Privacy Policy

Last updated 2026-09-07

This policy covers two different groups of people, and it is worth being clear which one you are. If you subscribe to Netstack Hotspot to run your own WiFi, section 1 applies to you. If you bought a voucher to get online in a shop or café, section 2 applies to you — and your relationship is with that business, not with us.

1. If you subscribe as an operator

You give us this directly when you create an account, and we keep it for as long as the account exists.

What is stored	Why
Business name, your name, email address, phone number	To create and identify your account, to sign you in, and to contact you about the service
A hashed version of your password	To sign you in. The password itself is never stored and cannot be recovered — only reset
Your subscription plan, billing period, payment records and amounts	To take payment, to know what your account is entitled to, and for our own accounting
A record of significant actions in your account, with the time and the user	So that you can see who changed what, and so abuse can be investigated

2. If you are a WiFi customer using a voucher

The operator whose WiFi you are using decides what to collect and why. We store it on their behalf. What the system records is:

What is stored	Why
Your voucher code and when it was first used	To let you online and to stop the same code being shared beyond its limit
Your device MAC address and the IP address it was given	To tie your session to your device so your time is not spent by someone else
When each session started and ended	To enforce the time you paid for
How much data your session used	To enforce a data cap where the package has one

3. Who is responsible for what

For operator accounts, we are the data controller. For WiFi customers, the operator is the controller and we act only as their processor — we hold the data, they decide what happens to it. This matters because it tells you who to ask: if you are a WiFi customer, ask the business whose WiFi you used, and if they cannot help, contact us and we will help them.

4. Who else sees your data

Our web hosting provider stores it on servers we rent. Mobile money providers receive only what is needed to take a payment. Nothing is sold, rented or shared for advertising, and no data is passed to anyone else unless the law requires it. Operators cannot see each other’s data at all — every record is scoped to one account and the system refuses to run a query that forgets which account it belongs to.

5. Cookies and tracking

The site sets one cookie, and only after you sign in. It holds a session identifier so the site knows you are logged in, and it is deleted when you log out. There is no advertising, no analytics, no tracking pixels and no third-party scripts. Fonts are served from our own server rather than from Google, so no third party learns your IP address from visiting this site. Because the one cookie is strictly necessary to provide a service you asked for, no consent banner is required.

6. How long data is kept

Operator accounts and their data are kept while the subscription is active and for 90 days after it ends, so a lapsed account can be recovered. WiFi session records are kept for 12 months and then deleted. Payment records are kept for as long as accounting law requires. An operator can delete their own vouchers, packages and session records at any time.

7. Your rights

You can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Write to the address above and you will get an answer within 30 days. If you close your account we will delete it on request rather than waiting for the 90 days to pass.

8. Security

The site is served over HTTPS only. Passwords are hashed, never stored in readable form. Each router authenticates with a unique 40-character token rather than a shared password. Being honest about the limits: this is a small service on shared hosting, and router API passwords entered by operators are stored in a form the system can read, because it needs them to talk to the router.

9. Children

Netstack Hotspot is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 18.

10. Where data is held

Data is stored on servers in our hosting provider’s data centres, which may be outside Cameroon. It is transferred and stored under the provider’s own security terms.

11. Changes to this policy

If this policy changes in a way that affects you, operators will be told by email before the change takes effect. The date at the top always shows when it was last revised.