Privacy Policy

Article I: Binding Nature and Incorporation

1.1 Binding Contract and Incorporation by Reference

This Policy constitutes a legally binding agreement between Zaboca Holdings Inc. and each User of the Application. This Policy is incorporated by reference into the BNS Terms of Service (the "Terms"), available at blacknosugar.app/terms, which Terms govern Users' access to and use of the Application. By creating an Account, accessing the Application, submitting information via the Application, or otherwise using any Application features or services, Users expressly acknowledge that they have read, understood, and agree to be bound by this Policy in its entirety.

1.2 Scope and Application

This Policy applies to all Personal Information collected by Zaboca Holdings Inc. through or in connection with the Application, including but not limited to: (a) information provided directly by Users during account creation or use of the Application's debt-planning features; (b) information collected automatically through Users' interactions with the Application, including device information and diagnostic data; (c) information obtained from third-party sources including account-aggregation providers and platform billing systems; and (d) information derived from the User's own financial entries, such as projections and payoff comparisons computed from that data. This Policy does not apply to information collected by third-party websites, applications, or services linked from the Application, which are governed by their own privacy policies.

1.3 Amendments and Updates

Zaboca Holdings Inc. reserves the right, in its sole and absolute discretion, to modify, amend, supplement, or replace this Policy at any time to reflect changes in data practices, legal or regulatory requirements, technological capabilities, business operations, or for any other reason deemed appropriate. Material changes to this Policy shall be communicated to Users via: (a) email notification sent to the email address associated with the User's Account; (b) prominent in-app notification displayed upon the User's next Application access; or (c) prominent notice on the Application's website homepage. Material changes shall take effect thirty (30) calendar days following notice to Users unless a shorter period is required by law or is necessary for immediate implementation due to security or legal compliance needs. Users' continued use of the Application following the effective date of amendments constitutes express acceptance of the amended Policy.

Article II: Definitions and Interpretation

2.1 Defined Terms

To ensure precision, clarity, and legal enforceability, the following capitalized terms shall have the meanings ascribed to them throughout this Policy:

(a) "Account" means the User profile and associated credentials created by a User to access and use the Application, including the User's household composition, debt facility records, and consent settings.

(b) "Aggregation Provider" means the third-party, read-only bank/loan account-aggregation service the Company engages to retrieve balance and transaction data at a User's election, which service is never granted write or transfer permissions of any kind.

(c) "Data Controller" means the natural or legal person which, alone or jointly with others, determines the purposes and means of the Processing of Personal Information. Zaboca Holdings Inc. is the Data Controller with respect to all Personal Information collected via the Application.

(d) "Data Processor" means a natural or legal person which processes Personal Information on behalf of the Data Controller. Caimite Technologies Limited acts as a Data Processor with respect to certain data processing activities conducted on behalf of Zaboca Holdings Inc.

(e) "Debt Facility Data" means the balances, interest rates, terms, servicer identifiers, and related figures a User enters or links for any mortgage, revolving credit line, auto loan, education loan, or other personal debt, together with the projections, comparisons, and recommendations the Application computes from that data.

(f) "Path A" means the structural design commitment, described fully in the Terms of Service, under which the Application never takes custody of a User's funds, never initiates a payment, and never connects to a payment rail — the Application computes a payment instruction only, which the User alone reviews and executes.

(g) "Payment Instruction" means the amount, target account, and servicer information the Application computes and displays for the User's own manual execution, which is not itself a transfer, payment order, or instrument capable of moving funds.

(h) "Personal Information" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, financial account information, debt terms and balances, device identifiers, IP address (in hashed form), captured statement or receipt content, and any other information that alone or in combination with other information can be used to identify an individual.

(i) "Processing" or "Process" means any operation performed on Personal Information, whether or not by automated means, including collection, storage, use, disclosure, or erasure.

(j) "Pooled Inference" means the Application's optional, opt-in feature under which anonymized patterns derived in aggregate from consenting Users' Debt Facility Data may inform a general, non-authoritative suggestion shown to other Users.

(k) "Sensitive Personal Information" means Personal Information that reveals financial account numbers, linked-account tokens, or biometric data, to the extent such biometric data ever reaches the Company's systems (which, as described in Article IV, it does not).

(l) "Third-Party Service Provider" means any natural or legal person, other than Zaboca Holdings Inc. or Caimite Technologies Limited, that provides services to Zaboca Holdings Inc. in connection with the Application, including the Aggregation Provider, the statement/receipt parsing provider, Apple and Google's billing systems, and the Company's crash-reporting provider.

