Privacy Policy

1. Identity and Roles

CaptiFi Limited
Company number: 15948581
ICO registration number: ZC268697
Registered address: Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE

For the purposes of applicable data protection legislation:

CaptiFi acts as a data controller in relation to its customers, prospects, website visitors, and business contacts.

CaptiFi acts as a data processor in relation to guest data processed on behalf of venue operators using the Services.

Venue operators are the data controllers for guest data.

2. Global Scope and Regulatory Frameworks

This Privacy Policy applies worldwide.

CaptiFi designs its privacy practices to align with applicable privacy and data protection laws, including but not limited to:

• UK GDPR and Data Protection Act 2018
• EU General Data Protection Regulation
• California Consumer Privacy Act and CPRA
• Other US state privacy laws including Virginia, Colorado, Connecticut, and Utah
• Canadian PIPEDA
• Australian Privacy Act 1988
• Brazilian LGPD
• Singapore PDPA
• Other comparable privacy frameworks

Legal responsibility for compliance with local laws relating to guest data remains with the venue operator acting as data controller.

3. Categories of Personal Data Collected

3.1 Customer and Business Data

We collect personal data relating to customers and authorised users including:

• Names and contact details
• Business identifiers and addresses
• Account credentials and preferences
• Subscription and billing records
• Communications and support correspondence

Payment card details are processed by third party payment processors and are not stored by CaptiFi.

3.2 Guest Data Processed on Behalf of Customers

CaptiFi processes guest data strictly on documented instructions from customers.

Guest data may include:

• Names and email addresses
• Telephone numbers if enabled
• MAC addresses and device identifiers
• Session metadata and access logs
• Device, browser, and operating system data
• Custom data fields configured by the customer

CaptiFi does not determine the purposes of guest data processing.

3.3 Technical and Usage Data

We automatically collect technical data including:

• IP addresses
• System logs and diagnostics
• Usage analytics
• Approximate geographic location derived from IP

3.4 Website Forms and Unfinished Sign-ups

When you fill in a form on this website (contact, partner application, trial sign-up or the scanner download), we keep what you submitted together with the date, your IP address and browser details.

If you give your email address to download the UniFi Device Scanner, we email you a link to the download. Once you open that link we may send you occasional emails about CaptiFi, which you agree to on the download form. Each of these emails has an unsubscribe link, and you can opt out at any time.

If you type an email address into a trial or "try it for free" field and leave the page without submitting, that address may be saved before submission, with the page you were on, so that we can send one follow-up inviting you to finish the sign-up. We do this on the basis of our legitimate interest in following up an interest you have shown in the service; the follow-up is a single email, no marketing list is built from it, and the address is deleted after 30 days if you do not continue (section 10). The email address you give to download the free report is stored in the same way and kept under the same 30-day rule unless you go on to start a trial. You can object at any time by emailing hello@captifi.io.

When you arrive from an advert or a partner link, the campaign identifiers in that link may be stored in a cookie so that a later sign-up is attributed to the campaign or partner. Advert identifiers are stored only after you accept analytics cookies in the banner; the partner referral cookie is set when you follow a partner link. If you fill in our sign-up form after arriving from a campaign link, that link's campaign name (its utm tags) is saved with your sign-up details whatever you chose in the banner. It is carried from the page you landed on to the form in the link, so no cookie is needed. While you browse, the session our site already uses also notes the first page of this website you opened on that visit, with only its campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and any partner code, and the address of the website or app that sent you there, without the page (https://www.google.com, for example). If you have accepted Analytics cookies when you start a trial or leave your email address in a sign-up field, these are saved with your sign-up details; without that consent they are never added to your details and go when the session ends. The advert's click identifier is kept only while you consent: if you withdraw consent, our attribution cookies are removed the next time one of our pages loads. The Cookie Policy lists each of these.

4. Purposes of Processing

4.1 Customer Data

Customer data is processed to:

• Provide and administer the Services
• Manage subscriptions and billing
• Communicate operational and security notices
• Provide customer support
• Improve platform functionality
• Prevent fraud and misuse
• Comply with legal obligations

4.2 Guest Data

Guest data is processed only:

• To provide the Services
• In accordance with customer instructions
• To comply with applicable legal obligations

CaptiFi does not use guest data for independent marketing, profiling, or analytics.

