Legal

Privacy Policy

Effective Date: August 31, 2026  ·  Last Updated: October 17, 2026  ·  Version: 2026-10-17-mobile-app-v7

Welcome to Ongati, a software platform owned and operated by Zeptonic Solutions LLC d/b/a Ongati ("Ongati," "we," "our," or "us"). Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, protect, and process information when you access or use the Ongati website, software, mobile applications, business pages, booking services, customer relationship management (CRM) tools, communication services, and any other products or services we provide (collectively, the "Services").

By using Ongati, you acknowledge that you have read and understood this Privacy Policy.

Current product availability notice. The free Ongati business presence does not require a card. Ongati is not currently enabling new collection of a business customer’s underlying service payment or appointment deposit. Ongati may continue to retain and process historical payment, deposit, refund, dispute, saved-card-consent and provider-reference records where needed to support prior transactions, security, legal obligations and account requests. Ongati still processes its own subscriptions and Communication Wallet payments through its payment provider.
Contents
  1. Who We Are
  2. Scope of This Policy
  3. Information We Collect
  4. Cookies & Similar Technologies
  5. How We Use Information
  6. Communication Services
  7. Communication Wallet
  8. Payment Processing
  9. Third-Party Services
  10. Data Ownership
  11. Data Security
  12. Data Retention
  13. International Data Transfers
  14. Your Privacy Rights
  15. Children's Privacy
  16. Changes to This Policy
  17. Contact Us

1. Who We Are

Ongati is a Software-as-a-Service (SaaS) platform that helps businesses establish an online presence, manage appointments, communicate with customers, keep private business payment notes, organize customer information, and operate their businesses more efficiently.

The Services are operated by:

Zeptonic Solutions LLC
Doing Business As: Ongati
Virginia, United States

Privacy Questions: privacy@ongati.com

2. Scope of This Policy

This Privacy Policy applies to:

It does not apply to third-party websites or services that may be linked from our platform.

3. Information We Collect

We collect information in several ways.

A. Information You Provide

When you create an account, subscribe, or use our Services, we may collect:

Business Information

Businesses must keep private business payment notes inside their restricted workspace; Ongati does not publish those notes on customer-facing pages.

Account Information

Billing Information

When purchasing a subscription or adding communication credits, we may collect:

Full payment card numbers and security codes are processed by our payment providers and are not stored by Ongati. As described in Section 8, Ongati may retain limited payment evidence and a keyed, nonreversible hash derived from a provider-supplied card fingerprint to determine eligibility for a one-time promotional credit and prevent duplicate-account abuse.

B. Customer Information Stored by Businesses

Businesses using Ongati may choose to store information about their customers, including:

Businesses remain the owners of this customer data. Ongati acts only as a service provider that stores and processes this information on behalf of the business.

C. Booking Information

When a customer books an appointment through an Ongati Business Page, we may collect:

D. Communication Information

If a business sends notifications using Ongati, we may process:

We do not claim ownership of message content. Ongati Conversations are business-scoped: a customer chooses and starts the relationship, the selected business may reply, and passive profile views or QR scans do not create a Conversation or Connected Business relationship. Conversation content is available only through authenticated participant or authorized safety-review paths and is not reused as marketing email or SMS content.

E. Automatically Collected Information

When you visit Ongati, we automatically collect technical information including:

This information helps improve reliability, security, and performance.

We may also use an approximate country and a validated browser time zone to suggest how appointment times are presented. For this purpose, Ongati may check the request IP transiently against a database hosted on our own server; we do not send the visitor IP to a remote geolocation provider or create a separate stored IP-location profile. Ordinary security and access records may still contain an IP address as described above. Region and time-zone suggestions can be inaccurate, including when using a VPN, and an available saved choice takes precedence. This product includes GeoLite Data created by MaxMind, available from MaxMind.

Service prices are shown in the currency selected by the business. Ongati account prices and subscriptions, and all newly created Communication Wallets and new Wallet funding, are in USD. Historical non-USD Wallet balances, charges, and recharge records retain their original currency without conversion. Visitor region and time-zone data are not used to select or convert any service, account, subscription, or Wallet amount. The former public visitor-currency conversion endpoint and scheduled exchange-rate refresh are retired and are not used to present money.

F. Business Forms

A business can ask its customers to fill in forms through Ongati, such as intake forms, feedback forms, surveys, and polls. An intake form may ask for health information. The business decides the questions and uses your answers to provide its service.

Ongati stores the answers you send, and any name you type to acknowledge a form, encrypted at rest. In Ongati, they are shown to the business's owners and admins who manage its forms. Authorized Ongati staff can also open them during a short, audited support session in that business's workspace.

Ongati does not use your answers for anything else. We do not use them for advertising or for our own analytics, and we do not include them in emails, text messages, or app notifications.

