Privacy Policy

Last updated: 04 September 2026

This policy explains what information Gold Enterprises ("Gold WiFi", "we", "us") collects when a business runs its WiFi hotspot through our platform, and when a customer of that business connects to the internet through it.

1. Who this policy covers

Two different people interact with Gold WiFi, and we collect different information about each:

Business accounts — the owner/staff of a hotspot business who register with us, connect a router, and manage their WiFi business through our dashboard.
End-customers — people who connect to a business's WiFi network and use the captive sign-in page to redeem a voucher, start a free trial, or pay for access.

If you are an end-customer, the business whose WiFi you used is the one offering you internet access — we process your data as the technology provider running that business's captive portal and payment collection on its behalf.

2. Information we collect

From business accounts

Account details: username, email address, phone number, and password (stored as an irreversible hash, never in plain text).
Business details: your business name, and — if you enable direct customer payment collection or pay a platform subscription — the first name, last name, and email address used to identify you to our payment processor.
Router information: the hostname/IP, API port, and login credentials for the MikroTik router(s) you connect to us. Router passwords are encrypted at rest and are never displayed back to you in plain text after saving.
Financial records: your package prices, transaction history, platform subscription payments, commission and earnings ledger, and any withdrawal requests you submit (including the mobile-money number or bank details you provide as a payout destination).
Activity logs: a record of significant actions taken on your account (router changes, vouchers generated, withdrawals requested) for security and support purposes.

From end-customers using a captive portal

Your device's MAC address and IP address, used to recognise your device, bind it to a voucher or free trial, and reconnect you automatically without asking you to sign in again.
If you pay for a package directly: the mobile-money phone number you provide, and the payment amount, currency, and status returned by the payment processor. We do not see or store your mobile-money PIN.
Connection/usage data: how much time or data you've used against a voucher or package, and session start/end times — needed to enforce the package you paid for and to help the business resolve connection issues.
If your browser supports it, a small locally-stored device identifier (kept only in your own browser's local storage, not a tracking cookie shared across sites) is used to recognise repeat free-trial use on the same device.

We deliberately do not ask end-customers for a name, email address, or any account/identity information to redeem a voucher or pay for a package — a phone number for the payment prompt (when paying directly) is all that's required.

3. How we use this information

To operate the service: authenticate accounts, run the captive portal, issue and validate vouchers, process payments, and grant network access.
To bill business accounts for their platform subscription and to calculate/pay out earnings owed to a business from its own customers' direct payments.
To send account-related email: signup verification codes, password reset codes, and — for business owners — reminders before a subscription expires.
To detect and prevent abuse: for example, rate-limiting repeated payment or redemption attempts, and preventing a single device from claiming more than one free trial per business.
To provide support and investigate reported problems (for example, a customer reporting a payment that didn't connect them).

We do not sell personal information, and we do not use end-customer data for advertising.

4. Who we share information with

We share the minimum information necessary with the following categories of service providers:

Who	What for	What's shared
Mobile-money payment processors (including FasihiNet and ClickPesa)	To collect payment for a package, free-trial upgrade, or a business's platform subscription	Phone number, amount, currency, and (for business payments) the payer's name and email
Transactional email delivery provider	To deliver signup codes, password-reset codes, and subscription reminder emails	Recipient email address and the message content
Certificate authority and DNS infrastructure (for secure HTTPS on a business's own captive portal)	To issue and renew the TLS certificate that secures a business's hotspot login page	The router's hostname only — no personal or payment data

We may also disclose information if required by law, to comply with a valid legal request, or to protect the rights, property, or safety of Gold Enterprises, our customers, or the public.

5. Payment data

All mobile-money payments are processed by licensed third-party payment providers. Gold Enterprises never receives or stores a customer's mobile-money PIN, and we do not store full bank or card details for any payout. We keep a record of each transaction's amount, status, and provider reference for accounting, reconciliation, and dispute-resolution purposes.

6. Data retention

We keep account and financial records for as long as an account is active and afterwards for as long as needed to meet our accounting, tax, and legal obligations. Device-level connection data (MAC address, session usage) is kept only as long as needed for the voucher/package it relates to, plus a reasonable period for support and fraud investigation. Verification and password-reset codes are short-lived and are invalidated once used or expired.

7. Security

Passwords are stored as salted, irreversible hashes — we cannot see or recover your password.
Router credentials are encrypted at rest.
Traffic to and from the platform is encrypted in transit (HTTPS/TLS), including on the secure captive-portal pages we help provision for a business's own router.
Payment webhooks from our payment processors are cryptographically signed and verified before we ever act on them, and duplicate payment notifications are detected and ignored.

No system is 100% secure, but we design and review the platform with these protections as a baseline, not an afterthought.

8. Cookies and local storage

The business dashboard uses a first-party cookie to keep you signed in, and a small local-storage preference to remember your chosen light/dark theme — no third-party advertising or tracking cookies. The captive portal (for end-customers) uses your browser's local storage only to recognise repeat free-trial use on the same device; it is never shared with other websites and does not follow you off the WiFi network.

9. Your rights

You can ask us to access, correct, or delete personal information we hold about you, subject to what we're legally required to keep (for example, financial records). Business owners can update most of their own account and router details directly from the dashboard. For anything else, or if you're an end-customer without a Gold WiFi account, contact us using the details below.

10. Children's privacy

Gold WiFi is intended for use by businesses and their adult customers. We do not knowingly collect personal information from children, and business accounts must be operated by someone old enough to enter into a binding agreement under applicable law.

11. Changes to this policy

We may update this policy as the platform evolves. We'll update the "Last updated" date above when we do; if a change is significant, we'll make a reasonable effort to let business account holders know by email.

12. Contact us

For any privacy question or request, reach us on WhatsApp at +255 623 708 627.