ONTON Privacy Policy
1. Introduction
This Privacy Policy explains how ONTON ("we", "us", or "our") collects, uses, and protects your personal data when you use our Telegram Mini App and Web platform (onton.live, app.onton.live). We comply with the General Data Protection Regulation (GDPR) and applicable laws of Finland and the European Union.
2. Information We Collect
- Profile & Identity Data: When you sign in or register for an event, we may collect your display name, public Telegram username and numeric Telegram ID, email address (when signing in via Email OTP or Google OAuth), and linked public TON wallet address.
- Event & Attendance Data: Information regarding events you host or register for, ticket orders, organizer registration form answers, and verified door check-in timestamps.
- Technical & Session Data: Standard server logs (IP address, browser/device type) and strictly necessary
httpOnlysession cookies used for authentication, language preferences, and anti-bot security.
3. How We Use Your Data & Lawful Basis (GDPR Art. 6)
- Contractual Necessity (Art. 6(1)(b) GDPR): Issuing event tickets and 20-second rotating QR passes, processing 100% post-event escrow settlements, issuing verifiable attendance badges (cSBT / SBT), granting automated access to event Telegram groups, and sending transactional ticket confirmations.
- Explicit Consent (Art. 6(1)(a) GDPR): Optional features—such as anonymized event discovery recommendations, aggregated sponsor analytics, and the public attendance verification API—are disabled by default and only activated if you explicitly opt in under
/my(revocable at any time). - Legitimate Interests (Art. 6(1)(f) GDPR): Preventing spam, sybil/multi-account abuse, and ticket fraud.
4. Data Sharing & Controller Roles
- Event Organizers: When you register for a specific event, your submitted registration details are shared with that event's organizer solely for guest list management, admission approval, and door check-in.
- EU Infrastructure & Sub-Processors (GDPR Art. 28): We engage vetted sub-processors under standard Data Processing Agreements (DPAs): Hetzner Online GmbH (Finland & Germany — EU database and compute hosting), Cloudflare, Inc. (DNS, CDN, and WAF security), Telegram Messenger Inc. (Mini App runtime and bot notifications), and Google LLC (optional Google OAuth 2.0 sign-in). We never sell personal data to third parties.
5. Off-Chain Personal Data vs. On-Chain Blockchain Immutability (GDPR Art. 17)
- No Plaintext PII On-Chain: ONTON never writes plaintext personal information (such as your name, email address, phone number, or Telegram username) into smart contracts on the TON blockchain.
- Off-Chain Erasure vs. Public Ledger Immutability: Off-chain personal data stored in ONTON's databases can be rectified, exported, or erased upon request. However, when you choose to mint an on-chain Soulbound Token (TEP-85 SBT) or broadcast a smart contract transaction using your TON wallet, your public wallet address and transaction hash are permanently recorded on the decentralized, immutable TON blockchain, which cannot be modified or deleted by ONTON or any third party.
6. Your GDPR Rights & Contact
Under the GDPR, you have the right to access, rectify, erase ("right to be forgotten" for off-chain records), restrict, or export your personal data, and to withdraw optional consents at any time. To exercise these rights, please contact us via https://t.me/ontonsupport or [email protected].
Effective Date: September 11, 2024 (Updated November 2026)