If your Ongati account is deleted, the business keeps the answers you sent as its record, but they are no longer linked to your Ongati login. If your customer record at a business is erased, the answers stay with that business but are no longer linked to that record or to your login. Ask the business how long it keeps them.

G. App Push Notifications

If you use the Ongati app on iPhone or Android and allow notifications, your device gives the app a push token. A push token is a code that lets Ongati send notifications to that device.

Ongati stores the token encrypted, together with your account, the business it is for if you are a business user, the device type, the app version, the kinds of notifications the device receives, and delivery status. We use the token only to send you Ongati notifications. Customers choose whether they receive booking updates, message updates, or both. Business users receive the kinds that match their role in the business.

Ongati sends these notifications through Google Firebase Cloud Messaging. Firebase receives the token, the notification text, such as the business name and a short summary, and a link to the matching page in Ongati, so it can deliver the notification to your device. On iPhone, Firebase passes the notification to Apple Push Notification service, which delivers it to your device.

When you sign out of the app, Ongati removes the stored token for that device. Ongati also removes every stored token on your account when your account is deleted or removed. It removes a device's token when a different Ongati profile signs in on that device, or when Google reports that the token no longer works. After removal, Ongati keeps only a one-way fingerprint of the token, which cannot be turned back into the token, together with the record of notifications already sent to it.

4. Cookies and Similar Technologies

We use cookies and similar technologies to:

For more information, please see our Cookie Policy.

5. How We Use Information

We use information to:

We do not sell your personal information to third parties.

6. Communication Services

Businesses may use Ongati to send:

Communication services may be provided through trusted third-party providers.

Businesses are responsible for ensuring that they have permission to contact their customers.

Before sending appointment updates by text, Ongati may ask the customer to confirm that choice. We do not send those updates until confirmation is recorded. A customer can turn text updates off at any time, and we use the consent and opt-out records described above to respect that choice.

Communication charges are billed separately from subscription fees according to the business's selected communication plan or wallet balance.

7. Communication Wallet

Ongati may require businesses to maintain a prepaid Communication Wallet for usage-based services, including:

Communication credits are deducted based on actual usage. Rates are selected from the business's saved country and communication type, with the configured global rate used when no saved-country rate is available, and may reflect destination, message length, and applicable third-party costs. Provider routing may separately use the recipient destination. Current rates are available within the Ongati dashboard before Wallet credit is used, and Ongati records the applicable rate snapshot with each charge.

Free includes 100, Solo includes 1,000, and Growth includes 5,000 provider-accepted transactional emails for each UTC calendar month. SMS and WhatsApp sending are unavailable on Free. Ongati records when included usage reaches approximately 80 percent and 100 percent so a warning can be sent. After Free's included allowance is exhausted, further transactional email is held until the next UTC month or an upgrade; Free has no additional email bucket and cannot use Communication Wallet credit for overage. Further supported Solo and Growth emails and all supported Solo and Growth SMS, including consent requests and booking confirmations, use Communication Wallet credit at the rate shown in Ongati. SMS additionally requires a supported, ready route, applicable consent and preferences, and sufficient Wallet credit. Ongati retains plan and period attribution, usage status, warning evidence, and charge records to enforce allowances, preserve historical usage evidence, prevent duplicate charges, investigate abuse, explain balances, and support account requests.

For businesses that accepted the current Terms, Ongati may record a separate capped liability when scheduled reminders use the optional grace buffer, and may process projected-balance alerts, recharges, and explicit auto-recharge authorization records.

8. Payment Processing

Ongati subscriptions and Communication Wallet payments are processed by Stripe. Where customer deposits are separately launch-enabled for a provider-ready business, optional appointment-deposit payments are also processed by Stripe and the connected business receives them as merchant through its own Stripe account. Customer deposits are not part of the ordinary launch booking flow.

For historical connected accounts, or where customer deposits are separately launch-enabled and provider-ready, Stripe collects connected-account identity, banking, tax, and verification information directly. Ongati receives and stores limited account identifiers, capability and requirements status, and onboarding state. Ongati does not store the business's full bank-account or identity-document details.

To award the current one-time USD $5 Solo or USD $10 Growth messaging credit, preserve historical USD $3 grants, and prevent duplicate promotion abuse, Ongati may process limited evidence for the qualifying paid invoice and payment, such as the plan and subscription item set, Stripe customer, subscription, invoice, PaymentIntent, charge, event, amount, currency, payment status, refund or dispute status, and payment-method type. For eligible card payments, Ongati transforms the provider-supplied card fingerprint with a secret key and stores only the resulting keyed, nonreversible hash for cross-account eligibility checks. Ongati does not store the full card number, security code, or the provider-supplied fingerprint in this promotion record. These records may be retained as promotion, fraud-prevention, accounting, security, and legal evidence.

