Privacy Policy

Version 2026-09-21 · Draft for legal review. This policy is written to satisfy the EU GDPR, the UK GDPR, the UAE Personal Data Protection Law (Federal Decree-Law 45/2021) and US state privacy laws (including the CCPA/CPRA). [Counsel: insert the legal name and address of the data controller and, where required, the EU/UK representative and Data Protection Officer.]

1. What we collect

• Account: name, email, password hash, two-factor and passkey credentials, country, profile handle.
• Business sellers: legal name, registration and tax numbers, address, website.
• Marketplace activity: listings, photos, orders, shipping addresses, messages, reviews, disputes.
• Wallet and payments: deposit addresses, on-chain transaction IDs, balances, withdrawal destinations and, above legal thresholds, beneficiary details.
• Identity verification (KYC): documents and data you submit, and the result. Where we use a verification provider, they process this on our behalf.
• Technical: IP address, device and browser information, security logs. We do not use advertising cookies; our analytics are cookieless.

2. Why we use it and on what legal basis

Purpose	Legal basis (GDPR/UK GDPR)
Running your account, orders, escrow and wallet	Performance of a contract
Identity verification, sanctions screening, transaction monitoring, record keeping	Legal obligation (anti-money-laundering and sanctions laws)
Fraud prevention, platform security, dispute resolution	Legitimate interests
Order updates, messages, security emails	Performance of a contract
Product analytics (aggregated, cookieless)	Legitimate interests
Marketing emails (only if you opt in)	Consent

3. Who we share it with

Sellers see the shipping address for orders they fulfil, and buyers see the seller's business details. Service providers act on our instructions: hosting (Vercel, Railway, Neon, Upstash, Cloudflare), email delivery (Resend), blockchain infrastructure (Alchemy and public node operators), identity verification and sanctions-screening providers, error monitoring (Sentry). We disclose data to regulators, law enforcement and courts when legally required, and to a successor if our business is transferred.

4. International transfers

Our providers process data in the EU, UK and US. Transfers out of the EU/UK rely on adequacy decisions or the EU Standard Contractual Clauses / UK International Data Transfer Addendum. Transfers out of the UAE follow the PDPL's adequacy and contractual mechanisms.

5. How long we keep it

• Account and profile data: while your account is open, then deleted or anonymised within 30 days of a deletion request.
• Financial and identity records (orders, ledger entries, wallet transactions, KYC results): kept for at least 5 years after the relationship ends, as required by anti-money-laundering laws in the EU, UK, US and UAE, even if you delete your account.
• Messages and disputes: 2 years after the related order closes, or longer if needed for a legal claim.
• Security logs: 12 months.

6. Your rights

Depending on where you live you can ask us to access, correct, export, delete or restrict your data, object to processing based on legitimate interests, and withdraw consent. Use Account → Settings → Privacy to download your data or request deletion, or email privacy@bolimber.com. We answer within one month (EU/UK), 45 days (California) or as the UAE PDPL requires. You can complain to your data-protection authority (for example the ICO in the UK, your national authority in the EU, the UAE Data Office). We never sell personal data and do not share it for cross-context behavioural advertising.

7. Security

Encryption in transit, hashed passwords, two-factor authentication, role-restricted admin access with an audit log, rate limiting, and monitored backups. No system is perfectly secure; report concerns to security@bolimber.com.

8. Children

Bolimber is for adults (18+). We do not knowingly collect data from children.

9. Changes

We will post updates here and, for material changes, notify you in the app or by email.