2.2 Interpretation

In the interpretation and construction of this Policy: (a) article, section, and subsection headings are provided for convenience only and shall not affect interpretation; (b) the singular includes the plural and vice versa; (c) the words "including," "includes," or similar phrases mean "including but not limited to"; (d) references to laws include all amendments and successor provisions; and (e) "writing" and "written" include electronic communications.

Article III: Data Controller and Processor Roles

3.1 Data Controller Designation

Zaboca Holdings Inc. is the Data Controller for all Personal Information collected via the Application and is responsible for determining the purposes and means of Processing and for compliance with applicable data protection law.

3.2 Data Processor Designation

Caimite Technologies Limited, a wholly-owned subsidiary of Zaboca Holdings Inc., acts as a Data Processor with respect to certain regional technical operations and support activities conducted on behalf of Zaboca Holdings Inc. Caimite Technologies Limited processes Personal Information solely on behalf of, and under the instructions of, Zaboca Holdings Inc. and does not determine the purposes or means of Processing.

3.3 Third-Party Processors

Zaboca Holdings Inc. engages a narrow, fixed set of Third-Party Service Providers to perform data processing activities on its behalf, enumerated in Article VIII. All such providers are contractually bound to process Personal Information only in accordance with the Company's instructions, to implement appropriate security measures, and to comply with applicable data protection law. Zaboca Holdings Inc. remains responsible for the acts and omissions of its Third-Party Service Providers to the extent required by applicable law.

3.4 Contact Information for Data Controller

For inquiries, requests, or complaints regarding Zaboca Holdings Inc.'s Processing of Personal Information, Users may contact:

Data Protection Contact
Zaboca Holdings Inc.
Email: support@zaboca.org
Address: 254 Chapman Rd, STE 208, Newark, DE 19702, USA

Article IV: Categories of Personal Information Collected

4.1 Account and Authentication Information

When a User creates an Account, Zaboca Holdings Inc. collects: (a) an email address and password, or an Apple Sign-In or Google Sign-In identifier; and (b) household composition, currency, and timezone settings necessary to compute the User's figures correctly. The Company does not require a User's legal name, physical address, or phone number to create or use an Account.

4.2 Debt Facility Data

The core of what the Application collects is Debt Facility Data as defined in Article II: balances, interest rates, terms, and identifying labels for mortgages, revolving credit, auto loans, education loans, and other personal debt the User enters, together with the resulting payoff projections, cadence comparisons, sweep recommendations, goals, refinance scenarios, tax-arbitrage analyses, and related alerts the Application computes. This category is not optional; it is the data the Application exists to compute against.

4.3 Bank and Loan Connection Data

If, and only if, a User elects to connect a bank or loan account through the Aggregation Provider, Zaboca Holdings Inc. receives: (a) a tokenized reference to the linked account, never the User's raw account number; and (b) read-only balance and transaction data. This connection is optional in every respect, cannot be used to move money, and the Company does not request write or transfer permissions from the Aggregation Provider under any circumstance.

4.4 Receipt and Statement Capture Data

If a User elects to use the Application's optional receipt/statement capture feature, the Company collects photographs of receipts or statements and the line-item data extracted from them. Captured images are run through an automated PII-redaction step before any extracted text is stored; the raw image is destroyed after that step and is not retained in the Company's systems.

4.5 Device-Local Biometric Data

The Application's optional Face ID / fingerprint app-lock is processed entirely on the User's device by the operating system's authentication framework. This category of data is described here for completeness, but as a structural matter, it never reaches, and is never collected by, Zaboca Holdings Inc.'s systems.

4.6 Diagnostic, Notification, and Consent Data

Zaboca Holdings Inc. additionally collects: (a) crash reports and stack traces transmitted to its crash-reporting provider with personal identifiers scrubbed before transmission; (b) push-notification device tokens, used solely to deliver account-relevant alerts and never marketing communications; and (c) records of which consent-gated features (Pooled Inference, bank connection) a User has enabled, together with a hashed — never raw — IP address recorded at the time of consent and on security-relevant account actions.

Article V: Methods of Information Collection

5.1 Direct Collection from Users

The substantial majority of Personal Information collected by Zaboca Holdings Inc. is entered directly by Users through: (a) account registration; (b) entry of Debt Facility Data; (c) optional connection of a bank or loan account; (d) optional use of receipt/statement capture; and (e) direct communication with the Company's support channel.

5.2 Automatic Collection

Zaboca Holdings Inc. automatically collects crash diagnostics and push-notification tokens as described in Section 4.6, via the Application's embedded crash-reporting library and the device operating system's push-notification framework, respectively.

