Privacy Policy

Last updated: September 25, 2026

Summary

When you tap a Vonga-powered item, we record which item was tapped and when, and we learn who you are only if you choose to tell us and tick an unticked opt-in box; that information belongs to the team, venue, or event that gave you the item, and we handle it on their behalf. On vonga.io, our own business website, we use Google Analytics and a business visitor identification service called RB2B, and we explain below what they collect and how to opt out.

1. Who we are and what this policy covers

Vonga, LLC is an Indiana limited liability company based in Indianapolis, Indiana ("Vonga," "we," "us"). This policy covers three groups of people:

• Fans. People who tap an item (such as a giveaway, a jersey patch, a hospitality card, or a booth) with a phone, using an NFC chip or a printed QR code, and see a Vonga-powered web page. No app is needed.
• Website visitors. People who visit vonga.io or use its contact form.
• Business contacts. People at the teams, venues, events, sponsors, and partners we work with or talk to, including people a client authorizes to view its reporting.

Our role for fan data. Each tap experience is run by a sports property (a team, venue, or event) that is our client. For fan data, the property decides what is collected and why, and we process that data on its behalf and under its written instructions. In privacy law terms, the property is the "controller" or "business," and Vonga is its "processor" or "service provider." The property's own privacy notice also applies to you, and the tap experience links to it. For website visitors and business contacts, Vonga decides how data is used and is responsible for it.

2. How a tap works: two layers, kept separate

The tap layer (every tap). A tap records the item's identifier, the time, and the venue or zone the property assigned that item to. It does not include your name or contact details. It lets the property count how many items were tapped, how often, and when. Because an item's identifier stays the same, later taps of the same item can be linked to earlier ones. We know an item was tapped; we do not know who is holding it.

Precise location (only with your permission). See section 4.

The identity layer (only if you say yes). After an age check, you may choose to share your name or email address. You must tick an opt-in box, which is never ticked for you. If you do not opt in, no identity is collected. If you do opt in, your identity is linked to the item you tapped, including that item's tap history, and it is used only for the purposes stated on the screen where you opted in.

3. Information we collect

From fans

• Tap data: item identifier, date and time, the venue or zone assigned to the item, and what you did on the page (for example, which content you opened or which offer you redeemed).
• Precise location: only if you allow it (section 4).
• Age check answer: used only to decide whether you may share information. We do not keep a record of your date of birth.
• Information you choose to share: name, email address, and answers to any question the property asks, together with the record of your consent (the wording you saw and the time you agreed).
• Technical data: your device and browser send an IP address and basic device and browser details to load the page. We use these to deliver the page, keep the service secure, and prevent abuse. We do not store your IP address with your tap record.

From website visitors

• Contact form: the topic you choose, name, email, organization, role, timing, the sponsor and activation you mention, your message, the page you sent it from, and the time.
• Analytics: pages viewed, referring site, approximate location based on IP address (city or region), device and browser type, and events such as a form submission (section 9).
• Business visitor identification: RB2B may match a visit to a business profile, such as a name, job title, employer, business email, LinkedIn profile, and city and state, together with the page viewed (section 9).

From business contacts

• Name, title, organization, business email and phone, and the content of our correspondence and agreements.
• For people a client authorizes to view its reporting: name, business email, and login activity.

4. Precise location and how we ask

A phone with a strong cellular or Wi-Fi signal can report its location to within about 50 feet. Several privacy laws treat this as sensitive information that needs your consent, so we ask first:

• We ask only after the age check, and only if the property's activation uses location.
• We first show a short explanation of why location is requested and how it will be used. Your phone or browser then shows its own permission prompt. Location is collected only if you choose to allow it.
• If you decline, the tap still works. We record only the venue or zone assigned to the item.
• You can turn off location access at any time in your phone or browser settings. That stops future collection.
• Precise location is used to report where and when items are engaged with, for the property and, in aggregated form, its sponsors. It is never used for advertising targeting and never sold.

5. Minimum age

You must be at least 16 years old to share any information through a tap experience. Anyone who indicates an age under 16 sees content only: we do not ask for location, name, or email, and we do not offer an opt-in. The age check is neutral: it does not suggest an answer or tell you which answer unlocks more features. If we learn that we have collected information from someone under 16 through the identity layer, we delete it and tell the property. vonga.io is a business website and is not intended for anyone under 16.

6. How we use information

• Fan data: only to run the property's activation and produce its reporting, on the property's instructions. That includes delivering the tap page, counting and reporting engagement, sending you what you asked for, running any offer or redemption code, preventing fraud and abuse, and securing the service.
• Website and business contact data: to answer your inquiry, schedule and hold conversations, follow up about Vonga's services, understand how the website is used, and secure the website.
• All data: to comply with law, enforce our agreements, and protect the rights and safety of people and of Vonga.

We do not use fan data for our own marketing, we do not sell it, and we do not use it to build profiles for advertising.

7. Who receives information

The property

Fan data collected through a property's activation belongs to that property and is available to it. Each property's data is kept separate; no property can see another property's fans.

Sponsors

• Always: sponsors receive aggregated reporting, such as how many items were tapped, repeat rates, and what fans did. This reporting contains no personal information.
• Only if the opt-in said so: a sponsor receives information about you only if the consent wording you agreed to at the tap named that sponsor and said so. Our preferred approach is to give each opted-in fan a unique code that the sponsor redeems, so the sponsor can count real redemptions without receiving a list of fans.

Service providers

We use these providers to run our services. Each processes data for us under a contract and only for the purpose listed.

