Privacy Policy

TCI Holdings Group (“we”, “us”, “our”), [registered office address], operates the Volcano Ads website and the Volcano Ads advertising platform. We are the data controller for the personal data described in this policy.

This single policy covers both:

• the public Volcano Ads website, including its landing pages (the “Website”); and
• the Volcano Ads advertising platform and dashboard, including account creation, wallet funding, campaign management and reporting (the “Platform”).

It explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have. Where we say “you”, we mean visitors to the Website and the individuals who create or use Platform accounts, including people acting for a business.

Account and profile data (Platform). When you register we collect your first and last name, email address, phone number, company name, Telegram ID and a password. You may later add a job position. Passwords are stored only as a salted cryptographic hash; we never see the plain password. We also record whether your email is verified and an “admin” label for staff accounts.

Wallet and transaction data (Platform). When you fund your account we assign deposit addresses to you on supported blockchains (an EVM address and, where offered, a Tron address) and record the transaction hash, sending wallet address, token, network, amount and verification status of each deposit, together with your resulting balance and spend history. Note that blockchain transactions are public by design — see section 8.

Campaign data (Platform). Campaign names, destination URLs, targeting choices (countries, devices, browsers), budgets and bids, schedules, event names, comments, and any tracking or postback URLs you provide. Campaign data may include personal data of third parties only if you put it there — you are responsible for that content.

Performance data (Platform). Aggregated impressions, clicks, conversions and spend per campaign, day and event. These are counts, not profiles of end users. If your postback URLs carry identifiers such as click IDs, we process them only to attribute conversions to your campaigns.

Usage and device data (Website and Platform). Server logs and security records such as IP address, browser and device type, pages requested, timestamps, approximate location derived from IP, and the time you last accessed your account.

Communications. Messages you send us, including support requests, and our replies.

Verification data. Where we need to confirm your identity, business or source of funds under our Terms or the law, we may ask for identity documents, company records or proof of wallet ownership.

We do not knowingly collect data from anyone under 18; the Services are for businesses only.

We keep this minimal. The Website and Platform currently use:

• Authentication session cookies, set by our authentication provider when you sign in, so you stay signed in and your requests are protected. These are strictly necessary and expire when the session ends or you sign out.
• Browser local storage for your display preferences, such as light or dark theme. This never leaves your device.

We do not currently use third-party advertising or tracking cookies on the Website or Platform. If we introduce analytics or similar tools we will update this policy and, where the law requires it, ask for your consent first.

You can block or delete cookies in your browser settings, but the Platform will not work without the authentication cookie.

We use personal data to:

• create and administer your account, authenticate you and keep it secure;
• generate your deposit addresses, verify deposits against public blockchains and maintain your balance and transaction history;
• build, deliver and optimise your campaigns through our delivery networks and partners;
• produce reports, resolve reporting disputes and handle billing;
• send transactional messages — for example email verification, password resets, deposit confirmations and campaign status changes;
• provide support and respond to your requests;
• detect and prevent fraud, invalid traffic, abuse, security incidents and breaches of our Terms;
• meet legal obligations, including anti-money-laundering, sanctions, tax and record-keeping rules, and respond to lawful requests from authorities;
• understand how the Services are used so we can maintain and improve them;
• with your consent where required, send you marketing about our Services. You can opt out at any time.

Where data-protection laws such as the GDPR or UK GDPR apply, our legal bases are: performance of our contract with you (account, deposits, campaigns, reporting, support); our legitimate interests (security, fraud prevention, improving the Services, internal operations) balanced against your rights; compliance with legal obligations; and consent, where we ask for it. We do not use personal data for automated decisions that have legal or similarly significant effects on you.

We do not sell personal data. We share it only as described here:

• Service providers acting on our instructions, including our authentication and database provider, cloud hosting, email delivery, blockchain node and RPC providers used to verify deposits, and messaging services (including Telegram) used for operational alerts to our team.
• Advertising delivery partners — the networks, channels, publishers and platforms through which your campaigns run. They receive the campaign content and targeting needed to deliver it (for example your creatives, destination URLs and targeting settings), not your account credentials or wallet history.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality.
• Authorities, regulators and law-enforcement where the law requires it, to protect our rights or safety, or to enforce our Terms.
• A buyer or successor in the event of a merger, acquisition, financing or sale of assets, under confidentiality and this policy.
• Our affiliates within the TCI Holdings Group for the purposes described in this policy.

Staff with administrator access to the Platform can view account, campaign, balance and report data to operate the Service, correct records and investigate issues. Access is limited to what their role requires.

Our service providers and partners may store or process personal data in countries other than your own, including countries whose laws offer a different level of protection. Where required, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses, and we take reasonable steps to ensure your data remains protected. You can ask us for more information about the safeguards used.

• Account and profile data: for as long as your account is open, then for a limited period to handle any disputes, after which it is deleted or anonymised.
• Deposit, balance, spend and campaign billing records: for 7 years after the transaction, as required for tax, accounting and anti-money-laundering purposes.
• Campaign settings and performance reports: for the life of the account and for the billing-records period above, as they underpin your spend history.
• Server logs and security records: typically 12 months, longer where needed to investigate an incident.
• Support communications: up to 3 years from closure of the request.
• Verification documents: for the period required by anti-money-laundering law, then deleted.

We may keep data for longer where a legal claim or investigation requires it, in which case we restrict its use to that purpose.

Deposits to the Platform are transactions on public blockchains. The transaction hash, the sending and receiving addresses, the token and the amount are recorded permanently on that blockchain, are visible to anyone, and cannot be altered or deleted by us or by anyone else. Linking a wallet address to your identity in our records is within our control; the on-chain record itself is not. Please consider this before funding your account from a wallet you would not want associated with it.

We protect personal data with measures including encrypted connections, salted password hashing, access controls and least-privilege administrator access, and monitoring for suspicious activity. No system is completely secure, and you play a part too: use a strong, unique password, keep it private and tell us immediately if you suspect your account has been accessed without permission.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected — you can edit most profile details yourself in the Platform;
• have your data deleted, subject to the retention obligations in section 7;
• restrict or object to certain processing, including processing based on legitimate interests and any direct marketing;
• receive the data you gave us in a portable, machine-readable format;
• withdraw consent at any time where we rely on it, without affecting processing already carried out;
• complain to your local data-protection authority.

To exercise any of these rights, email [privacy@volcanoads.com] from the address on your account. We may need to verify your identity first. We will respond within the time required by law, normally within one month.

The Services link to third-party sites and services — for example block explorers, wallet providers, Telegram, Meta and Google. Their privacy practices are their own and are not covered by this policy. Please read their policies before using them.

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. For material changes we will notify you through the Platform or by email before they take effect.

Questions, requests or complaints about personal data: TCI Holdings Group, [registered office address] — [privacy@volcanoads.com].