Privacy Policy

This policy explains what personal data Blanco Mohbel Communications ("B·Mohbel", "we") collects when you use tickets.mohbel.com or the Ximbal mobile app to find, reserve and buy bus tickets in Belize, why we need it, and what you can do about it.

What we collect

• Account details — your full name, username, email address and password (stored only as a one-way hash). If you turn on two-factor authentication we also store an encrypted authenticator secret and recovery code.
• Bookings and tickets — the trips, dates and seats you book, passenger names, the contact name, email and phone you enter, fares, payment status, and whether a reserved ticket was paid, cancelled or not used ("no-show").
• Card payments — card payments are made on Belize Bank's own secure page. We never see or store your full card number. The bank tells us the result, a masked card number (we show only the last four digits), the approval code and the order number.
• Ta'ab card — if you link a Ta'ab card, we store a one-way hash of the card's NFC serial number so a terminal agent can find your reservation when you tap the card. We do not read or store anything else from the card.
• Reservation ID — to reserve a seat without a Ta'ab card you may add a Social Security card or passport number. We store only a keyed hash of the number, its type and its last four digits, so an agent can check it against the document you show.
• On your device — the app keeps your sign-in token in the device's secure storage, your display preferences, and departure and payment-deadline reminders scheduled as local notifications. Reminders are created on your phone; we do not send push notifications from the app.
• Technical data — our servers log IP addresses and request details to keep the service secure and to limit abuse. Maps in the app load tiles from OpenStreetMap, whose servers see your device's IP address. The website uses Vercel Analytics, which counts page views without cookies; the app contains no analytics or advertising SDKs.

How we use it

• To create your account, sign you in and keep it secure.
• To issue, show and verify your tickets, and to email booking confirmations and verification codes.
• To hold reserved seats and let terminal agents and conductors collect payment for them.
• To prevent abuse of free reservations: three unused reservations block new ones. This record is tied to your Ta'ab card or reservation ID, not only to your email address.
• To keep accounting records the bus companies and we are required to keep.

We do not sell your data, use it for advertising, or track you across other companies' apps and websites.

Who we share it with

• The bus company running your trip — passenger name, seat, ticket and contact details, so its conductors and agents can check you in and contact you about the trip.
• Belize Bank — the amount and order number of a card payment you choose to make.
• Service providers who host our servers and database and deliver our email, only to run the service.
• Authorities, when Belizean law requires it.

Deleting your account

You can delete your account at any time in the Ximbal app under Profile → Delete Account, or by emailing support@mohbel.com. Deleting your account:

• signs you out everywhere and permanently erases your name, email, username, password and 2FA secrets;
• cancels any reservation you have not paid for and releases the seat;
• removes the contact name, email and phone from your bookings and unlinks your Ta'ab card and reservation ID.

We keep the financial record of past bookings and tickets (trip, seat, fare, payment and passenger name) because bus companies must account for every ticket sold. We also keep the hashes of a linked Ta'ab card or reservation ID together with any no-show record, so that unused reservations cannot be cleared by deleting an account and opening a new one. None of this is linked to your name or email once the account is deleted. Tickets you have already paid for remain valid, but you will no longer be able to see them in the app.

Security

All traffic is encrypted with HTTPS. Passwords are hashed, authenticator secrets are encrypted, and card numbers never reach our systems.

Children

Accounts are for people 13 and older. A parent or guardian can book tickets for a child under their own account.

Changes and contact

If we change this policy we will update the date above and, for significant changes, tell you in the app or by email. Questions or requests about your data: support@mohbel.com.