Privacy Policy

This Privacy Policy explains how Bash & Crew LLC, doing business as Bumbei ("Bumbei," "we," "us"), collects, uses and shares information when you use the Bumbei website at bumbei.com, the web app at app.bumbei.com, and the Bumbei mobile apps for iOS and Android (together, the "Services"). It applies to users in the United States.

If you have questions, write to us at privacy@bumbei.com.

The short version

• We collect what we need to run a cashback program: your account details, the purchases our partner stores report to us, and how you use the Services.
• We use it to track your purchases, pay you rewards in bitcoin, keep the Services secure and improve them.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
• You can access, correct or delete your data, including deleting your account from inside the app.

Information we collect

Information you give us

• Account information: email address, first and last name, and a password if you choose one. If you sign in with Apple or Google, we receive an identifier for your account and the email address and name that service shares with us. If you use Apple's "Hide My Email," we receive a private relay address.
• Wallet information: the Lightning address or Lightning invoices you provide to withdraw your rewards.
• Optional information: phone number, your favorite stores or categories, and anything you send us when you contact support or report a missing purchase (for example, an order number, amount and date).
• Referral information: the referral code you used to join, and the code you share with others.

Information from partner stores and affiliate networks

When you shop at a store through Bumbei, the store and the affiliate network that connects us with it (such as Impact, AWIN, ActiveJunky and similar networks) report the transaction to us. This usually includes the store, an order or transaction identifier, the purchase date and amount, the commission paid, and its status (pending, confirmed or reversed). We do not receive your payment card details — you pay the store directly.

Information collected automatically

• Device and usage information: IP address, device type, operating system, browser, app version, language, approximate location derived from your IP address, pages and screens viewed, links clicked and the stores you visit through Bumbei.
• Tracking links: when you open a store from Bumbei we create a link with a unique identifier so the store can attribute your purchase to you.
• Cookies and similar technologies: see Cookies and analytics.
• Push notification tokens: if you allow notifications, an identifier for your device so we can notify you about your rewards.

How we use information

We use information to:

• create and secure your account and let you sign in;
• track your purchases, calculate your rewards and pay them to you;
• process withdrawals to the Lightning address or invoice you choose;
• run the referral program and attribute sign-ups to the right campaign or referrer;
• send you service messages (sign-in codes, reward and withdrawal updates, changes to these terms) and, if you opt in, news and offers — you can unsubscribe from marketing emails at any time;
• answer support requests and investigate missing purchases;
• detect and prevent fraud, abuse and violations of our Terms;
• understand how the Services are used and improve them;
• comply with legal obligations and enforce our rights.

How we share information

We share information only as described here:

• Stores and affiliate networks, to attribute and confirm your purchases. They receive the tracking identifier we create, not your name or email.
• Service providers that work on our behalf, such as cloud hosting (for example Railway and Vercel), email delivery, push notifications (Apple, Google Firebase and Expo), analytics (Google Analytics), link shortening, and bitcoin payment processing (Strike, which sends your Lightning withdrawals). They may use the information only to provide their service to us.
• Sign-in providers. If you use Sign in with Apple or Google, those companies process your sign-in under their own privacy policies.
• Legal and safety. When we believe it is required by law, legal process or a government request, or needed to protect the rights, property or safety of Bumbei, our users or others.
• Business transfers. If Bumbei is involved in a merger, acquisition, financing or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.
• With your consent or at your direction.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

Cookies and analytics

We and our partners use cookies, local storage and similar technologies to:

• keep you signed in and remember your preferences (such as your country and language);
• remember how you first arrived at Bumbei (the campaign, referral code and page) for up to 90 days, so sign-ups are credited correctly;
• let stores and affiliate networks attribute your purchases to you after you click through from Bumbei;
• measure traffic and usage with Google Analytics. Google's use of this data is described at policies.google.com/technologies/partner-sites. You can opt out with the Google Analytics opt-out add-on.

You can block or delete cookies in your browser settings. If you block them, purchases may not be tracked and you may not earn rewards. Our Services do not currently respond to "Do Not Track" browser signals; we honor Global Privacy Control signals as a request to opt out of any sharing that would count as a "sale" or "sharing" under state law, although we do not engage in either.

How long we keep information

We keep your information while your account is active and as needed to provide the Services. When you delete your account, we delete or de-identify your personal information within a reasonable time, except where we must keep certain records — for example, records of purchases, rewards and payments that we keep for accounting, tax, fraud-prevention and legal purposes. Those records are kept with restricted access and are not used to contact you.

Your choices and rights

• Access and correction: you can see and update most of your information in your account. You can also ask us for a copy of your data.
• Deletion: you can delete your account in the app (Profile → Delete account) or by requesting it at privacy@bumbei.com. Deleting your account forfeits any rewards still in your balance, as explained in the Terms.
• Marketing: use the unsubscribe link in any marketing email.
• Push notifications: turn them off in your device settings.
• Location and other device permissions: manage them in your device settings.

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with consumer privacy laws), you may have additional rights to know what personal information we collect, to access, correct or delete it, to obtain a portable copy, and to opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We do not sell or share personal information as those terms are defined by these laws. To exercise a right, email privacy@bumbei.com from the address on your account. We will verify your request, respond within the time the law requires, and not discriminate against you for exercising your rights. You may use an authorized agent, and if we deny your request you can appeal by replying to our decision.

California residents

In the last 12 months we have collected these categories of personal information: identifiers (such as name, email, account and device identifiers, IP address); commercial information (purchases reported by partner stores, rewards and withdrawals); internet and network activity; approximate geolocation; and inferences about your shopping interests. We collect them from you, your devices, partner stores and affiliate networks, and service providers, for the purposes described in this Policy, and disclose them for business purposes to the categories of recipients listed in "How we share information." We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.

Security

We use technical and organizational measures to protect your information, such as encryption in transit, hashed passwords and limited access to personal data. No system is perfectly secure, so we cannot guarantee absolute security. Keep your sign-in credentials and email account secure, and tell us right away if you suspect unauthorized access.

Children

The Services are for adults 18 and older. We do not knowingly collect personal information from children under 13 (or anyone under 18). If you believe a child has given us information, contact us and we will delete it.

Bitcoin and third-party services

Lightning payments are recorded by the Lightning wallet and payment services you use, not by Bumbei, and are generally irreversible. Stores, affiliate networks, Lightning wallets and other third-party sites linked from the Services have their own privacy policies, which we encourage you to read.

Changes to this Policy

We may update this Policy. If we make material changes, we will notify you by email or in the Services before they take effect. The "Last updated" date above shows when it last changed.

Contact

Bash & Crew LLC (Bumbei) [Mailing address] privacy@bumbei.com