Privacy policy

In short

• Guest data belongs to the business running the portal, not to us. We process it on their instructions.
• We never sell personal data, and we do not use guest data to advertise to anyone.
• Card numbers never touch our servers. Payments run through Authorize.Net.
• Guest records are deleted automatically at the end of the account's retention window.

The detail below matters if you are deciding whether to run NerdPortal, or if you are a guest who filled in a form and wants to know where it went.

Who controls what

Two different relationships sit inside this product, and they carry different obligations.

For guest data, the business running the portal is the controller and we are the processor. When someone connects to WiFi at a café and submits their email, that café decides what to collect, why, and what to do with it afterwards. We store and transmit it on their behalf. If you are that business, the terms and privacy policy you link from your portal are yours to write, and requests about that data come to you first.

For account data, we are the controller. That covers the details you gave us when you signed up and how you use the dashboard.

What we collect

Account data

• Business name, email address and chosen subdomain
• A password hash — we never store your password in a readable form
• Any custom domain you attach
• Subscription status, plan and billing history

Guest data, on behalf of our customers

Every completed portal form stores:

• First and last name, and email address
• Phone number and date of birth, only if the business has turned those fields on
• The device MAC address and IP address
• The browser user agent string
• Whether network authorisation succeeded, and when

MAC and IP addresses are technical identifiers needed to grant the device access — without the MAC we cannot tell the controller which device to let through.

Integration credentials

To authorize guests we hold the UniFi controller URL, username and password you provide. The password is encrypted with AES-256-GCM before storage and is never returned by our API or shown in the dashboard.

Payment data

Card numbers are handled by Authorize.Net and are never stored on our servers. We keep the profile identifiers Authorize.Net issues, the last four digits of the card, and the amount and status of each transaction, so we can show you a billing history.

Why we hold it

• To provide the service — account data and controller credentials exist so the product can function at all
• On our customers' instructions — guest data is collected and stored because the business operating the portal asked for it
• To take payment — billing records support the subscription you agreed to
• To keep the platform working and secure — server logs and error reports help us find and fix faults

We do not profile guests, sell data to third parties, or use anything collected through a portal to market to the people who filled in that form.

How long we keep it

Guest submissions are retained for the window attached to the account's plan — 30 days on Starter, 90 days on Pro, 365 days on Enterprise — and are then deleted. Businesses that need records for longer should export them; both CSV and JSON exports are available from the dashboard.

Account and billing data is kept while the account is open. If you close your account, we delete guest data associated with it and retain only what we are required to keep for accounting and tax purposes.

Who else sees it

We share personal data with a small number of processors, each for a specific job:

• Authorize.Net — payment processing and recurring billing
• Our hosting provider — the servers the application and database run on
• Google Analytics — traffic measurement on our public marketing pages only

We also transmit the guest MAC address to the UniFi controller you configured, because that is the instruction that grants the device access. That controller is yours, not ours.

We may disclose data where legally required, and we will tell the affected account unless we are prohibited from doing so.

Security

• Passwords are hashed with bcrypt; controller credentials are encrypted with AES-256-GCM
• Traffic is served over TLS
• Dashboard requests are scoped to the signed-in account on the server, so one account cannot read another's records
• Payment card data is out of scope by design — it never reaches our infrastructure

No system is perfectly secure. If you believe you have found a vulnerability, please report it to security@unifinerds.com rather than disclosing it publicly, and we will work with you on it.

Your rights

Depending on where you live, you may have the right to access the personal data held about you, correct it, delete it, receive a portable copy, object to processing, or withdraw consent. The GDPR and the CCPA both grant versions of these rights.

If you hold a NerdPortal account, email privacy@unifinerds.com and we will respond within 30 days. You can export or delete your guest data yourself from the dashboard at any time.

If you are a guest

You filled in a form to get onto someone's WiFi and ended up here. The business whose WiFi you joined decided what to ask you for and what to do with your answers — so contact them first, and they can delete your record from their dashboard immediately.

If you cannot reach them, or they will not help, write to privacy@unifinerds.com with the name of the venue and the email address you used. We will identify the record and pass the request to the account holder, and we will act on it directly where the law requires us to.

Changes and contact

We will post any material change to this policy on this page and update the date at the top. Where a change meaningfully affects how we handle your data, we will email account holders rather than relying on you noticing.

Questions about this policy: privacy@unifinerds.com. Anything else: get in touch. Related reading: terms of service and cookie policy.