Privacy Policy

1. Two kinds of data

• Businesses that use DevHotspot (hotspot owners, ISPs and their staff). For this data we decide how it is used.
• Their customers (people who buy WiFi bundles, and subscribers). We handle this data on behalf of the business you buy from, and only as that business instructs. That business decides how it uses your data, so contact them first with questions about it. We will help them answer you.

2. What we collect

From businesses and their staff: name, email, phone number, business name, country, currency and time zone; your password (stored only as a secure hash, never readable); team members and their roles; settings, including the keys you connect for payment, SMS, WhatsApp, email and AI services (stored encrypted); plan payments made to us; and security records such as sign-in times, IP addresses and changes to settings.

From customers of those businesses:

• phone number and, if the business asks for it, your name;
• payment records: amount, Mobile Money network, reference and time (we never see your Mobile Money PIN);
• WiFi codes bought, and your device's MAC and IP address, so the code works on your device;
• connection records from the router: when you were online and how much data you used;
• for subscribers: account number, contact details, address or location the business adds, the plan, invoices and payments, support tickets and the messages sent to you.

3. Why we use it

• to sell WiFi bundles and run subscriber accounts: taking payments, issuing codes, logging you in, renewing and ending access on time;
• to send the receipts, codes, reminders and alerts the business has switched on, by SMS, WhatsApp or email;
• to keep accounts secure, prevent fraud and abuse (for example limiting repeated sign-in attempts), and investigate problems;
• to bill businesses for their DevHotspot plan;
• to meet legal duties, such as keeping financial records.

We do not sell personal data, and we do not show advertising.

4. Who we share it with

Only with services needed to run DevHotspot, and only what they need:

• Hosting: Vercel (the application, running in Ireland) and Supabase (the database, in the EU, Ireland). This means data is stored outside Uganda, with safeguards in place.
• Payment providers the business connects (for example Relworx, MTN MoMo, Airtel Money, M-Pesa, Yo! Payments, Flutterwave, pawaPay or Paystack): your phone number and the amount, to send the payment prompt. With DevHotspot Pay, payments go through DevHotspot's own Relworx account, and the business's withdrawal number is checked with Relworx, which tells us the name it is registered to.
• Messaging providers: DevHotspot SMS (sent through our Africa's Talking account) or the SMS or WhatsApp provider the business connects, and our email service (Resend): your phone number or email and the message.
• AI assistant (optional): if a business uses the "Ask AI" assistant, the question and the business figures needed to answer it are sent to Anthropic (Claude) or OpenAI, depending on the business's settings.
• Maps: the maps in the dashboard load map pictures from OpenStreetMap, which sees the viewer's IP address. When staff search for a place to pin a location, the search words (not who is searching) are sent to OpenStreetMap's Nominatim service.
• Authorities, when the law requires it.

5. Cookies and storage

The dashboard uses one cookie to keep you signed in. The browser also stores small preferences, such as light or dark mode, and the WiFi login page remembers the last code bought on that phone. We do not use advertising or tracking cookies.

6. How long we keep it

We keep data while the business's account is open, because the business needs its sales, subscriber and payment history. When a business closes its account we delete its data within 90 days, except records the law requires us to keep longer (for example financial records). Rate-limit counters are deleted within hours.

7. How we protect it

All traffic uses HTTPS. Passwords are hashed, payment and messaging keys are encrypted, two-step sign-in is available for dashboard accounts, each business can only see its own data, and access to the database is restricted.

8. Your rights

You can ask to see the personal data held about you, to correct it, to delete it, or to object to how it is used. Customers of a business should ask that business first; we will help them. If you are not happy with the answer, you can complain to Uganda's Personal Data Protection Office.

9. Children

DevHotspot accounts are for businesses and adults. We do not knowingly collect data about children for our own purposes.

10. Changes

We will update this page if how we handle data changes, and tell businesses in the dashboard or by email when the change matters.

11. Contact

OCHIENO DAVID, DevHotspot Billing, Uganda · Email: support@devbilling.systems · Phone and WhatsApp: +256 760 552913