5.3 Collection from Third-Party Sources

As described in Section 4.3, Zaboca Holdings Inc. collects read-only balance and transaction data from the Aggregation Provider, but only where and to the extent a User has affirmatively connected a bank or loan account.

Article VI: Legal Bases for Processing Personal Information

6.1 Performance of Contract

Zaboca Holdings Inc. processes Personal Information as necessary to perform the Terms of Service contract between the Company and Users, including creating and maintaining Accounts, computing debt payoff figures, and providing customer support.

6.2 Consent

The Company processes certain Personal Information based on a User's affirmative, revocable consent, including: (a) connection of a bank or loan account through the Aggregation Provider; (b) use of receipt/statement capture; and (c) enrollment in Pooled Inference. Users may withdraw consent at any time as described in Article XI.

6.3 Legitimate Interests

Zaboca Holdings Inc. processes Personal Information based on the Company's legitimate interests, where such interests are not overridden by a User's data protection rights, including fraud prevention, security monitoring, maintaining the audit trail described in Article IX, and improving the Application.

6.4 Legal Obligation

The Company processes Personal Information as necessary to comply with legal obligations, including responding to lawful legal process and complying with applicable tax and recordkeeping requirements under Delaware and U.S. federal law.

6.5 Trinidad & Tobago Data Protection Act

For Users located in Trinidad & Tobago, Zaboca Holdings Inc. processes Personal Information consistent with the principles of the T&T DPA — necessity for contract performance, compliance with legal obligation, and consent — as more fully described in Article XVI.

Article VII: Use of Personal Information

7.1 Application Operation and Service Delivery

Zaboca Holdings Inc. uses Personal Information to operate and deliver the Application, including to: (a) create and maintain Accounts; (b) compute payoff projections, cadence comparisons, and Payment Instructions from Debt Facility Data; (c) retrieve linked-account balances where a User has connected a bank; (d) process captured receipts/statements through PII redaction; (e) deliver account-relevant push notifications; and (f) provide customer support.

7.2 Path A Boundary on Use

7.3 Pooled Inference

If a User enables Pooled Inference — off by default — anonymized patterns derived from that User's Debt Facility Data may inform a general suggestion shown to other Users. No Sweep recommendation, projection, or other confirmed figure shown to any User is ever derived from Pooled Inference; it may only ever surface as a general, non-authoritative suggestion. A User may disable this feature at any time, which stops the use of that User's data for this purpose going forward.

7.4 Security, Fraud Prevention, and Legal Compliance

Zaboca Holdings Inc. uses Personal Information to detect and prevent fraud and abuse of the Application (including anti-abuse measures for the free trial described in Section 9.2), to maintain the security audit trail described in Article IX, to enforce the Terms of Service, and to comply with legal process and applicable law.

7.5 No Advertising or Behavioral Use

Zaboca Holdings Inc. does not use Personal Information to build advertising profiles, does not integrate third-party ad networks or behavioral advertising SDKs into the Application, and does not accept lender-paid placement, referral fees, or commissions for anything the Application displays.

Article VIII: Disclosure of Personal Information

8.1 Disclosure to Caimite Technologies Limited

As described in Article III, Caimite Technologies Limited acts as a Data Processor and processes certain Personal Information on behalf of Zaboca Holdings Inc. for regional technical operations and support, under the Company's instructions and subject to the Company's security requirements.

8.2 Disclosure to the Aggregation Provider

If a User connects a bank or loan account, Zaboca Holdings Inc. shares the credentials or tokens necessary for the Aggregation Provider to retrieve that User's linked balances and transactions, read-only. This disclosure occurs only upon the User's affirmative election and never grants the Aggregation Provider, the Company, or anyone else the ability to move funds through that connection.

8.3 Disclosure to the Parsing Provider

If a User uses receipt/statement capture, the Company shares the captured image transiently with its statement/receipt parsing (OCR) provider for the sole purpose of extracting line-item text before the Company's redaction step runs.

8.4 Disclosure to Platform Billing Systems

If a User purchases BNS Pro, Zaboca Holdings Inc. receives subscription purchase, renewal, and cancellation events from Apple's App Store or Google Play billing systems, verified server-side via signature-verified webhooks, to grant or revoke Pro access. The Company never receives card numbers or other payment credentials — those remain with Apple or Google.

8.5 Disclosure to Crash-Reporting Provider

Zaboca Holdings Inc. shares crash reports and stack traces with its crash-reporting provider, with personal identifiers scrubbed before transmission.

