Privacy Policy

This policy explains how ZFINET handles personal data in ZFINET. It covers two groups of people:

• Operators and their staff, who have ZFINET accounts. For their data, we are the controller.
• Wi-Fi customers, who buy access on an operator's hotspot. The operator is the controller of their data and we process it on the operator's behalf. Questions about a hotspot's use of your data should go to that operator first.

Operators and staff: name, email address, phone number if given, password (stored hashed), two-factor and passkey settings, organization details, invoices and billing contacts, and a log of important actions for the audit trail.

Wi-Fi customers: phone number (to send the access code and receipts), optional name and email, the packages bought, payment references and status, the device's MAC address and IP address while connected, session times and data used, and SMS messages sent to them.

We do not receive or store full card numbers or mobile money PINs; our payment partner handles those.

• To provide the service: sell and activate Wi-Fi access, enforce data and time limits, send access codes, and run reports (performing our contract with the operator).
• To bill operators and prevent fraud and abuse (contract and legitimate interests).
• To keep the service secure and reliable, investigate problems and keep audit records (legitimate interests and legal obligations).
• To tell operators about their account, invoices and important changes. We do not sell personal data or use it for advertising.

Only with service providers that help us run ZFINET, under contracts that protect the data:

• Payment processing (currently Paystack) for customer payments and operator invoices.
• SMS delivery (currently TextTango) for access codes, reminders and receipts.
• Hosting, email and backup providers.

Operators see their own customers' data. We may disclose data when the law requires it, or to protect people, the service or our rights.

We keep data only as long as needed. By default:

Payments and access passes are kept as financial records for as long as the law requires; a customer's details can be anonymized on request. Operator account data is kept while the account is open and deleted or anonymized after it closes, except where we must keep it by law.

Data is encrypted in transit. Secrets such as router credentials, payment keys and access codes are encrypted at rest. Access is limited by role, privileged staff must use two-factor authentication, and important actions are logged. No system is perfectly secure; we will notify affected operators and authorities of a breach as the law requires.

ZFINET is used in many countries, and our providers may process data outside yours. Where that happens we rely on appropriate safeguards required by the applicable law.

Depending on where you live, you may have the right to access, correct, export or delete your data, or object to some uses. Operators can do most of this themselves in the app, including exporting and anonymizing a customer's data.

Wi-Fi customers should contact the operator of the hotspot; we will help the operator respond. You can also email us at billing@rcodez.com or complain to your data protection authority.

We use only the cookies needed to run ZFINET: keeping you signed in, protecting forms, remembering your theme, and on the Wi-Fi portal remembering your purchase so you can get back to your code. We do not use advertising or tracking cookies.

ZFINET accounts are for businesses and adults. We do not knowingly collect data from children for our own purposes.

We will post changes here and tell operators about material ones. See also our Terms of Service. Contact: billing@rcodez.com, Accra, Ghana.