Dabog Inc., Attn: Privacy
[Street address, City, State ZIP, USA]

Privacy requests and questions: privacy@bogaclub.com
Everything else: support@bogaclub.com