Compliance and privacy
Running a guest network means processing personal data about people who do not work for you. Sign In treats that as part of the service rather than as something the venue improvises: the terms a visitor accepted are recorded with the login, retention is configurable, and a visitor who asks what you hold about them can be answered from the portal.
Terms and conditions
Section titled “Terms and conditions”The captive portal can present your own terms, which the visitor accepts before reaching the network.
- Versioned. Each version of the terms carries its own identifier and version number.
- Tied to the login. Every login records which version was active, so the acceptance is traceable to a specific text rather than to “the terms”.
- Revocable. When the terms change, an administrator can revoke every active login, which requires each visitor to accept the new version on their next connection.
That last point is what makes the versioning worth having. Without it, a changed text leaves you unable to say which visitors agreed to what.
Privacy policy
Section titled “Privacy policy”A privacy policy is displayed alongside the terms and maintained from the administration portal, so it can be updated when the legal position changes. The visitor must have had the opportunity to read it before access is granted, which is the requirement GDPR and comparable frameworks impose.
Data retention
Section titled “Data retention”Retention is configured per context, and records that are both past the period and inactive are deleted automatically. The shortest period that can be set is one day.
What counts as active depends on how the visitor arrived:
| Record | Active while |
|---|---|
| Email-based access | An associated login exists |
| Meeting host request | It is linked to a pending or active guest login |
| SMS-based access | A login is active for the associated number |
| Login history | The valid-until date has not passed |
The distinction matters: a record is not kept because it is recent, but because something still depends on it.
End-user reports
Section titled “End-user reports”An administrator can produce a report on a single individual, looked up by MAC address, email address or mobile number. It covers how that person used the service: first and last login, the devices they used, which authentication methods, and any meeting host or conference activity. Reports can be exported.
This is what a subject access request is answered with.
Opt-out
Section titled “Opt-out”A visitor can be opted out from the administration portal, identified by MAC address, email address or mobile number.
Before the request is carried out, the administrator can review an impact report showing what it will affect. Executing it removes the person’s data and ends any session tied to that identifier.
How the data is protected
Section titled “How the data is protected”- Encryption. Data is encrypted in transit and at rest.
- Controlled access. The compliance tools and reports are available only to administrators entitled to them.
- Traceability. The audit record covers the administrative actions taken here, including opt-outs, so the handling of a privacy request is itself accountable.
Related
Section titled “Related”- Logging, Reporting, and Retention: the platform-wide model this sits inside.
- Privacy Annex and Privacy Data Sheet: the contractual documents.
- Security and Data Protection: how the platform is protected.