Privacy Policy
Draft, not yet in effect. Sign-ups aren't open. This policy is under legal review and will change.
PlugNPortal LLC, a Washington limited liability company, runs PlugNPortal, a hosted guest WiFi sign-in service for UniFi networks. This policy explains what we collect, how we use it, who receives it and how we protect it.
Two kinds of information
For our customers, the businesses that use PlugNPortal, we decide how account information is used. For guests who sign in to a customer's WiFi, the customer decides what its portal collects and how that information is used, and we process it on the customer's behalf. Each portal has its own guest privacy notice, and guests should send requests to that business first.
Information we collect
- Customer accounts: business name, contact email, the names and email addresses of people invited to the account, their roles and an encrypted sign-in code secret if they use one, a hash of your password, your plan and the settings you choose, and the time you accepted our terms.
- Network details: your UniFi API key, stored encrypted, plus the names and identifiers of the consoles, sites, devices and WiFi networks we work with.
- Portal content: the logos, images, text and addresses you add.
- Billing: your Stripe customer and subscription references and your billing status. Stripe collects card details directly, and they never reach our servers.
- Guest sign-ins: whatever the portal asks for, which can include email address, name, mobile number, marketing preference and answers to questions the customer adds, along with the device's network (MAC) address, the access point and network name, browser type, time and visit counts. Guest accounts and vouchers add a username, a hash of the password, or a voucher code.
- Support and technical data: messages you send us, and server logs that can include IP addresses and browser type.
- Website visits: when you visit this website, we count the page you viewed, the time, the site or campaign that sent you here, your country, and a scrambled code made from your IP address and browser type, so we can count unique visitors. We work out your country on our own server from your IP address. We don't store your IP address in these records, and they're deleted after 90 days.
How we use it
- To provide the service, including letting guests online and setting up guest WiFi when you ask us to.
- To bill you, and to send account messages such as email verification, password resets and usage notices.
- To keep the service secure, limit abuse, fix problems and restore from backup.
- To meet legal obligations.
We don't sell personal information, use guest information for our own marketing, or run advertising or analytics scripts on our website or sign-in pages.
Who receives it
We share information only as the service needs, over encrypted connections to these providers' systems:
- Vultr: hosts our servers.
- Ubiquiti: receives guest device and access details through its cloud service so the guest can be let online, and receives the network changes you request.
- Stripe and its Link service: sell and collect payment for subscriptions, and handle sales tax, receipts and billing support.
- Postmark: delivers our account emails.
- Cloudflare: provides our domain name service and routes email sent to our support address.
- A customer's own Stripe account: if a customer sells WiFi vouchers, the guest pays that customer through Stripe. We store the customer's Stripe key encrypted, and use the guest's email only to send their code.
- A guest's sponsor: if a customer uses sponsored sign-in, the guest's name is sent to the person they say they're visiting, on the customer's list of approvers. Requests are deleted after 7 days.
- Tools a customer connects: if a customer connects Mailchimp, HubSpot, Klaviyo or a webhook such as Zapier, we send that customer's guest contact details there on the customer's instruction.
The customer whose WiFi a guest joins can view and export that guest's information. We may also disclose information when the law requires it, to protect people or the service, or as part of a sale or transfer of the business.
How long we keep it
Guest sign-in records are deleted after the period each customer sets, which is 365 days by default. A customer can also choose to keep them until it deletes them, and can delete a guest's data at any time. When a customer deletes its account, we delete its data, and backups clear within 30 days.
How we protect it
- Our site and dashboard use encrypted HTTPS connections.
- UniFi API keys and connected tool credentials are encrypted when stored.
- Passwords are stored only as hashes, so we can't read them.
- Backups are encrypted, and server access is limited to our administrator.
No system is completely secure, so we can't guarantee absolute security.
Cookies
The dashboard uses a cookie to keep you signed in and protect your forms. We don't use advertising or tracking cookies.
Your choices and rights
Customers can update their details or delete their account from the dashboard. Depending on where you live, you may have the right to access, correct or delete your personal information. Email us to make a request. If you're a guest, we may refer your request to the business whose WiFi you used.
Children
PlugNPortal is for businesses and isn't directed to children. We don't knowingly collect children's information for our own purposes.
Where information is processed
We're based in the United States. We and our providers may process information in the United States and other countries.
Changes
We'll post any changes on this page with a new version label, and tell customers by email about significant ones.
Version draft-2026-11-01. Questions or requests: support@plugnportal.com