Privacy Policy

Effective Date: March 27, 2026  ·  Last Updated: March 27, 2026

Orange Rabbit / Vegas Crypto Group ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use OrangeRabbit.me, the ORB Portal, and related services (the "Platform").

By using the Platform, you consent to the practices described in this policy. If you do not agree, please do not use the Platform.

1. Information We Collect

Information you provide directly:

• Name, email address, phone number
• Company name, website, social media links
• City / location (optional)
• Role selections and interests
• Sponsorship and event preferences
• Profile information and bio content
• Suggestions, feedback, and topic submissions
• Communications with us (email, form submissions)

Information collected automatically:

• IP address (stored as a one-way hash — not reversible)
• Browser type and operating system
• Pages visited, time spent, and navigation patterns
• UTM / referral source parameters
• Authentication tokens (stored as secure HTTP-only cookies)
• Event participation and RSVP activity
• Poll votes and portal engagement actions

Information from third parties:

• Event attendance data from Meetup.com (if you connect your Meetup account)
• Analytics data from Google Analytics 4 (anonymized)

2. How We Use Your Information

We use the information we collect to:

• Create and manage your ORB Portal account
• Deliver role-appropriate features and content
• Process sponsorship, vendor, and other commercial inquiries
• Send you event invitations, updates, and communications you've requested
• Track and display your XP, badges, and loyalty rewards
• Route your referrals and invite activity
• Improve the Platform through analytics and usage data
• Prevent fraud, spam, and abuse
• Comply with legal obligations
• Communicate important updates about the Platform

3. How We Share Your Information

We do not sell your personal information. We may share it in these limited circumstances:

• With our CRM provider (HubSpot): We use HubSpot to manage contact records, email communications, and sponsorship pipelines. Your contact information and role data may be stored in HubSpot.
• With our email provider (Resend): Used to deliver transactional emails such as magic link logins and portal invitations.
• With event platforms (Meetup.com): If you interact with our Meetup events, your RSVP data may be exchanged with Meetup.
• With our analytics provider (Google Analytics 4): Anonymized usage data only. No personally identifiable information is shared.
• With the Founder / Admin team: Authorized administrators of the Platform can access your profile data and submissions to operate the Platform.
• For legal compliance: We may disclose information if required by law, court order, or to protect our rights and the safety of users.
• Business transfers: If Orange Rabbit / Vegas Crypto Group is acquired or merged, your information may be transferred as part of that transaction.

4. Data Storage and Security

Your data is stored on secure servers operated by our infrastructure providers. We implement the following security measures:

• Passwords hashed using bcrypt (12 rounds) — never stored in plaintext
• Authentication tokens signed with HS256 JWT — stored as HTTP-only cookies
• Timing-safe comparisons to prevent credential enumeration attacks
• Rate limiting on all sensitive endpoints
• HTTPS enforced with HSTS headers
• IP addresses stored as one-way hashed values (not reversible)
• API secrets managed via environment variables, never in source code

No security system is impenetrable. While we take strong precautions, we cannot guarantee absolute security of your information.

5. Cookies and Tracking

We use the following cookies and tracking technologies:

• portal_token — An HTTP-only, Secure session cookie used to authenticate you on the Platform. Expires in 30 days. Scoped to .orangerabbit.me.
• Google Analytics 4 — Analytics cookies to understand aggregate usage patterns. You can opt out via your browser settings or a GA opt-out extension.
• Session storage — Used to preserve your onboarding flow state on the current device only. Cleared when you close your browser tab.

We do not use advertising cookies or behavioral tracking for ad targeting.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of the personal information we hold about you.
• Correction — Ask us to correct inaccurate or incomplete information.
• Deletion — Request deletion of your account and associated data.
• Portability — Request a machine-readable export of your data.
• Opt-out of communications — Unsubscribe from marketing emails at any time using the link in our emails or by contacting us.

To exercise any of these rights, contact us at hello@orangerabbit.me. We will respond within 30 days.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we will remove your personal data within 30 days, except where required by law to retain it longer.

8. Children's Privacy

The Platform is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete it promptly. Contact us if you believe we have inadvertently collected such information.

9. Third-Party Links

The Platform may contain links to third-party websites and services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

10. International Users

The Platform is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to and processed in the United States, where privacy laws may differ from those in your country. By using the Platform, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by updating the "Last Updated" date and, where appropriate, by email or in-platform notice. Continued use of the Platform after changes take effect constitutes your acceptance of the revised policy.