Privacy Policy

What we collect

• From shop owners (the businesses that use Barista WiFi): your name, email address, phone number, business name and address, and billing details. Card payments are processed by Stripe — we never see or store full card numbers.
• From guestswho connect to a shop's Wi-Fi through our captive portal: the information the shop asks for on its sign-in page — typically name and email, and optionally phone number — along with the device's hardware (MAC) address, connection timestamps, and whether the guest chose to receive marketing.
• What we don't collect: we do not log the websites guests visit, the contents of their traffic, or their passwords. We have no interest in browsing history.

What we do with it

We use this information only to:

• provide and operate the Wi-Fi service;
• recognize returning guests so they don't have to sign in every visit;
• send the marketing emails a guest has chosen to receive from the shop;
• bill shop owners and provide customer support;
• prevent abuse, keep the network secure, and comply with the law.

We never sell personal data — not to advertisers, not to data brokers, not to anyone.

Google sign-in

If a guest chooses to sign in with Google, we receive only their name and email address from Google, and only to identify them for Wi-Fi access. We do not request or access any other Google account data. Barista WiFi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

SMS and Mobile Numbers

• Mobile numbers are used to send the requested verification code and are saved with the guest's sign-in for the cafe. We never use them to send marketing or promotional texts.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.

Coworking memberships

If you join a shop's coworking membership, we hold your email address, name, a Barista WiFi account login, your membership and payment history (amounts and dates — Stripe holds your card details, we never see them), the network addresses of the devices you use on the shop's Wi-Fi, and the members-only Wi-Fi password we create for you. We use them to run your membership: billing, letting your devices onto the members-only network, receipts, and emails about your membership (these are service emails, separate from any marketing the shop sends). The shop sees your name, email, membership status and how many devices you use. Payment records are kept as long as tax law requires, even after a membership ends.

Third parties

We share data only with the service providers that help us run Barista WiFi, and only as needed to provide the service:

• Stripe — payment processing and billing.
• SendGrid— delivering email on a shop's behalf.
• Twilio — sending SMS verification codes.
• Supabase — secure database and authentication hosting.
• Google — guest sign-in, when a guest chooses it.
• Ubiquiti (UniFi) — the Wi-Fi hardware and network platform.

Each provider is contractually bound to use the data only to perform its service for us. We do not authorize any of them to use it for their own purposes.

This website

Everything above is about the Barista WiFi service and the guests who use a shop's Wi-Fi. This section is only about visitors to this website, baristawifi.com.

We use Vercel Web Analytics and PostHog to see which pages are visited, roughly where visitors come from, and whether pages work properly. PostHog may record how a visit looks on screen so we can fix confusing pages; typed text is masked.

Visits are anonymous until you give us your email, by sending the contact form or subscribing to the blog. From then on we connect your email, and the name and shop name if you gave them, to your visits to this website, including the pages you viewed before you wrote to us, so we understand what you were looking for. We do not use any service that tries to work out who anonymous visitors are.

The free Cafe Wi-Fi Safety Check saves your answers in your own browser. Your answers are not sent to us, except when you ask us to email you your results: then we receive your answers, your email address, and your cafe name if you give it, so we can send the email. We keep a copy with your email and may follow up with you once. We do not add you to a mailing list. Otherwise, we record only that a check was finished and its overall score.

We also use advertising tags from Meta (Facebook and Instagram) and Google Ads. They tell those platforms that someone visited this website, finished the safety check, or asked to book a call, so we can measure our ads and show them to people who have visited. They never receive your safety check score or answers. You can opt out of personalized ads in your Meta and Google ad settings, or at optout.aboutads.info. None of this applies to guests on a shop's Wi-Fi: guest data is never used for advertising.

Retention & deletion

We keep guest data for as long as the shop's account is active and the guest hasn't asked to be removed. Guests can unsubscribe from marketing at any time using the link in any email, which stops further marketing immediately. A shop owner can delete individual guests or close their whole account; when an account is closed, we delete its data within 30 days, except limited records we must keep for legal, tax, or fraud-prevention purposes. Routine backups may persist for a short period before they cycle out.

Controller vs. processor

For guest data collected through a shop's captive portal, the shop is the data controller and Barista WiFi acts as its processor— we handle that data on the shop's instructions. For a shop owner's own account information, Barista WiFi is the controller. Shop owners are responsible for having a lawful basis to collect from and market to their guests.

Your rights

Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, or delete your personal data, to opt out of marketing, and to opt out of any “sale” of personal data — though we don't sell it in the first place. Guests should direct requests to the shop they connected at; shop owners and anyone else can contact us directly. We will never discriminate against you for exercising these rights.

Privacy contact

For any privacy question or request, email [email protected]. We may update this policy from time to time; material changes will be reflected by the “last updated” date above.