• Vercel: website and tap page hosting.
• Supabase: database for tap records, fan data, and website inquiries.
• Resend: email delivery, including delivery of contact form submissions to our team.
• Google: website analytics (Google Analytics 4).
• RB2B: business visitor identification on vonga.io.
• Telegram: short internal alerts to our team that a new website inquiry or business visit arrived. Alerts carry the topic or company name only, never a person's name or email address.
• GoToTags: production and fulfillment of NFC chips and tags. GoToTags receives item identifiers and shipping details, not fan data.

Legal and business transfers

We may disclose information if required by law or legal process, or when needed to protect the rights or safety of people or of Vonga. If Vonga is involved in a merger, acquisition, or sale of assets, information may transfer to the successor, which will remain bound by this policy and by our commitments to our clients for the data it receives.

8. No sale of personal information

We do not sell personal information for money or other value, and we do not share it for targeted advertising. We do not use advertising or retargeting cookies. RB2B, described in section 9, collects information on vonga.io using its own technology; you can opt out of it as described there.

9. Cookies, analytics, and visitor identification on vonga.io

• Google Analytics 4 sets first-party cookies to measure visits and page use. You can block it with the Google Analytics opt-out browser add-on or your browser settings.
• RB2B places a script and cookies on vonga.io. RB2B and its data partners may associate your visit with business profile information they hold, such as a name, job title, employer, business email address, and LinkedIn profile, and send us that profile with the pages you viewed. We use it only to understand which organizations are interested in Vonga and to follow up with business contacts. RB2B identifies people only in the United States. You can opt out at app.retention.com/optout or by contacting us (section 16).

Tracking across other websites. RB2B and its data partners may collect information about your online activities over time and across different websites, including ours. Google may also combine Analytics data with other data under its own policies.

Browser signals. When your browser sends a Global Privacy Control signal, we do not load RB2B for that visit. We do not respond to "Do Not Track" signals, because no common standard exists for them; Global Privacy Control is the signal we honor.

Tap experiences do not use Google Analytics, RB2B, or any advertising technology.

10. How long we keep information

• Tap data (including any precise location): 24 months from the tap, then deleted automatically.
• Information a fan chose to share: for as long as the property's agreement with Vonga is in effect, then deleted, unless the property instructs us to return it first. It is deleted sooner if you ask.
• Consent records: for as long as the information they cover, so the property can show what you agreed to.
• Website inquiries and business contact data: for as long as we have an active or potential business relationship, and no more than 3 years after our last contact, unless we need it longer for a legal claim or obligation.
• RB2B visitor profiles: no more than 12 months unless you become a business contact.
• Analytics data: 14 months, the retention setting in Google Analytics.

11. Security

Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher, through our infrastructure providers. Each client's data is isolated from every other client's. Access to personal data is limited to people who need it to do their work. We do not put personal information in URLs or analytics events. If a security incident affects personal data we process for a property, we will notify that property without undue delay so it can meet its own obligations. No system is perfectly secure, and we cannot guarantee absolute security.

Vonga is designed to meet the standards of the EU General Data Protection Regulation. We do not hold, and do not claim, any security or privacy certification.

12. Your choices and rights

Depending on where you live, you may have the right to:

• find out whether we hold information about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• receive your information in a portable format;
• withdraw consent at any time, including your opt-in and location permission, without affecting earlier processing;
• opt out of any sale, targeted advertising, or profiling (we do none of these with fan data);
• object to or restrict certain processing;
• appeal our decision on your request.

Fans. You can ask to delete your information at any time, whatever state or country you live in. Because the property controls your fan data, you may contact the property directly or contact us. If you contact us, we will act on the request as the property instructs, or forward it to the property and tell you that we have. When we delete your identity, we also remove the link between your identity and your item's tap history.

How to make a request. Use either method in section 16. We may ask for information needed to confirm your identity, such as access to the email address you shared, and we will use it only for that purpose. You may use an authorized agent; we may ask the agent for proof of your permission. We respond within 45 days and will tell you if we need up to 45 more days. We will not treat you differently for exercising a right.

Appeals. If we decline your request, you may appeal by replying to our decision or using either method in section 16 with the subject "Privacy appeal." We will respond within 60 days. If you disagree with the result, you may contact your state attorney general, such as the Indiana Attorney General.

Europe and the United Kingdom. If the EU or UK General Data Protection Regulation applies, the legal bases we rely on are: consent (identity layer, precise location, and non-essential cookies where required); performance of a contract (serving our clients and responding to business inquiries); our legitimate interests in operating, securing, and improving our services and in business development (website analytics and business contact data); and legal obligation. You may also complain to your local data protection authority.

13. International transfers

Vonga is based in the United States and stores data in the United States. If you are outside the United States, your information will be processed there. When we process personal data for a client in the European Economic Area, the United Kingdom, or Switzerland, the transfer is covered by the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) in our agreement with that client.

14. Aggregated and deidentified data

We may create aggregated or deidentified data from the data we process, for example to measure how our service performs across activations. That data does not identify any person or any client. We keep and use it only in deidentified form, we do not attempt to reidentify it, and we require anyone we share it with to do the same.

15. Changes to this policy

We will post any update on this page with a new "Last updated" date. If a change materially affects how we handle information already collected, we will notify our clients before it takes effect, and we will not apply it to fan data already collected without the property's instruction and any consent the law requires.

16. Contact us

For privacy requests, questions, or legal notices, use either:

• the contact form at vonga.io/contact, choosing the topic "Data, privacy, or legal question"; or
• email to privacy@vonga.io.

Vonga, LLC, Indianapolis, Indiana.