4.3 Mobile Numbers and Text Messages

A guest who ticks the box to receive texts on a venue's WiFi sign-in page can receive marketing texts from that venue via CaptiFi. Outside the US and Canada, a guest who gives a mobile number and says yes to the venue's marketing question, on its WiFi sign-in page or its ticket checkout, can receive them too when a line under the question says so. How often texts arrive varies from venue to venue, and message and data rates may apply.

CaptiFi stores the mobile number, the guest's answer and when it was given. It uses them to send that venue's texts, to answer HELP messages and to act on STOP messages. If a guest replies to a venue's text, CaptiFi keeps the reply so that the venue and CaptiFi support can read it. The venue can see the number in its dashboard, exports and API, and if it has connected its own marketing or loyalty platform (section 6), CaptiFi can pass the number and the guest's consent to that platform for the venue's own messages. Mobile numbers, text message opt-in data and consent are never sold or rented, and are never shared with third parties or affiliates for their own marketing or promotional purposes. CaptiFi sends the texts through Sinch ClickSend, listed in section 6, which receives the number and the message text (which can include the guest's first name) only so that it can deliver them.

A guest can opt out at any time by texting STOP, as each marketing text explains, and can get help by texting HELP or by emailing support@captifi.io. The full text message terms are in section 23 of our Terms and Conditions.

5. Legal Bases for Processing

Processing is conducted under one or more of the following bases:

• Performance of a contract
• Legitimate interests
• Compliance with legal obligations
• Consent obtained by the data controller

CaptiFi does not independently determine lawful bases for guest data.

6. Subprocessors and Third Parties

CaptiFi uses a small number of vetted service providers (subprocessors) to deliver the Services. The current subprocessors are:

• Hetzner Online GmbH: application and database hosting, European Union (Finland/Germany).
• Amazon Web Services (Amazon SES): email delivery, currently the United States (us-east-1 region), safeguarded by Standard Contractual Clauses. Regional email delivery (EU or Australia) can be arranged for customers who require it.
• Stripe, Inc.: payment processing, global, safeguarded by Standard Contractual Clauses. CaptiFi does not store card details.
• Cloudflare, Inc.: object storage for uploaded media such as logos and splash page images, European Union.
• Sinch ClickSend: text message (SMS) delivery for venues that use SMS Marketing. Receives the guest's mobile number and the message text only, Australia.

The following providers process website visitor data only (they never receive guest data):

• Tawk.to Inc.: live chat widget, United States, safeguarded by Standard Contractual Clauses. Loaded only after you grant chat consent in the cookie banner; receives the messages you type and your IP address.
• Kloudend, Inc. (ipapi.co): resolves your IP address to a country so the pricing and trial pages show your currency, and to a city-level location for our internal traffic map, United States, safeguarded by Standard Contractual Clauses. Receives your IP address only, over an encrypted connection; the traffic map stores the result against a salted hash of the address and the address itself is not stored (see the 90-day deletion in section 10).
• Cloudflare, Inc. (Turnstile): bot protection on the contact form and the trial sign-up form, United States, safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework. On the contact form it loads the first time you interact with the form, or on the homepage when you scroll the form into view.
• cdn.jsdelivr.net (jsDelivr): content delivery network that serves the phone number input library on the trial sign-up and partner application forms. It loads when those pages open; the request carries your IP address and browser details, as any file download does, and none of the form data. Global network, so the request may be answered from outside the UK.

Email marketing campaigns are sent through CaptiFi's own self-hosted campaign system running on CaptiFi's EU infrastructure, not a third party marketing platform.

Where a venue operator enables an optional marketing, loyalty, or point-of-sale integration (for example Mailchimp, Klaviyo, EmailOctopus, HubSpot, Square, Toast, Incentivio, Pepper, Leat, Airship, Twilio, Zapier, or Slack), opted-in guest data is sent to that platform on the venue's instruction. The venue chooses whether to enable these integrations.

Splash pages served to venue guests contain no third party analytics by default. Website analytics tools (Google Analytics, Meta Pixel) run on the CaptiFi marketing website only, subject to cookie consent.

