Guest WiFi Security
and Data Protection
When guests log in through your WiFi, they trust your venue with their details. This page lists what we record, where it is stored, what consent is captured, how you delete it, and what we do not have yet, such as a security certification.
The three things that matter most
Where guest data lives
Guest records are stored in a Supabase Postgres database, which Supabase encrypts at rest with AES-256 (supabase.com/security). Every page, dashboard session and API call runs over HTTPS. Our server code runs on Vercel, in its Washington, D.C. region.
Consent captured at the portal
Every login uses the explicit consent form: accepting the WiFi terms and agreeing to marketing are two separate boxes, the marketing box starts unticked, and the wording and time of each choice are stored. Accepting the terms is never treated as marketing consent.
Never sold, never rented
Guest data collected through your login belongs to your business. We do not sell it, rent it, or share it with advertisers or data brokers. The services that process it for us are listed in our privacy policy.
How Guest Data Is Handled
Six facts, stated plainly. Where something depends on your network setup, we say so.
What we record, in full
From the form: the fields you switch on, such as name, email, phone and an optional birthday, plus the consent choices. From the connection: the device MAC address, IP address, browser and operating system, the access point and SSID, when the session started and how long it lasted, and data used where the controller reports it. We do not record the sites guests visit.
HTTPS everywhere
Login pages, dashboard sessions and API calls are served over HTTPS, so guest details never travel between the login page and the database in plain text.
Consent you can evidence
Each guest record carries its consent status, and the guest list exports to CSV from the dashboard. The exact wording each guest saw is stored too, so if a guest asks what they agreed to, you can show them.
Deleting a guest
You can delete a guest from the guest list in the dashboard. That removes the guest and their linked records from VoqadoWiFi. If you synced them to Mailchimp, delete them there as well; we do not reach into your Mailchimp account to do it.
No sale of guest data
We do not sell guest personal information to anyone. Your guest list is not our product. This applies on every plan, including the free Starter tier.
Guest traffic stays off your business LAN
Your Omada or UniFi controller runs the guest network; VoqadoWiFi only serves the login page and tells the controller to let a device online. Put guest WiFi on its own SSID and VLAN so guest devices never touch your POS, cameras or back office. Our setup guides show where.
The Guest Network Is Not Your Business Network
Your TP-Link Omada or Ubiquiti UniFi controller runs the guest network. VoqadoWiFi serves the login page and, once the guest finishes it, tells the controller to let that device online. Our setup guides walk through putting guest WiFi on its own SSID and VLAN, so a guest device can reach the internet and the login page but nothing else.
- With a separate VLAN, guest devices cannot reach POS terminals, payment networks, cameras or office machines
- The portal only needs to reach the guest network segment, never your internal LAN
- VoqadoWiFi never asks guests for payment card data, so the login itself handles no card data
- Client isolation on the guest SSID keeps guest devices from seeing each other