Last Updated: June 2026 — Added EU-U.S. Data Privacy Framework Compliance

Privacy Policy — VOYiJE, Inc.

Effective Date: September 20, 2025 (Last Updated: June 2026)

VOYiJE, Inc. ("VOYiJE," "we," "our," or "us") is a mobile-first SaaS platform that enables universities, study-abroad offices, and experiential learning programs to onboard students, maintain engagement during international travel, and gather program-level insights. We are committed to protecting the privacy of every individual who uses the VOYiJE mobile application and web platform (collectively, the "Platform").

info@voyije.com.

1. Information We Collect

1.1 Information You Provide

When you register, enroll in a program, or interact with the Platform, we may collect:

• Account information: name, email address, student ID number, and university affiliation provided by your institution at enrollment
• Profile content: any information you voluntarily add to your profile
• Program reflections and journals: free-text responses submitted through storytelling and reflection tools (these may contain sensitive personal details at your discretion)
• Communications: messages sent through group messaging and support requests submitted to our team
• Survey and feedback responses: answers to pulse checks, assessments, and optional feedback forms

1.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Usage data: in-app activity, completed tasks, accessed content, feature interactions, and session duration
• Device and technical information: device type, operating system, app version, IP address, crash reports, and diagnostic logs
• Pulse check response data: emotional and experiential engagement data collected through VOYiJE's check-in features, powered by Morphii technology

Location: VOYiJE does not collect or store your real-time GPS location. The Platform does not use background location tracking.

2. How We Use Your Information

We use your personal information for the following purposes, and only where we have a lawful basis to do so under applicable data protection law (including consent, contractual necessity, legal obligation, or legitimate interests):

• Platform delivery: creating and managing your account, delivering program enrollment and onboarding features, enabling messaging and collaboration tools, and generating your personalized Wrap Report at program conclusion
• Institutional reporting: providing program administrators and university partners with engagement analytics and program-level insights
• Platform improvement: analyzing anonymized and aggregated usage patterns to improve features, performance, and user experience; conducting internal research and development
• Communications: sending program notifications, responding to support requests, and delivering important notices about platform changes or policy updates
• Security: detecting fraud, preventing misuse, monitoring for security incidents, and protecting the integrity of the Platform
• Legal requirements and safety: complying with applicable laws, regulations, and legal obligations, and protecting the rights, property, or safety of VOYiJE, our users, or the public. VOYiJE may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

3. How We Share Your Information

VOYiJE shares personal information only in the following limited circumstances:

3.1 University Partners and Program Administrators

VOYiJE operates as a Data Processor on behalf of university partners (Data Controllers). Student engagement and feedback data is accessible to the designated Program Administrators and Institution Administrators at your sponsoring university, in accordance with a signed Data Processing Agreement and applicable FERPA and GDPR obligations.

3.2 Service Providers

We engage trusted third-party service providers to help deliver the Platform. All providers who handle personal data on our behalf are bound by Data Processing Agreements requiring them to process data only for the purpose of delivering their contracted service, under strict confidentiality. Our key providers include Amazon Web Services (cloud infrastructure and storage in the United States), GX2 (platform engineering), Morphii (pulse check technology), Amazon SES (transactional email), and Sentry (application error monitoring). A complete, current list of sub-processors is available upon request at info@voyije.com.

3.3 Legal Disclosures

We may disclose personal information when required by law, regulation, or valid legal process, including requests from public authorities to meet national security or law enforcement requirements. We may also disclose information to protect the safety of any person or to prevent fraud or abuse of the Platform.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of VOYiJE assets, personal information may be transferred as part of that transaction. Users will be notified, and the acquiring entity will be required to honor this Privacy Policy.

4. Data Storage and Security

All VOYiJE data is stored and processed on Amazon Web Services (AWS) infrastructure in the United States (AWS us-east-1, Northern Virginia). We protect your information using:

• Encryption at rest: AES-256 encryption via AWS Key Management Service (KMS) on all databases and storage
• Encryption in transit: TLS 1.2 or higher on all data transmission between users and the Platform
• Access controls: role-based access controls (RBAC) ensuring users and staff access only information appropriate to their role; multi-factor authentication (MFA) required for all administrative access
• Network security: AWS Web Application Firewall (WAF), private Virtual Private Cloud (VPC), and network segmentation preventing unauthorized access to production systems
• Audit logging: all administrative actions and data access events are logged and monitored
• Vulnerability management: continuous scanning and timely patching of security vulnerabilities across all platform components

While we implement robust security measures, no system is completely secure. If you believe your account has been compromised, contact us immediately at info@voyije.com.

