Privacy Policy

Last updated: March 14, 2026

1. Who This Policy Applies To

Vonga, LLC, an Indiana limited liability company ("Vonga," "we," "us," or "our") operates the Vonga fan engagement platform ("Platform") and our website at vonga.io. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Platform.

This policy applies to two categories of individuals:

• Fans: Individuals who interact with NFC-enabled merchandise or physical assets powered by the Vonga platform. Fans may interact anonymously (tap events only) or may voluntarily provide personal information such as an email address or name.
• Team Administrators: Authorized representatives of sports teams, venues, or organizations ("Clients") who use the Vonga platform to manage fan engagement campaigns and access analytics.

2. Information We Collect

Fan Data. When fans interact with NFC-enabled items, we may collect:

• Tap Event Data: NFC chip identifier, timestamp of interaction, and engagement context
• Device Information: device type, operating system, browser type and version, and general location data derived from IP address (city/region level)
• Geolocation Data: with your consent, we may collect precise geolocation data when you interact with NFC touchpoints
• Voluntarily Provided Information: email address, name, or other information a fan chooses to submit through a Vonga-powered experience

Team Administrator Data. When Clients register for and use the Platform, we collect:

• Account Information: name, email address, organization name, role/title, and account credentials
• Billing Information: Stripe handles all payment card data. Vonga stores only: company name, billing address, contact email, and tax ID if provided

Automatically Collected Information. We automatically collect certain information when you visit our Site or use the Platform:

• Usage Data: pages visited, features used, actions taken, and time spent on the Platform
• Cookies and Similar Technologies: we use analytics cookies to understand how visitors use our Site. We do not use advertising or tracking cookies.

3. How We Use Information

• To provide, maintain, and improve the Platform, including processing NFC tap events and generating analytics for Clients
• To create and manage Client accounts, process payments, and communicate about the Services
• To generate engagement reports, dashboards, and insights for Clients regarding their fan interactions
• To analyze aggregated and anonymized usage patterns to improve the Platform and develop new features
• To send transactional emails and, with consent, marketing communications
• To comply with applicable laws and protect our rights

We do not sell personal information. We do not use fan behavioral data for advertising targeting outside the team's own platform.

4. How We Share Information

With Clients. Fan engagement data (tap events, voluntarily provided information) is shared with the Client whose NFC-enabled item triggered the interaction. Clients are independent data controllers with respect to the fan data they collect through the Platform.

With Service Providers (Subprocessors). We use the following third-party service providers to operate the Platform:

• Supabase Inc. — Database hosting, backend infrastructure, and authentication
• Vercel Inc. — Platform hosting and delivery
• Stripe Inc. — Payment processing and billing
• GoToTags — NFC hardware fulfillment

These providers process data on our behalf under contractual obligations that require them to protect personal information consistent with this Policy and applicable law.

Legal Requirements. We may disclose personal information if required by law, regulation, or legal process, or if we believe disclosure is necessary to protect our rights or the safety of any person.

Business Transfers. In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity. We will provide notice before personal information becomes subject to a different privacy policy.

5. Data Ownership

As between Vonga and the Client, the Client owns all fan engagement data collected through the Client's use of the Platform. Vonga processes this data on the Client's behalf. Vonga may use aggregated and anonymized data (which does not identify any individual or Client) for platform improvement and benchmarking.

6. Your Rights Under GDPR

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, you have the following rights under GDPR:

• Right of Access: request a copy of the personal information we hold about you
• Right to Rectification: request correction of inaccurate or incomplete information
• Right to Erasure: request deletion of your personal information, subject to legal retention requirements
• Right to Restriction: request that we restrict processing in certain circumstances
• Right to Data Portability: receive your information in a structured, machine-readable format
• Right to Object: object to processing for certain purposes, including direct marketing
• Right to Withdraw Consent: where processing is based on consent, you may withdraw at any time

To exercise these rights, contact us at hello@vonga.io. We will respond within thirty (30) days.

Legal Basis for Processing (EEA): (a) performance of a contract; (b) legitimate interests (platform improvement, security); (c) consent (marketing communications, voluntarily provided fan data); (d) legal obligation.

7. Your Rights Under CCPA

If you are a California resident, CCPA provides you with the following rights:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: request deletion of personal information we have collected, subject to certain exceptions
• Right to Opt Out of Sale: we do not sell personal information. No opt-out is necessary.
• Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights

To exercise these rights, contact us at hello@vonga.io.

8. Cookies and Website Analytics

We use cookies and similar technologies for analytics purposes to understand how visitors use our Site and Platform.

• Google Analytics: We use Google Analytics to collect anonymized usage data, including page views, traffic sources, and session duration.
• Visitor Identification: We use third-party visitor identification services (such as RB2B) that may match website visitors to publicly available business profile information. This data is used solely for B2B sales and marketing purposes. No personal data is sold or shared for advertising.

We do not use advertising or retargeting cookies. You may control cookies through your browser settings. To opt out of visitor identification, contact us at hello@vonga.io.

9. Data Retention

• Fan Tap Event Data: retained for 24 months, after which it is automatically deleted
• Voluntarily Provided Fan Data: retained for the duration of the Client's subscription and deleted upon termination, subject to any legal retention obligations
• Team Administrator Account Data: retained for the duration of the account relationship plus a reasonable period for legal and operational purposes
• Billing Records: retained as required by applicable tax and accounting laws

10. Data Security

Data security is provided through our infrastructure partners. Supabase provides AES-256 encryption of data at rest. All data in transit is protected by TLS 1.2+. We also implement role-based access controls with least-privilege principles, regular security assessments and monitoring, secure development practices, and incident response procedures with 72-hour notification for security breaches affecting personal data.

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security.

11. International Data Transfers

Vonga is based in the United States. If you are located outside the United States, your personal information may be transferred to and processed in the United States. For transfers of personal data from the EEA, we rely on Standard Contractual Clauses approved by the European Commission.

12. Children's Privacy

The Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us at hello@vonga.io and we will promptly delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on our Site with a revised "Last Updated" date. For material changes affecting your rights, we will provide notice via email or through the Platform.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

• Email: hello@vonga.io
• Vonga, LLC, an Indiana limited liability company