Privacy Policy

This Privacy Policy explains how orbitapps ("Orbit Wifi," "we," "us," or "our") collects, uses, and protects personal information when you use our services ("Services") — whether you're a customer connecting to a hotspot or fixed-line (PPPoE) connection billed through our platform, or an operator running your own internet business on it.

Questions or concerns? If anything here is unclear, or you don't agree with how we handle your information, please contact us at ronkdy1@gmail.com before continuing to use the Services.

1. What Information We Collect

In Short: We collect what's needed to grant you network access, bill you correctly, and support you — phone number, device identifiers, payment details, and support messages. If you're an operator, we also hold your business and payout details.

If you're a customer

• Your phone number — used to send an M-Pesa payment prompt and identify your account.
• Your device's MAC address and IP address — used to authorize and manage your specific session on the network.
• M-Pesa transaction details — amount, M-Pesa reference/receipt number, and transaction status. We never see or store your M-Pesa PIN or full account details; those stay between you and Safaricom.
• Messages you send us for support — over in-app chat, WhatsApp, or SMS — including your phone number, message content, and (if relevant to the issue) your device's MAC address.

If you're an operator (tenant/admin)

• Account details — name, email, and role.
• Business details — business name, contact email/phone, and the M-Pesa phone number payouts are sent to.
• Your M-Pesa Daraja API credentials, if you connect your own — consumer key/secret, passkey, and B2C credentials. These are encrypted at rest (AES-256-GCM) and are never displayed or returned in plaintext once saved.
• If you use the Orbit Wifi Admin mobile app: your login credentials and a push-notification token, used to send you real-time alerts about your network.

Automatically, from anyone visiting our site

Standard web server information — IP address, browser/device type — logged the way any website's server logs traffic, for security and troubleshooting. We don't use this for advertising or profiling.

2. How We Use Your Information

In Short: To connect you, bill you, support you, and keep the network secure — not to profile you or sell to advertisers.

• To authorize and manage hotspot or fixed-line (PPPoE) network access for your device.
• To process M-Pesa payments and send you the resulting receipt or confirmation.
• To notify you about your session — for example, when your access is about to expire.
• To respond to support requests across chat, WhatsApp, and SMS, and to keep a record of the conversation so we can follow up properly.
• To detect and prevent fraud or abuse of the network or payment system.
• For operators: to run your wallet, calculate payouts, and manage your routers, packages, and customers on the platform.
• To meet our legal, tax, and accounting obligations.

3. How We Share Your Information

In Short: Only with the providers we need to operate the Services — never sold, never shared for advertising.

• Safaricom (M-Pesa Daraja API). Payment amount, phone number, and transaction reference are shared with Safaricom to process your M-Pesa payment — this is unavoidable for any M-Pesa transaction to complete.
• Messaging providers. When you contact support over WhatsApp or SMS, your message is relayed through our messaging provider to deliver it and our reply.
• Hosting and infrastructure providers. The servers and database that store this information are operated by our hosting provider under contract — they don't use your data for their own purposes.
• Legal requirements. If required by law, court order, or to protect the rights, safety, or property of Orbit Wifi, our operators, or our customers.
• Business transfers. If Orbit Wifi is involved in a merger, acquisition, or sale of assets, customer information may transfer as part of that transaction, subject to this policy.

We do not sell personal information, and we do not share it with third parties for advertising or marketing purposes.

4. Cookies & Tracking

In Short: We don't run third-party ad or analytics trackers. We use functional tokens only — things like keeping you signed in.

Our site doesn't use third-party advertising cookies, analytics trackers, or cross-site tracking technology. Where we use local storage or session tokens, it's strictly functional — to keep you or an operator signed in — not to track you across other sites.

5. How Long We Keep Your Information

In Short: We keep information for as long as your account is active plus a reasonable period after, and longer where accounting, tax, or dispute-resolution requirements apply.

Session and device information is retained for as long as it's useful for network operation and troubleshooting, then removed or aged out. Payment and transaction records are kept longer, as needed to satisfy accounting, tax, and regulatory obligations and to resolve any billing disputes. Support ticket history is retained to maintain service quality and to have a record if an issue resurfaces. When information is no longer needed for any of these purposes, we delete or anonymize it.

6. How We Keep Your Information Safe

In Short: Sensitive credentials are encrypted at rest, and access to admin systems is role-restricted — but no system is 100% secure.

Operator M-Pesa API credentials are encrypted at rest (AES-256-GCM) and are never returned in plaintext once saved. Access to admin and operator tooling is role-restricted, and actions taken by administrators are logged. That said, no method of transmission or storage over the internet is completely secure, and we can't guarantee absolute security — you should keep your own account credentials and device secure as well.

7. Children's Privacy

In Short: The Services are intended for use by adults; M-Pesa payments require your own registered line.

The Services, and particularly the M-Pesa payment flow, are intended for use by individuals 18 years or older, consistent with the age requirements for owning a registered mobile money account. We don't knowingly collect personal information directly from children. If you believe a child's information has reached us, contact us at ronkdy1@gmail.com and we'll remove it.

8. Your Privacy Rights

In Short: Under Kenya's Data Protection Act, 2019, you can request access to, correction of, or deletion of your personal information at any time.

As a data subject under Kenya's Data Protection Act, 2019, you have the right to:

• Know what personal information we hold about you and why.
• Request a copy of it.
• Request that inaccurate information be corrected.
• Request that we delete information we no longer have a lawful reason to keep.
• Object to or request that we restrict certain processing.

To exercise any of these rights, contact us or email ronkdy1@gmail.com. We'll respond within a reasonable time. If you're unsatisfied with our response, you can lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).

9. Changes to This Policy

We may update this Privacy Policy as our Services change. When we do, we'll update the "Last updated" date at the top, and for material changes, we'll make a reasonable effort to let you know directly.

10. Contact Us

Questions about this policy, or a request about your personal information, can go to:

Email: ronkdy1@gmail.com
orbitapps
Nairobi, Kenya