5. Data Retention

We retain personal information only as long as necessary to provide services, fulfill program obligations, and comply with legal requirements. Our general retention schedule:

• Student identity and enrollment data: retained for the duration of program enrollment plus 12 months, then deleted or anonymized
• Pulse check and engagement responses: retained for program duration plus 12 months; individual responses deleted at retention end, anonymized aggregate data may be retained indefinitely
• Reflections and journal entries: retained for program duration plus 12 months, then hard deleted
• Administrator account data: retained while account is active plus 24 months following contract end
• Security and audit logs: retained for 24 months to support security monitoring and compliance obligations

University partners may request a shorter retention period in writing. Upon contract termination, all student personal data associated with that institution will be deleted within 90 days.

6. International Data Transfers & Data Privacy Framework Compliance

VOYiJE's infrastructure is hosted in the United States. If you are located outside the United States — including in the European Union, European Economic Area, United Kingdom, or Switzerland — your personal information is transferred to and processed in the U.S. VOYiJE ensures all such transfers are lawful and adequately protected through the following mechanisms:

• EU-U.S. Data Privacy Framework (EU-U.S. DPF): VOYiJE is certified under the EU-U.S. DPF, which provides an adequacy-based legal mechanism for EU→U.S. data transfers under GDPR Article 45.
• UK Extension to the EU-U.S. DPF: Covers transfers from the United Kingdom, including students participating in UK-based programs (e.g., Oxford, London).
• Swiss-U.S. Data Privacy Framework: Covers transfers from Switzerland.
• Standard Contractual Clauses (SCCs): Incorporated into Data Processing Agreements with university partners as an additional transfer safeguard where applicable.

The Federal Trade Commission (FTC) has jurisdiction over VOYiJE's compliance with the EU-U.S. DPF. In compliance with the DPF Principles, we commit to resolve complaints about our collection or use of your personal information. European individuals with inquiries or complaints regarding our DPF policy should first contact VOYiJE at info@voyije.com. If you do not receive timely acknowledgment of your complaint, or if we have not addressed your complaint to your satisfaction, please contact our U.S.-based independent recourse mechanism, JAMS, at: https://www.jamsadr.com/dpf-dispute-resolution.

Data Location & Onward Transfers

All personal data collected by VOYiJE is transferred to, stored, and processed securely in regions located within the United States. We utilize robust administrative and technical safeguards to ensure your data remains protected during this transfer.

In the context of an onward transfer, VOYiJE has responsibility for the processing of personal information it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. VOYiJE shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless we prove that we are not responsible for the event giving rise to the damage.

7. Your Rights

Depending on your location, you have the following rights regarding your personal information. VOYiJE respects and supports these rights for all users:

You have the right to access your personal data to review, correct, or request the deletion of information that is inaccurate or has been processed in violation of the DPF Principles. If you wish to exercise these access rights, please submit a written request to our privacy team at info@voyije.com.

FERPA (U.S. Students)

For students at U.S. institutions, certain Platform data may constitute an "education record" under FERPA. FERPA rights are administered by your institution. VOYiJE supports your institution's FERPA obligations as a designated School Official.

EU/EEA, UK, and Swiss Data Subjects

If you are in the EU, EEA, UK, or Switzerland, you have additional rights under GDPR, UK GDPR, and the Swiss Data Protection Act, including the right to lodge a complaint with your local supervisory authority. You also have the right to invoke binding arbitration through the DPF — see Annex I below.

8. Children's Privacy

The Platform is designed for students enrolled in university-level study-abroad and experiential learning programs and is intended for users who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 13 without institutional or verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA). If you believe a minor under 13 has been enrolled without consent, please contact us at info@voyije.com.

9. Cookies and Tracking Technologies

The VOYiJE web platform uses cookies and similar technologies to maintain session state and gather anonymized analytics. We use only essential cookies (required for authentication and security) and analytics cookies (collecting anonymized usage data to improve the Platform). We do not use advertising cookies or permit third-party advertisers to place cookies on the Platform. You may manage cookie preferences through your browser settings; disabling essential cookies may affect functionality.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this policy, display a notification banner in the Platform, and send a direct email to registered users. Changes that add legal protections (such as DPF compliance) are considered minor updates and do not require affirmative consent. Your continued use of the Platform after updates constitutes acceptance of the revised policy.