For historical customer deposits and saved-card records, or where those functions are separately launch-enabled and provider-ready, Ongati processes the service and deposit snapshot, business-authored policy and its acceptance, payment/refund/dispute status, Stripe object references, explicit saved-card consent evidence, and safe display details such as card brand, last four digits, and expiration. Stripe, not Ongati, stores the full card number and security code.

Where saved cards are separately launch-enabled and provider-ready, the option is offered only to a signed-in, verified customer, is stored for a future customer-initiated payment with the same business, and is not automatically charged in this version. Historical saved-card records may also remain for reconciliation. We use these records to complete and reconcile payment, prevent duplicate charges, support refunds and disputes, document consent, detect fraud, and comply with legal obligations.

9. Third-Party Services

Ongati integrates with third-party services that may process information on our behalf, including:

These providers only receive the information necessary to perform their services.

Connected calendars (Google, Microsoft and Apple).

When you choose to connect a Google, Microsoft or Apple (iCloud) calendar, Ongati accesses only what Calendar Sync needs: your account name and email address, to show which account is connected; the list of your calendars, so you can choose which ones Ongati checks; the start and end times of events on the calendars you select, so Ongati can hide times when you are busy; and the ability to create, update and remove copies of your Ongati appointments on the calendar you choose. Ongati stores only an encrypted event identifier, the event's start and end time, and whether it lasts all day. Ongati does not store event titles, descriptions, locations or attendees. Access credentials are encrypted.

Ongati does not sell this information, does not use it for advertising, and does not share, transfer or disclose it to anyone except service providers that host and operate Ongati on our behalf (only as needed to provide Calendar Sync), when required by law, or with your permission. People at Ongati do not read your calendar data except to investigate a security issue, to comply with the law, or when you ask us to help with your account.

You can disconnect a calendar at any time from Calendar sync. Ongati then stops syncing, removes the appointment copies it created where the provider allows, deletes the stored access credentials and, for Google, revokes Ongati's access. For Microsoft and Apple, you can also remove Ongati's access in your account settings.

Ongati's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connected business systems

When a business chooses to connect a supported website, calendar, customer-management, commerce, operations, accounting, or automation system, Ongati may process encrypted OAuth tokens or similarly limited credentials, provider account and external object identifiers, the settings the business selected, synchronization cursors, and bounded synchronization, webhook, error, and security logs. Ongati requests only the scopes needed for the enabled connection and does not request broader access merely because a provider offers it.

The business can disconnect a supported integration through the applicable account controls. Disconnection stops future synchronization and Ongati deletes or revokes reusable provider credentials where the provider supports that action. Records already created in Ongati or the connected system do not necessarily disappear automatically. We may retain minimal identifiers, consent, audit, security, webhook, and failure records when reasonably necessary to prevent replay or fraud, investigate an incident, meet legal obligations, or explain prior synchronization. The connected provider applies its own retention terms to information it holds.

A provider outage or disconnected integration does not remove the business's core Ongati presence or permanent QR. Connection status and errors are separated from the business-presence lifecycle.

10. Data Ownership

One of Ongati's core principles is that your business owns your data.

Business users retain ownership of:

Ongati receives a limited license to process this information solely for the purpose of providing the Services.

11. Data Security

We implement commercially reasonable safeguards designed to protect your information, including:

No system can guarantee absolute security. Users are responsible for maintaining the confidentiality of their account credentials.

12. Data Retention

We retain information only as long as necessary to:

After account closure, certain information may be retained for a limited period before secure deletion, unless a longer retention period is required by law.

13. International Data Transfers

Ongati serves businesses around the world.

By using our Services, you understand that your information may be processed or stored in countries other than your country of residence.

Where required, we implement appropriate safeguards for international data transfers.

14. Your Privacy Rights

Depending on your location, you may have rights to:

Requests may be submitted by contacting privacy@ongati.com.

Deleting Your Account

You can delete your Ongati account yourself in the Ongati app or in a web browser. Deleting your account removes the name, email address, and phone number on your login, removes your app push tokens, and signs you out everywhere. Some records stay, such as the bookings, payments, and form answers a business keeps, and records Ongati keeps for consent, security, and audit purposes. The steps for each type of account, and the full lists of what is removed and kept, are at ongati.com/delete-account. If you cannot sign in, email privacy@ongati.com.

15. Children's Privacy

Ongati is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child under 13 has given us personal information, email privacy@ongati.com with the email address or phone number involved, and we will delete it, including any Ongati account the child created. Some records may stay, such as records a business keeps or that Ongati must keep, as described in Deleting Your Account.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When material changes are made, we will update the "Last Updated" date and, where appropriate, notify users through the platform or by email.

Continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy.

17. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Ongati
A product of Zeptonic Solutions LLC d/b/a Ongati
Virginia, United States

Privacy Email: privacy@ongati.com