Privacy Policy

Wyfy Guest is used by two different kinds of people, and this policy tries not to blur them together: the venue (a hotel, cafe, PG, co-working space, campus, or library) that runs our dashboard and pays for our software, and the guest who connects to that venue's WiFi through our captive portal and never signs up for anything.

Wyfy Guest is a product operated by Infovertias Technologies Pvt Ltd ("Wyfy Guest", "we", "us", "our"), an Indian private limited company. Wherever this policy says "you," it means either the venue's account and its staff, or the guest using that venue's network, depending on the section — we've labelled each one so it's clear which applies.

1. Who this policy covers

Customers and their staff. If your business signed up for Wyfy Guest to manage guest WiFi at your property, you and the staff accounts you create are our direct customer. We collect what's needed to run your account: your name, work email and phone number, your business and billing details, and — if you're registered under India's GST regime — your GSTIN, which we use to generate compliant GST invoices for your subscription.

Guests. If you're connecting to WiFi at a property that uses Wyfy Guest, you never create a Wyfy Guest account and never pay us anything. The venue you're visiting is our customer, not you. But your device still talks to our captive portal and our backend to get you online, and that necessarily involves some of your data passing through our systems, described below.

2. Information we collect from guests

When you connect to a WiFi network running on Wyfy Guest, depending on which login method the venue has turned on, we may process:

• A phone number or email address, used to send you a one-time password (OTP) over SMS, WhatsApp, or email so you can log in. Some venues instead use a voucher code or a PIN handed out at the front desk, in which case we don't need a phone number or email at all.
• Your device's MAC address, the hardware identifier your phone or laptop's WiFi radio presents when it joins the network. This is how we recognize your device on a return visit.
• Your device's IP address and the Accept-Languageheader your browser sends, captured at login.
• Session information: when your session started and ended, and how much data you uploaded and downloaded during it. We use this for the venue's own usage reports and to apply any fair-usage limits the venue has configured, not to look at what you actually browsed.
• Your acceptance of the venue's network terms, recorded when the captive portal asks you to agree to them before you get online.
• A display name or a separate contact email, only if you choose to add one to your guest profile on a portal that offers that. It's never required to get online.

We do not require a real name, a government ID, or any payment information from a guest to get WiFi access. If a venue asks for something beyond what's listed above, that's a choice the venue has made in how they configure their own portal, not something Wyfy Guest requires.

3. Information we collect from customers and staff

• Account details: name, work email, phone number, and password (stored hashed, never in plain text).
• Business details: your organization's name, address, and, where applicable, your GSTIN, used for GST-compliant invoicing.
• Payment information: handled directly by our payment processors (Razorpay and Stripe) — we do not store your full card or bank account number on our own servers.
• Usage of the dashboard itself: which staff account did what, when, kept in an audit log for security and support purposes.
• Anything you upload to brand your captive portal: your logo, colors, and similar assets.

4. How guest data is shown to the venue, and how it's masked

A venue's staff can see their own guests' login identifiers (phone or email) in the dashboard to run their business — for example, to look up who was connected during an incident. By default, Wyfy Guest masks that data in the dashboard: a phone number shows as mostly hidden digits with only the last few visible, an email shows only its first and last character, and a MAC address is shown unmasked because staff genuinely need the full value to identify a device for support.

A staff member who wants to see the unmasked value has to explicitly turn masking off on their own account, and doing that requires completing a one-time password (OTP) verification first — it isn't a setting anyone can flip silently. Every time masking is bypassed and an unmasked value is actually viewed, we record that access. Masking is a display-layer protection: the underlying data in our database is never altered by it, and search/filtering in the dashboard continues to work on the real values.

5. Network authentication (RADIUS) and the captive portal

Getting a device from "connected to the WiFi radio" to "allowed onto the internet" runs through RADIUS-based network authentication between the venue's router and our backend. That process necessarily involves your device's MAC address and the router/location you're connecting through. This is infrastructure-level processing needed to make the network work at all, not a separate data collection we do on top of what's described in Section 2.

6. How we use this information

• To authenticate guests and get them online through the captive portal.
• To send OTPs and other login codes over SMS, WhatsApp, or email.
• To generate the usage and network-health reports a venue sees in its dashboard.
• To enforce fair-usage limits and access rules a venue has configured.
• To run and secure the platform itself: billing, invoicing, staff access control, audit logging, and fraud/abuse prevention.
• To respond to support requests from either a venue or a guest.

We do not sell guest or customer personal data to anyone, and we do not use guest login identifiers or browsing activity for advertising.

7. Who we share information with

We share data with a small number of service providers who help us run Wyfy Guest, each only for the specific job they do for us:

• Twilio — delivers OTP messages over SMS and WhatsApp. Your phone number is shared with Twilio only to send that message.
• Email delivery (SMTP or Amazon SES, depending on deployment) — delivers OTP emails, invoices, and account notifications.
• Razorpay and Stripe — process customer subscription payments. We don't receive or store your full card/bank details; these processors handle that directly.
• Cloud infrastructure providers (Microsoft Azure and Amazon Web Services) — host the servers and storage that run our platform.
• Google Tag Manager — used on this marketing website (wyfyguest.com) only, to manage analytics tags. It is not used inside the captive portal or the customer dashboard.

We also share a venue's own guest data with that venue, since it's their network and their business relationship with their guests — see Section 4 for how that's masked by default. We may disclose information if required by law, such as in response to a valid court order or a lawful request from a government authority.

We do not currently run advertising-network cookies or third-party ad tracking on the captive portal or the dashboard.

8. Data retention

We keep guest and customer data for as long as the relevant venue's account with us is active, so the dashboard's history, reports, and support context stay accurate and useful. We do not currently have a fixed, automatic deletion schedule that purges guest session data after a set number of days. If a venue closes its account, or a guest wants their data removed sooner, they can reach us using the contact details in Section 12 and we'll act on that request. We're aware this is an area we intend to formalize further as the product matures, and this policy will be updated when we do.

9. Security

We apply role-based access control so that only staff with the right permissions can see a venue's data, guest PII shown in the dashboard is masked by default as described in Section 4, and sensitive router credentials our platform needs to manage a venue's network are encrypted at rest. No system is perfectly secure, and we can't guarantee absolute security, but this is the real posture our engineering follows, not a boilerplate promise.

10. Cookies

This marketing website uses Google Tag Manager, which may set cookies or similar identifiers in your browser to support analytics. The captive portal identifies your session on the guest network using session and device identifiers rather than advertising cookies. The customer dashboard uses standard session cookies/tokens needed to keep you logged in securely.

11. Children's privacy

Wyfy Guest isn't directed at children, and we don't knowingly collect personal information from children through our dashboard sign-up. A venue's guest network may of course be used by guests of any age as part of a family or group visiting that property; we don't collect anything beyond what's described in Section 2 from any guest, regardless of age.

12. Your choices and rights

If you're a guest and want to know what we hold about a device or login identifier, or want it deleted, contact us at the email below, or contact the venue directly since they can also action this from their dashboard. If you're a customer, you can update most of your account and staff details directly in the dashboard, and can contact us for anything that isn't self-service.

13. Changes to this policy

We'll update this page as our product and processors change, and update the "Last updated" date above when we do. If a change is significant, we'll look for a reasonable way to flag it to active customers directly, not just quietly edit this page.

14. Contact us

Wyfy Guest is operated by Infovertias Technologies Pvt Ltd (CIN: U58201DL2024PTC437197), an Indian private limited company. For any question about this policy or your data, email us atsales@wyfyguest.com.