8.6 Disclosure for Legal Reasons

Zaboca Holdings Inc. may disclose Personal Information to law enforcement, regulatory authorities, courts, or other third parties when the Company believes in good faith that disclosure is necessary to comply with legal process, enforce the Terms of Service, detect or prevent fraud, or protect the rights, property, or safety of the Company, Users, or the public.

8.7 Disclosure in Business Transactions

If Zaboca Holdings Inc. is involved in a merger, acquisition, asset sale, or similar transaction, Personal Information may be disclosed or transferred to the acquiring or surviving entity, subject to that entity honoring this Policy or providing Users with notice of any changes to data practices.

8.8 No Sale of Personal Information

Zaboca Holdings Inc. does not sell Personal Information to third parties for monetary or other consideration, and does not "sell" or "share" Personal Information as those terms are defined under the CCPA/CPRA or comparable state statutes. The disclosures described in this Article VIII are made solely to the fixed set of Third-Party Service Providers necessary to operate the features described in Article IV, and for no other purpose.

Article IX: Data Retention

9.1 Retention Principles

Zaboca Holdings Inc. retains Personal Information for as long as necessary to fulfill the purposes for which it was collected, to provide the Application, to comply with legal obligations, and for other legitimate business purposes, and deletes or anonymizes it thereafter, subject to the exceptions below.

9.2 Category-Specific Retention

(a) Debt Facility Data, linked-account data, captures, goals, and alerts: retained for the duration of the Account and deleted outright, in-app or via the web-based deletion request described in Article XI, when the User deletes the specific item or closes the Account.

(b) Account profile: anonymized rather than hard-deleted on Account closure. The Company retains a non-identifying tombstone record proving the deletion occurred, carrying no name, email, or financial data, so that the completion of an erasure can be demonstrated if ever required.

(c) Security audit log of a User's own account actions: retained and not individually deletable on request, because it is the evidence that the Company's security and deletion controls in fact ran. A User may export their own audit trail at any time.

(d) Records of a User's own export or deletion requests: retained as proof that the User exercised that right, even after the underlying data is gone.

(e) Anti-abuse trial records: retained as one-way, salted hashes not linked to identity, so the one-week free trial cannot be repeatedly re-claimed after deletion; these hashes cannot be reversed to identify a User.

(f) Platform configuration and reference data: not personal data about any User and not part of any deletion request.

9.3 Backup Systems

Personal Information may remain in the Company's backup or disaster-recovery systems for a limited period after deletion from active systems, for technical continuity reasons, and is purged from backups on the Company's ordinary backup rotation schedule.

Article X: Security Measures

10.1 Security Commitment

Zaboca Holdings Inc. implements technical, administrative, and physical security measures designed to safeguard Personal Information against unauthorized access, disclosure, alteration, or loss, including encryption of data in transit, encryption or tokenization of sensitive fields at rest (linked-account tokens, servicer references), hashing of IP addresses recorded for consent/audit purposes, access controls, and an internal security audit trail.

10.2 Payment Information Security

Zaboca Holdings Inc. does not collect, process, or store payment card numbers or other payment credentials. Pro subscription payment is handled entirely by Apple's or Google's billing systems, which are subject to their own security standards.

Article XI: User Rights and Control Over Personal Information

11.1 Right of Access and Export

Users have the right to a full-fidelity export of their Personal Information at any time, in-app or via the web-based request page at blacknosugar.app/delete-my-data. Export content is never limited or withheld to make leaving harder.

11.2 Right to Correction

Because most Personal Information the Company holds is data a User entered directly, Users can correct it in-app at any time. For data not directly editable in-app, Users may contact support@zaboca.org.

11.3 Right to Deletion

Users may delete their Account and associated Personal Information at any time, in-app (Settings → Delete Account) or via the web-based deletion request page, which works without the Application installed. Deletion is subject to the narrow retention exceptions described in Section 9.2.

11.4 Right to Withdraw Consent

Users may disable Pooled Inference or disconnect a linked bank account at any time in Settings, which stops the relevant Processing going forward without affecting the lawfulness of Processing before withdrawal.

11.5 Exercising Rights and Response Time

Requests under this Article XI may be submitted in-app, via the web-based request page, or by emailing support@zaboca.org. Zaboca Holdings Inc. responds to verified requests without undue delay and, in any event, within thirty (30) calendar days. The Company does not charge a fee to exercise these rights.

Article XII: Children's Privacy

The Application is not intended for use by anyone under eighteen (18) years of age or the age of majority in the User's jurisdiction, whichever is greater. Zaboca Holdings Inc. does not knowingly collect Personal Information from children. If the Company learns it has collected Personal Information from a child without appropriate consent, it will delete that information as soon as reasonably practicable. Parents or guardians who believe a child has provided Personal Information to the Company should contact support@zaboca.org.

