Tagnect

Privacy Policy

Last updated: October 31, 2026

This Privacy Policy explains how Tagnect LLC (“Tagnect”, “we”, “us”) processes information when guests use the Tagnect app to get access to a venue's Wi‑Fi, when venue staff use Tagnect Manager and the web console, and when anyone visits this website. Tagnect coordinates access with the venue's network equipment and does not carry guest internet traffic.

1. Who is responsible

Tagnect LLC, a limited liability company organized in the State of Wyoming, United States, 30 N Gould St, Ste N, Sheridan, WY 82801, USA. Privacy contact: privacy@tagnect.com.

2. Our role and the venue's role

  • Guest access data (Section 3.1): the venue that offers the Wi‑Fi decides the access policies and is the controller of this data; Tagnect processes it on the venue's behalf, as a service provider (processor).
  • Manager accounts, billing, website and service metrics (Sections 3.2 to 3.5): Tagnect is the controller.

3. Data we process

3.1 Guest app (“Tagnect”)

  • Device MAC address — your device's network identifier, obtained from the venue's Wi‑Fi equipment, used to grant and manage your access and to bind one‑time passcodes (OTP) to a device.
  • Connection and session data — the network used, time and duration of access, and the access profile (session time and, where the equipment supports it, bandwidth or data quota).
  • Tag‑read records — which tag was read and when. These records contain no MAC address, IP address, name or contact details.

The guest app does not require an account, does not ask for your name, email or phone number, and does not access your location or GPS.

3.2 Tagnect Manager and web console

  • Account email address — to identify and authenticate the manager.
  • Device identifier — sent at sign‑in to bind the session to the device and keep access secure.
  • Administrative activity — an audit record of management actions, to protect the venue's account.

This data is used only to operate the service; it is not used for advertising or to track you across other companies' apps or websites.

3.3 Billing

Card payments are processed by Stripe; we do not receive or store full card numbers. We keep the plan, subscription status, amounts and invoices. Bitcoin payments are processed by our own BTCPay Server; on‑chain transactions are public by nature of the Bitcoin network.

3.4 This website

We use Cloudflare Web Analytics, which works without cookies and without personal data, to count visits in aggregate. The website uses no advertising pixels, no tracking cookies and therefore needs no consent banner. Our hosting provider may keep short‑lived technical logs for security.

3.5 Service capacity metrics

To size our cloud servers in real time and offer the best possible experience, we measure the aggregate number of connection requests at a given moment. These metrics contain no personal data and are never linked to a person or device.

4. How we use data

  • Authorize and manage access to the venue's Wi‑Fi, applying the policies defined by the venue.
  • Authenticate venue staff and protect their management sessions.
  • Prevent misuse of credentials (for example, flagging unusual tag‑validation patterns for review).
  • Bill subscriptions, provide support and operate, secure and scale the service.

Legal bases (where laws such as the GDPR or Brazil's LGPD apply): performance of the service requested, the legitimate interest in network security, compliance with legal obligations and, where applicable, consent.

5. Sharing and service providers

We do not sell or share personal information for advertising. Data is shared only with the venue where you connect and with providers that operate the service on our behalf:

  • Hetzner (cloud servers, United States) and Supabase (database, United States);
  • Cloudflare (DNS, content delivery, security and cookieless web analytics);
  • Stripe (card payments) and Resend (transactional emails, such as password recovery);
  • Google Workspace (company email and support).

We may disclose information when required by law or to protect the rights and security of users and of the service.

6. Retention

  • MAC address in sessions and OTPs: deleted 15 minutes after the session or OTP expires (or is revoked).
  • Tag‑read records: deleted after 1 day by default; a venue may set up to 45 days. Because they contain no MAC address, IP address, name or contact details, these records do not, in practice, identify guests.
  • Manager accounts: while the account is active; deleted within 30 days after a verified deletion request or account closure.
  • Billing records: for as long as tax and accounting laws require.
  • Website analytics and capacity metrics: aggregate only, with no personal data.

7. International transfers

Our servers are located in the United States. When data from other regions is transferred, we rely on appropriate safeguards, such as standard contractual clauses, where the law requires them.

8. Security

We use encrypted connections (HTTPS/TLS), signed requests, multi‑factor authentication and IP allow‑lists for administration, and an append‑only audit record. Tagnect's Wi‑Fi credentials are temporary and rotate automatically, which limits how long an exposed credential remains usable.

9. Your rights and how to request deletion

Depending on where you live (for example, under the GDPR, Brazil's LGPD or California's CCPA/CPRA), you may have the right to access, correct, delete or port your data, to object to or restrict processing, to withdraw consent and to be informed about sharing. Tagnect does not sell or “share” personal information as defined by the CCPA.

How to request deletion of your data: email privacy@tagnect.com with the subject “Data deletion”.

  • Guests have no account; the device identifier is already deleted automatically 15 minutes after the session. For requests about access data held for a specific venue, we will coordinate with that venue, which controls it.
  • Managers: write from (or name) your account email. After verification we delete your account email and the device identifiers linked to your sessions within 30 days.

You may also lodge a complaint with your local data protection authority.

10. Children

Tagnect is not directed to children under 13 (or the minimum age set by local law), and we do not knowingly collect their personal data.

11. Changes

We may update this policy. The date at the top shows the current version; material changes will be announced through the service's channels.

12. Contact

Tagnect LLC — privacy@tagnect.com