Privacy Policy

Guest data: When visitors connect through a captive portal powered by VoqadoWiFi, we collect:

• Email address and name, when the venue's login asks for them
• Phone number and birthday (optional, if enabled by the venue)
• Device MAC address and type (iOS, Android, laptop)
• Connection timestamp, IP address, and SSID
• Marketing consent choices

Account data: When you create a VoqadoWiFi account, we collect your name, email and organisation name. There is no card checkout: a paid plan is activated by a person and billed by an invoice we email you, so we do not collect card details.

Usage data: We use Google Analytics on the public website and the dashboard (page views, feature interactions) to improve the product. It is not loaded on the captive portal that guests see.

Chat: Messages and details you type into the chat on our website are processed by Zapier to answer you and to follow up on the launch offer. The chat is never loaded on the captive portal, sign in or the dashboard.

We use collected data to:

• Operate and improve the VoqadoWiFi platform
• Authenticate guests through captive portals and grant WiFi access
• Sync guest data to Mailchimp when you connect your Mailchimp account
• Send email on your behalf, such as review requests, to guests (switched on venue by venue as guest email goes live)
• Send platform notifications and product updates
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell your personal data. We share data only with:

• Supabase: database hosting for account and guest data
• Vercel: hosting for the website, dashboard, captive portal and APIs
• Resend: delivery of email we send for you and to you (guest emails such as review requests, and account emails)
• Google Analytics: usage of the public website and dashboard, not the captive portal
• Zapier: the chat on our public website. It receives what you type into it and, if you arrived from a campaign link, that link's campaign tags (not sent when your browser sends Global Privacy Control), to answer you and follow up on the launch offer
• Anthropic: when you use the campaign draft helper in the dashboard, the details you enter for that draft are sent to Anthropic to write it
• Groq: only if you add your own Groq key and use review reply drafts, the Google review text you are replying to is sent to Groq
• Mailchimp: only when you connect your Mailchimp account (Growth plan). Guests who tick the marketing box at login are added to your audience as subscribed, with their name and a tag for the venue
• TP-Link Omada or Ubiquiti UniFi: the device MAC address and session details are passed to your own controller to grant WiFi access
• Law enforcement: when required by law or to protect rights and safety

VoqadoWiFi venues operate as data controllers for their guests. VoqadoWiFi acts as a data processor. Venues are responsible for:

• Presenting an appropriate privacy notice at the point of WiFi login
• Obtaining valid consent for marketing communications
• Responding to guest data subject requests (access, deletion, portability)
• Deciding how long guest data should be kept, and asking us to delete it on that schedule

Under GDPR and similar laws, guests have the right to access, rectify, or delete their data. Requests can be directed to the venue operator, or to us through our contact form or by email at hello@xfirm.io.

We keep guest records while your account is active. There is no retention setting in the dashboard: you can delete an individual guest from your guest list, and if you want records removed after a set period, ask us and we handle it on request. When an account ends, its data is kept for 90 days, during which you can request an export, and is then deleted, as the Terms of Service set out.

Our dashboard uses essential cookies for authentication. We use minimal analytics to understand product usage. Captive portals do not set persistent cookies on guest devices.

We use TLS encryption in transit, encrypted database storage, and access controls that limit guest data to the account it belongs to.

Your data may be processed in the European Union or United States. We ensure appropriate safeguards are in place for international data transfers in accordance with applicable data protection laws.

We may update this policy from time to time. Material changes will be communicated via email or dashboard notification. Continued use of VoqadoWiFi after changes constitutes acceptance of the updated policy.

For privacy-related questions, contact us through our contact form, by email at hello@xfirm.io or by post at VoqadoWiFi, 8087 Poinciana Blvd Unit 519B, Orlando, FL 32821, United States.