Article XIII: International Data Transfers

13.1 Cross-Border Transfers

The Application is operated by Zaboca Holdings Inc., a Delaware corporation, and Personal Information is transferred to, stored in, and processed in the United States and, for certain regional technical operations, in Trinidad & Tobago by Caimite Technologies Limited. By using the Application, Users consent to this transfer and processing.

13.2 U.S. Government Access

Users acknowledge that Personal Information stored or processed in the United States may be subject to access by U.S. government authorities under applicable U.S. law. Zaboca Holdings Inc. discloses Personal Information to such authorities only when required by law.

Article XIV: Cookies and Tracking Technologies (Website)

The blacknosugar.app website uses only strictly necessary cookies required for the site to function (for example, session state on the web-based deletion request page). Zaboca Holdings Inc. does not use analytics, advertising, or cross-site tracking cookies on the website, and the Application itself does not use browser cookies at all. Because no non-essential cookies are set, no cookie-consent banner is required or displayed.

Article XV: US State Privacy Rights

15.1 Applicability

This Article XV applies to Users who are residents of California, Virginia, Colorado, Connecticut, Utah, and other U.S. states with comparable consumer privacy statutes, which may provide rights in addition to those described in Article XI.

15.2 Right to Know, Correct, Delete, and Port

Where applicable, Users have the right to know what Personal Information the Company holds about them, to correct or delete it, and to receive it in a portable format — all of which are available through the mechanisms described in Article XI.

15.3 Right to Opt Out of Sale, Targeted Advertising, and Profiling

Zaboca Holdings Inc. does not sell Personal Information and does not use Personal Information for targeted advertising or for profiling in furtherance of decisions producing legal or similarly significant effects. There is accordingly nothing to opt out of on these fronts as of the effective date of this Policy; if this changes, the Company will update this Policy and provide an opt-out mechanism as required by law.

15.4 Non-Discrimination

Zaboca Holdings Inc. will not deny the Application's services, charge different prices, or provide a different level of service to Users who exercise their state privacy rights.

15.5 Authorized Agents

California residents may designate an authorized agent to submit a request on their behalf, subject to identity verification consistent with applicable law.

Article XVI: Notice for Trinidad & Tobago Residents

If a User uses the Application from Trinidad and Tobago, that User's Personal Information is subject to this Policy. The T&T DPA remains, as of this Policy's effective date, only partially proclaimed under Trinidad & Tobago law — most of its individual-rights provisions are not yet in force. Notwithstanding that fact, Zaboca Holdings Inc. applies the same data-minimization, purpose-limitation, and deletion practices described throughout this Policy to Trinidad & Tobago residents as to any other User, and will honor access, export, and deletion requests from Trinidad and Tobago on the same terms described in Article XI.

Article XVII: General Provisions

17.1 Entire Agreement

This Policy, together with the Terms of Service, constitutes the entire agreement between Zaboca Holdings Inc. and Users regarding the collection, use, disclosure, and protection of Personal Information, superseding all prior agreements or understandings relating to such subject matter.

17.2 Severability

If any provision of this Policy is held invalid, illegal, or unenforceable, such provision shall be enforced to the maximum permissible extent, and the remaining provisions shall remain in full force and effect.

17.3 No Waiver

Zaboca Holdings Inc.'s failure to enforce any provision of this Policy shall not constitute a waiver of such provision, right, or remedy.

17.4 Governing Law

This Policy and disputes arising hereunder are governed by the laws of the State of Delaware, United States, without regard to conflict-of-laws principles, except to the extent mandatory local data protection law requires otherwise.

17.5 Assignment

Users may not assign or transfer rights or obligations under this Policy without Zaboca Holdings Inc.'s prior written consent. The Company may freely assign this Policy in connection with a merger, acquisition, or corporate reorganization.

17.6 Language

This Policy is executed in the English language, which shall control in the event of any conflict with a translated version.

17.7 Survival

Provisions of this Policy that by their nature should survive termination of a User's Account survive, including provisions regarding data retention, security, and governing law.

Article XVIII: Acknowledgment and Acceptance

END OF PRIVACY POLICY
Effective Date: August 12, 2026  |  Last Updated: August 12, 2026
© 2026 Zaboca Holdings Inc. All rights reserved.
BNS (Black, No Sugar) is a trade name of Zaboca Holdings Inc., a Delaware Corporation.