Legal

Privacy Policy

Effective 10 October 2026 · Version 1.2

This Policy explains how Bomba Holdings Incorporated, a corporation incorporated in the State of Delaware, United States, together with its Mexican affiliate IT Link, S.A. de C.V. (“Bomba”, “we”, “us”), collects, uses and protects personal data when you use the Bomba mobile application and this website (the “Service”). Bomba Holdings Incorporated is the controller of that data; its Mexican affiliate IT Link, S.A. de C.V., processes it on its behalf for operations in Mexico.

1. The short version

We collect as little as we can. We never hold your private keys. We never receive or process your payment card or bank details — those go directly to the licensed payment provider you choose. We do not sell personal data and we do not share it for advertising.

Bomba is focused on Mexico. The Service is not available in the restricted jurisdictions listed in our Terms, and access from them is blocked. To enforce this we use your IP address and device region to determine the country you are connecting from.

2. What we collect

• Account data. An email address or other identifier you use to sign in, and the public on-chain address of the self-custodial account created for or connected by you.
• Device and technical data. Device model, operating system version, app version, language and region settings, IP address, crash reports and diagnostic logs.
• Usage data. Which screens you open and which features you use, so we can find defects and improve the product.
• Support data. The contents of any message you send us.
• Waiting list. If you save your spot on this website: your WhatsApp number, the code of the person who invited you (if any), the campaign of the link you arrived from and, if you answer it, your reply to “What are you most into?”. We use them to check the number is yours, give you your spot in line and tell you on WhatsApp when it’s your turn.
• Public blockchain data. Transactions you authorise are recorded on public blockchains by design. We read that public data to show you your positions. We do not control it and it cannot be deleted or altered by us or by you.

3. What we never collect

• Private keys, seed phrases or recovery secrets. Your account is self-custodial; key material is handled by our third-party account infrastructure provider and by you. We cannot access it.
• Payment credentials. Card numbers, bank details and the identity documents required for a payment provider’s own verification are submitted directly to that provider and are never received or stored by us.
• Special-category data. We do not seek data about health, beliefs, political opinions, biometrics or similar.

4. Why we use it, and on what legal basis

• To provide the Service — to create your account, display your positions and let you submit transactions. Basis: performance of a contract with you.
• To keep the Service secure and working — to detect abuse, prevent fraud, diagnose crashes and fix defects. Basis: our legitimate interests in a secure, functioning product.
• To communicate with you — service messages, security notices and replies to your support requests. Basis: contract and legitimate interests.
• To comply with law — where a legal or regulatory obligation applies to us. Basis: legal obligation.

We do not use your personal data for automated decision-making that produces legal effects for you, and we do not use it for behavioural advertising.

5. Who we share it with

We share personal data only with service providers who process it on our behalf under contract, and only as far as needed:

• Messaging — WhatsApp (Meta), to send you the waiting list’s verification code and the message when it’s your turn.
• Account infrastructure — to create and secure your self-custodial account.
• Payment providers — where you choose to add funds to your account, you deal with the provider directly under its own privacy policy and its own terms; we may receive the status of a transaction, but not your payment credentials.
• Cloud hosting, error monitoring and product analytics — to run and maintain the Service.
• App distribution — Apple, in connection with distributing and installing the application.
• Professional advisers, and authorities where we are legally required to disclose, or where disclosure is necessary to establish or defend legal claims.

If Bomba is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

We do not sell personal data and we do not share it with third parties for their own marketing.

6. International transfers

We are established in the United States and our service providers may process data in the United States, the European Economic Area and elsewhere. Where data is transferred out of the EEA, the United Kingdom or Mexico, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

We keep personal data only as long as needed for the purposes above: account data for as long as your account is active and for a reasonable period afterwards; technical and usage logs typically for up to 24 months; support correspondence for up to 24 months after the matter is closed. We keep data longer only where a law requires it or where it is needed for a legal claim.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict our processing of it, to receive a portable copy, and to withdraw consent where processing is based on consent. Users in Mexico have the ARCO rights (access, rectification, cancellation and opposition) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares.

To exercise a right, write to alejandro@trybomba.xyz. We will respond within the period required by the law that applies to you. You also have the right to complain to your local data protection authority.

Please note that we cannot delete data recorded on a public blockchain, and we cannot delete data held by a third-party payment provider — those requests must go to that provider.

9. Security

We use encryption in transit, access controls and the principle of least privilege, and we limit the personal data we collect in the first place. No system is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant authority.

10. Children

The Service is not directed to anyone under 18 and we do not knowingly collect personal data from children. If we learn that we have, we will delete it.

11. Cookies and this website

This website uses no advertising cookies and no third-party tracking. It loads a web font from Google Fonts, which involves a request to Google’s servers from your browser. If you save your spot in line, the site keeps an identifier in your browser to show you your spot when you come back; it isn’t a cookie, and “Use another number” deletes it.

12. Changes

We may update this Policy. The current version is always published at this address with its effective date, and we will notify you of material changes in the application or by email where we hold your address.

13. Contact

Bomba Holdings Incorporated
alejandro@trybomba.xyz