11. Contact Us

For questions, concerns, or rights requests related to this Privacy Policy:

Annex I — Binding Arbitration

EU-U.S. Data Privacy Framework

Under the Data Privacy Framework, an EU, UK, or Swiss individual has the option to invoke binding arbitration to resolve a residual complaint that has not been resolved by other recourse mechanisms.

To invoke this option, you must take the following steps prior to initiating an arbitration claim:

1. Raise your complaint directly with VOYiJE and allow us forty-five (45) days to respond and resolve the issue.

2. Attempt to resolve the issue through our designated independent recourse mechanism, JAMS.

3. Raise the issue through your relevant national Data Protection Authority (DPA) to allow the U.S. Department of Commerce an opportunity to resolve the complaint at no cost to you.

The binding arbitration process is administered by the International Centre for Dispute Resolution (ICDR-AAA), a division of the American Arbitration Association, in accordance with the DPF Arbitral Rules. For additional details regarding the scope, available remedies, and the exact terms under which VOYiJE is obligated to arbitrate claims, please visit the official U.S. Department of Commerce DPF Annex I Webpage.

Terms & Conditions — VOYiJE, Inc.

Effective Date: September 20, 2025 (Last Updated: June 2026)

These Terms and Conditions ("Terms") govern your access to and use of the VOYiJE mobile application and web platform (collectively, the "Platform"), provided by VOYiJE, Inc. ("VOYiJE," "we," "our," or "us"). By accessing or using the Platform, you agree to be bound by these Terms. If you do not agree, please do not use the Platform.

1. Eligibility

The VOYiJE Platform is made available to students enrolled in university-level study-abroad and experiential learning programs through participating institutional partners. You must be duly authorized by your institution to access the Platform. By using the Platform, you represent that you meet these eligibility requirements.

2. License to Use

Subject to these Terms, VOYiJE grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Platform solely for your educational program participation. You may not:

3. User Responsibilities

You are responsible for:

4. Institutional Content and Responsibilities

Content provided through the Platform by your institution — including program tasks, checklists, notifications, and curriculum materials — is the responsibility of that institution. VOYiJE is not liable for the accuracy, completeness, or legal compliance of institutional content. Any disputes regarding institutional content should be raised with your institution directly.

5. Intellectual Property

The Platform, including its design, features, underlying technology, and VOYiJE branding, is owned by VOYiJE, Inc. and protected by applicable intellectual property laws. Nothing in these Terms grants you any ownership rights in the Platform. Content you submit through the Platform (your reflections, responses, and profile information) remains yours; you grant VOYiJE a limited license to store and process that content as necessary to deliver the Platform's services.

6. Privacy

7. Acceptable Use

You agree not to use the Platform to:

VOYiJE reserves the right to remove content that violates these standards and to suspend accounts engaged in prohibited conduct.

8. Termination

VOYiJE may suspend or terminate your access to the Platform if you violate these Terms, misuse the Platform, or at the written request of your sponsoring institution. You may also discontinue use at any time. Upon termination, your license to use the Platform ends immediately. Provisions that by their nature should survive termination (including intellectual property, limitation of liability, and dispute resolution) will remain in effect.

9. Disclaimer of Warranties

The Platform is provided "as is" and "as available" without warranties of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. VOYiJE does not warrant that the Platform will be uninterrupted, error-free, or free of viruses or other harmful components. We are not responsible for any decisions made by institutions or students based on Program data or analytics generated by the Platform.

10. Limitation of Liability

To the fullest extent permitted by applicable law, VOYiJE and its officers, directors, employees, and agents shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising out of or relating to your use of the Platform, even if advised of the possibility of such damages. Our total cumulative liability to you for all claims arising out of or relating to the Platform shall not exceed the amount paid (if any) by you or your institution for access to the Platform in the twelve (12) months preceding the claim.

11. Governing Law and Dispute Resolution

These Terms are governed by the laws of the State of South Carolina, United States, without regard to its conflict of law principles. Any dispute arising out of or relating to these Terms or the Platform that cannot be resolved informally shall be submitted to binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, in Charleston, South Carolina.

For EU, UK, and Swiss users with privacy-related disputes, the Data Privacy Framework dispute resolution process described in Section 6 of the Privacy Policy and Annex I applies.

12. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated via in-app notification and/or email. Your continued use of the Platform following the effective date of any update constitutes your acceptance of the revised Terms.

13. Contact Us