All subprocessors are subject to contractual obligations regarding confidentiality, security, and data protection. The same list, with notice-of-change commitments, is set out in our Data Processing Agreement.

7. International Data Transfers

Application and database servers are located in the European Union (Finland/Germany). Guest and customer data is stored in the EU.

Email delivery is currently routed through Amazon SES in the United States (us-east-1 region), so email addresses and message content transit the US for sending. This transfer is safeguarded by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Regional email delivery (EU or Australia) can be arranged for customers who require it.

Text messages are sent through Sinch ClickSend in Australia, so a guest's mobile number and the message text pass through Australia when a venue texts them. These transfers are covered by the European Commission's standard contractual clauses and the UK International Data Transfer Addendum in ClickSend's customer terms.

Where personal data is transferred outside the UK or EEA, CaptiFi relies on appropriate safeguards including:

• UK International Data Transfer Agreement and Addendum
• EU Standard Contractual Clauses
• Adequacy decisions
• Contractual data protection commitments

For Australian customers, cross-border disclosures are handled in line with Australian Privacy Principle 8 (APP 8) of the Privacy Act 1988. See our Data Processing Agreement for details.

8. Information Security Measures

CaptiFi implements administrative, technical, and organisational safeguards including:

• Encryption in transit and at rest
• Access controls and authentication mechanisms
• Monitoring and intrusion detection
• Secure infrastructure and hosting environments
• Backup, recovery, and resilience procedures

No system can be guaranteed to be fully secure.

9. Data Breach Management

In the event of a personal data breach, CaptiFi will:

• Investigate and contain the incident
• Notify affected customers without undue delay where required
• Assist data controllers in meeting notification obligations
• Maintain internal incident records

10. Data Retention

Customer data is retained for the duration of the account and thereafter as required by law.

Guest data retention is controlled by the customer and may be configured, exported, or deleted at any time.

Upon termination, guest data is deleted within thirty days unless retention is legally required.

Data collected through this website is kept for the following periods, enforced by a nightly deletion job:

• Contact form, partner application and scanner download submissions: 24 months from submission.
• Copies of emails we send you from this website: 24 months.
• Email addresses saved from an unfinished sign-up or the free report download (section 3.4): 30 days, unless you go on to start a trial, in which case the address forms part of your customer account.
• Visitor location records for our internal traffic map (hashed IP, city, page): 90 days.
• Campaign attribution cookies (_captifi_gclid, _captifi_utm_*): 90 days, renewed on each visit while your Analytics consent stands (see the Cookie Policy).
• Partner referral cookie (affiliate_code): 90 days from the first referral click, not renewed by later visits.

11. Automated Decision Making and Profiling

CaptiFi does not engage in automated decision making or profiling that produces legal or similarly significant effects on individuals.

12. Cookies and Do Not Track

CaptiFi uses cookies and similar technologies for essential functionality, analytics, and performance monitoring.

CaptiFi does not respond to browser Do Not Track signals due to lack of an industry standard.

Details are provided in the Cookie Policy.

13. Individual Rights

Subject to applicable law, individuals may have rights to:

• Access
• Rectification
• Erasure
• Restriction
• Objection
• Data portability
• Withdrawal of consent

Requests relating to guest data should be directed to the relevant venue operator.

CaptiFi will assist controllers where required.

14. US State Privacy Rights

Residents of certain US states may have additional rights, including rights to access, delete, correct, and opt out of certain processing activities.

CaptiFi does not sell personal data or engage in targeted advertising based on sensitive personal information.

Requests may be submitted to hello@captifi.io.

15. Children's Data

The Services are not intended for individuals under sixteen.

CaptiFi does not knowingly process children's personal data.

16. Policy Changes

This Privacy Policy may be updated periodically.

Material changes will be communicated through reasonable means.

Continued use of the Services constitutes acceptance.

17. Supervisory Authorities and Complaints

You have the right to lodge a complaint with a relevant data protection authority.

CaptiFi encourages users to contact us first to resolve concerns.

18. Contact Information

CaptiFi Limited
Email: hello@captifi.io

Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE