Volcora Vending Mobile App Privacy Policy

Effective date: August 10, 2026

This Privacy Policy explains how Volcora (“we”, “us”, “our”) collects, uses, and shares information through the Volcora Vending mobile application for Android and iOS (the “App”).

This policy applies only to the App. Information collected through our website at volcora.com is governed by a separate privacy policy available at https://volcora.com/policies/privacy-policy.

The App is a business tool intended for operators, managers, and service personnel who manage Volcora vending machines. It is not intended for use by consumers purchasing from those machines.

Information We Collect

Account Information

To use the App you must sign in with an account issued by your organization. When you sign in, we process your username and password, and we receive from our servers your user ID, organization ID, name, email address, and assigned role. Your credentials are stored on your device in the platform’s secure keystore (Android Keystore or iOS Keychain) so that you can remain signed in.

Device Identifiers and Push Notification Tokens

The App collects a device identifier and transmits it to our servers:

• On Android, this is the Android ID (Settings.Secure.ANDROID_ID).
• On iOS, this is the Identifier for Vendor (IDFV).

The App also collects and transmits a Firebase Cloud Messaging (FCM) registration token issued by Google.

We use these identifiers solely to deliver push notifications to the correct device — for example, alerts about machine faults, restocking tasks, and system messages. The identifier lets us route a notification to your specific device and avoid sending duplicate notifications when you sign in on more than one device.

We do not use these identifiers for advertising, profiling, tracking across other apps or websites, or analytics.

Device and App Settings

Together with the identifiers above, the App transmits your device’s time zone, system language, app version, and operating system API level. This information is used to display notifications at the correct local time, in the correct language, and in a format your app version supports.

Camera and Photos

The App requests camera access so you can scan machine codes to activate or bind equipment, and so you can take photos when reporting on a machine. The App can also access your photo library if you choose to attach an existing image. Photos are uploaded to our servers only when you explicitly select and submit them. Scanned codes identify vending equipment and do not contain personal information.

We access the camera and photo library only when you actively use these features.

Operational Data

When you use the App to manage vending machines, we process operational records associated with your account and organization, such as machine status, inventory, restocking activity, and service history.

Information We Do Not Collect

• We do not collect your location. The App does not request location permissions and does not access GPS or device location.
• We do not collect advertising identifiers (Google Advertising ID or IDFA).
• We do not include advertising networks or third-party analytics SDKs.
• We do not sell your personal information or share it for behavioral advertising.

How We Share Information

We do not sell your personal information and we do not share it with third parties for their own purposes. We share information only in the following circumstances:

Service providers. We use Google Firebase Cloud Messaging to deliver push notifications. Your FCM registration token is processed by Google in order to route notifications to your device. Google acts as our service provider for this purpose. See Google’s privacy policy at https://policies.google.com/privacy.

Within your organization. Operational records you create in the App are visible to authorized users within your organization, consistent with your assigned role.

Legal requirements. We may disclose information to comply with applicable law, regulation, legal process, or an enforceable governmental request, or to protect the rights, property, or safety of Volcora, our users, or the public.

Data Security

All data transmitted between the App and our servers is encrypted in transit using HTTPS/TLS. Account credentials are stored on your device using the platform’s secure keystore. Access to operational data is restricted by account role.

Data Retention

We retain your device identifier and push notification token for as long as your account remains active and push notifications are enabled. Account and operational records are retained for as long as your organization maintains its relationship with Volcora, or as required by applicable law.

Your Rights and Choices

Push notifications. You can disable push notifications at any time in your device settings. Once disabled, we stop sending notifications to that device.

Access, correction, and deletion. You may request access to, correction of, or deletion of the personal information we hold about you, including your device identifier and push notification token, by contacting us at info@volcora.com. Note that because App accounts are issued by your organization, some requests may need to be directed to or confirmed by your organization’s administrator.

Depending on where you live, you may have additional rights under applicable data protection law, including the EU General Data Protection Regulation and the California Consumer Privacy Act.

International Data Transfers

Our servers are located in the United States and Singapore. Depending on the region you select when signing in, your information may be transferred to and processed in either location. Where required by law, we implement appropriate safeguards for these transfers.

Children’s Privacy

The App is a business tool and is not directed to, or intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. When we make material changes, we will update the effective date at the top of this page.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at: