Privacy policy

This privacy policy explains how we process personal data when you visit sostolabs.com, when you become a customer of Sosto Labs Captive Portal, and when guests use a Wi-Fi portal that one of our customers operates with our service. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP / nLPD) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who we are

The controller for the processing described in sections 2 and 3 is:

2. Visiting this website

This website is a static site and does not use advertising tools. We use Google Analytics to understand how the website is used, only if you agree in the cookie banner. Without your consent no analytics script is loaded and no analytics cookies are set.

• Google Analytics (only with your consent). If you accept, we use Google Analytics 4, provided by Google Ireland Limited (Ireland) and Google LLC (USA), to measure visits in aggregate: pages viewed, approximate location (country, city), device, browser and referring page. Google Analytics 4 does not store full IP addresses; Google signals and ad personalisation are switched off. The cookies _ga and _ga_* are stored for up to 2 years. Data may be transferred to the USA; Google LLC is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. Legal basis: your consent, which you can withdraw at any time via “Cookie settings” at the bottom of every page — the analytics cookies are then deleted. Your choice (accept or reject) is saved for 6 months in the technical cookie sl-consent, valid on sostolabs.com and platform.sostolabs.com, so we don’t ask you twice; after that we ask again. The same choice applies to Google Analytics on the public pages and in the customer area of platform.sostolabs.com.
• Server logs. Our hosting provider records technical data for each request (IP address, date and time, requested page, browser and referrer) to deliver the website and keep it secure. Logs are kept for a short period and then deleted.
• Localised prices. On the pricing section, the website loads Paddle.js from Paddle to show prices in your local currency. For this, your IP address is transmitted to Paddle, which estimates your country. Paddle processes this data under its own privacy policy. The website also reads the current plans and prices from platform.sostolabs.com, one of our own servers.
• Fonts and assets are served from our own domain; no third-party font services are used.
• Contact form and e-mail. If you write to us, we use your name, e-mail address, the optional company name and your message only to answer your request, and keep them as long as needed for that and for our business records. The form sends your message to us by e-mail; to limit abuse, we keep a short-lived, hashed record of the sending IP address for one hour.

3. Customers

When you start a trial or subscribe, we process the data needed to provide the service, manage your account and meet our legal obligations: name, company, e-mail address and, if you provide them, address, phone number and website; country, language, the people you invite to your account (name and e-mail address), the plan and usage of your subscription (for example the number of sites, access points and monthly guests), technical logs, including IP address and browser in the sign-in and activity logs, our correspondence with you and the messages and attachments of the support tickets you open in the customer area.

If you apply to become a reseller partner, we also process your company’s data (company name, address, website, contact person, registration number such as the Swiss UID or VAT number, and the description of your business) and check it by hand against the official public registers.

Payments are handled by Paddle.com Market Limited, our reseller and Merchant of Record. Paddle collects your payment and billing details directly; we do not receive or store your full card details. We receive from Paddle the information needed to manage your subscription (for example status, plan and country).

Legal bases: performance of the contract, compliance with legal obligations (for example accounting and tax records, generally kept for 10 years under Swiss law) and our legitimate interest in operating and securing the service.

News and offers. As a customer, we e-mail you news and offers about Sosto Labs products and services. You can opt out at any time and free of charge, from your account (Account → News and offers) or with the link in every e-mail; service e-mails (payments, security, changes to the service) are still sent. Legal basis: our legitimate interest in informing our customers about our products.

Purchases not completed. When you start a purchase in your account and do not complete it, we record its steps (the plan chosen, where it stopped and the technical codes returned by our payment provider, never your card details) to help you and to fix problems. We may e-mail you once, about a day later, to ask whether you need help; you can opt out with the link in that e-mail or from your account (Account → News and offers). We delete or anonymise these records 30 days after the purchase was abandoned. Legal basis: our legitimate interest in assisting you with a purchase you started and in improving our service.

4. Wi-Fi guests of our customers

When a guest signs in to a Wi-Fi portal run with Sosto Labs Captive Portal, the organisation offering the Wi-Fi (our customer) is the controller of the guest's personal data. We process that data only on the customer's behalf and on its instructions, as a processor.

Depending on how the customer configures its portal, this may include first and last name, e-mail address, the device’s MAC address, the device type and operating system (derived from the browser, which is not stored), the access point and the page requested, the sponsor’s e-mail address, a voucher code, the chosen duration and the reason for the visit if the customer asks for them, the language, session times and traffic volumes, the version of the privacy notice accepted and, if the guest opts in, the marketing consent. The IP address is used to recognise the device on the UniFi network and appears in technical logs, which are kept for 14 days. With voucher sign-in, no name or e-mail is collected. The customer sets how long this data is kept (90 days unless it sets otherwise); after that period the personal data is anonymised automatically and only statistics without reference to the person remain. The guest portal uses only technical cookies (session and form protection), no analytics or advertising tools, and its pages are excluded from search engines.

Guests who wish to exercise their rights should contact the organisation that offers the Wi-Fi, whose privacy notice is shown on the portal. If a request reaches us, we forward it to that organisation.

5. Hosting and service providers

We use carefully selected providers that process data on our behalf:

• Infomaniak Network SA, Switzerland — hosting of the website and of the service, e-mail delivery. The data of the service, including customer and guest data, is stored in Switzerland.
• Paddle.com Market Limited, United Kingdom — reseller and Merchant of Record for orders, payments, invoices and taxes.
• Google Ireland Limited / Google LLC, Ireland / USA — website analytics (Google Analytics), only with your consent.

Customers can choose to send guest e-mails through their own mail server; in that case their mail provider is involved under their responsibility.

When data is transferred outside Switzerland (for example to Paddle in the United Kingdom), it is transferred only to countries with adequate data protection according to the Swiss Federal Council, or on the basis of appropriate safeguards such as standard contractual clauses.

6. Security

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), encryption at rest of credentials and sensitive configuration data, passwords stored only as irreversible hashes, limits on sign-in attempts, two-factor authentication for administrators (mandatory for our staff), encrypted backups and separation of customer data.

7. Retention

We keep personal data only as long as necessary for the purposes described above or as required by law. Within 30 days of the end of the contract, the portal data, including guest data, is deleted or anonymised; if you reactivate your subscription before then, it remains unchanged. The customer company data needed for accounting is kept for the period required by law (usually 10 years); we delete or anonymise the other account data on request.

8. Your rights

Subject to the applicable law, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability and, where processing is based on consent, to withdraw your consent at any time. You also have the right to lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

To exercise your rights, use our contact form or write to the e-mail address given in our imprint.

9. Changes

We may update this privacy policy when our services or the law change. The current version is always available on this page.