FLUXI Privacy Policy

This Privacy Policy explains how FLUXI ("we," "us," or "our") collects, uses, stores, and protects information when you use our hotspot billing platform, including our website, tenant dashboard, and hotspot login pages (together, the "Service").

---

1. Who This Policy Covers

FLUXI serves two kinds of users:

• Tenants, meaning hotspot business owners and their staff who use FLUXI to manage billing, vouchers, and payments for their own customers.
• End users, meaning the customers of our tenants who connect to a hotspot network and purchase internet access through FLUXI.

This policy applies to both groups, with specific sections noting where practices differ.

2. Information We Collect

2.1 From Tenants

• Business name, contact details, and registration information provided at signup.
• Owner and staff account credentials, stored using industry-standard password hashing (argon2) and, where applicable, time-based one-time passcodes for additional account security.
• A registered payout phone number used for real disbursements. This number is verified against tenant records before any withdrawal is processed.
• Transaction and ledger records connected to the tenant's account, including sales, commissions, and withdrawal history.

2.2 From End Users

• Mobile phone number, used to process mobile money payments and to deliver voucher codes by SMS.
• Optionally, if you choose to save your details for faster future purchases, we store the minimum information needed to support that feature, described further in Section 6.
• Device information relevant to network access, such as the MAC address of the device connecting to a hotspot, used solely to authorize and manage your internet session.
• Transaction records related to voucher purchases, including amount paid, package selected, and timestamp.

2.3 Automatically Collected Information

• Basic technical data needed to operate the Service, such as session timestamps and network authorization events.
• If, and only if, you allow Analytics (Section 2.4), anonymous page-visit and page-speed measurements collected by Cloudflare Web Analytics.
• We do not use invasive tracking technologies, and we do not sell personal information to third parties.

2.4 Cookies and Local Storage

FLUXI uses a small number of cookies and similar browser storage. We set no advertising cookies, and nothing optional runs until you allow it. What we use is:

• Strictly necessary. On our dashboards, a sign-in token (and, if you choose it, a "remember this device" token for two-factor sign-in) is stored in your browser so you can stay logged in. On our hotspot access portal, your recent voucher codes are stored on your own device so you can reconnect. These are required to provide the service you asked for and are not used for tracking.
• Functional (optional). On our dashboards, a small preference such as your light or dark theme. These are switched off unless you allow them.
• Marketing (optional). On our website, a single first-party cookie (fluxi_partner_ref) that remembers which FLUXI partner referred you, so that partner can be credited when you sign up. It is not used for advertising and is set only if you allow it.
• Analytics (optional). On our website, blog and dashboards, Cloudflare Web Analytics counts page visits and measures how fast pages load, so we can improve FLUXI. It sets no cookies and does not build a profile of you or follow you across other sites, but it does send Cloudflare details of the page view (such as the page address, your browser type and your IP address). Its script is not loaded at all unless you allow Analytics, and it stops as soon as you turn Analytics off.

On our website and dashboards we show a cookie choice banner. Optional cookies and analytics stay off until you allow them, and you can change your choice at any time from the "Cookie settings" link at the bottom of our pages (or here). Declining optional cookies does not stop the core service from working. Our hotspot access portal does not show the banner because it sets only the strictly necessary voucher-reconnect storage described above.

Our fonts and interface libraries are served directly by FLUXI, so loading our pages does not send your IP address to third-party font or code networks.

3. How We Use Your Information

We use collected information to:

• Process mobile money payments and issue vouchers.
• Send SMS notifications confirming payment and providing voucher codes.
• Authorize and manage hotspot network access.
• Maintain accurate financial records for tenants, including commission calculations and withdrawal processing.
• Detect and prevent fraud, and protect the integrity of the platform's ledger.
• Communicate important updates about the Service.
• Comply with applicable legal obligations.

4. Third Parties We Share Information With

FLUXI relies on the following real, named service providers to operate:

• MarzPay, which processes mobile money collections and disbursements on our behalf. When you make a payment, relevant transaction details (such as phone number and amount) are shared with MarzPay to complete the transaction.
• MarzSMS, which delivers SMS notifications, including voucher codes and payment confirmations.
• Cloudflare, which delivers and protects our website, blog and dashboards (every request to them passes through Cloudflare's network, which is how it blocks attacks), and, only if you allow Analytics, measures page visits and load times with Cloudflare Web Analytics.

We only share the minimum information these providers need to perform their function. We do not permit these providers to use your information for their own independent marketing purposes.

We may also disclose information if required by law, or to protect the rights, property, or safety of FLUXI, our tenants, or end users.

5. Data Security

We take reasonable technical measures to protect your information, including:

• Password hashing using argon2, a modern and secure hashing algorithm.
• Time-based one-time passcodes for platform administrator accounts, in addition to a password.
• Rate limiting on login attempts to reduce the risk of unauthorized account access.
• Encrypted connections (HTTPS) for all interactions with our website and dashboard.
• Row-level database security ensuring one tenant's data cannot be accessed through another tenant's account.

No system can guarantee perfect security. If we become aware of a security incident affecting your personal information, we will notify affected users and relevant authorities as required by law.

6. Saved Details and Account Credentials for End Users

If you choose to save your phone number or other details with us for faster future purchases, this information is stored securely and is used only to speed up your own future transactions. You may request that we delete this saved information at any time by contacting us using the details in Section 10.

We do not require end users to create a full account or password to use the Service. Where any credential is created for this purpose, it is stored using secure, industry-standard methods, and is never stored in plain text.

7. Data Retention

We retain tenant and transaction records for as long as needed to provide the Service, meet our legal and accounting obligations, and resolve any disputes. End user information tied to a specific voucher purchase is retained for the period needed to complete that transaction and to maintain accurate financial records, after which it may be anonymized or deleted in accordance with applicable law.

8. Your Rights

Depending on applicable law, including Uganda's Data Protection and Privacy Act, 2019, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to our legal and legitimate business requirements.
• Object to certain uses of your information.
• Withdraw consent where our processing is based on consent.

To exercise any of these rights, contact us using the details in Section 10.

9. Children's Privacy

The Service is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: [email protected]
WhatsApp: +256 750 621 753

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify tenants and end users before the changes take effect. The "Last updated" date at the top of this policy reflects the most recent revision.