Privacy policy

We handle personal data under Kenya's Data Protection Act, 2019.

• For FreeACS accounts, the people who sign up and run an organization, Centipid Technologies is the data controller.
• For the devices an ISP connects and the people who use them, the ISP is the data controller and Centipid Technologies is its data processor. We process that data only to run FreeACS for the ISP.

• Account details: your name and email address from the sign-in service, and your organization's name.
• What your devices report when they check in: serial number, manufacturer, model and firmware version, the IP address a device connects from and its WAN address, uptime, Wi-Fi network names and how many clients are connected, the hostnames, IP and MAC addresses of devices on the customer's network, and the PPPoE username and connection status.
• What you send to a device: the commands you queue and the settings they change. Wi-Fi keys and passwords are stored encrypted and shown masked in the dashboard.
• Payments: the plan you buy, the amount, and the receipt number. Paystack collects your card details on its own checkout. So your plan can renew, we keep Paystack's token for your card with its brand and last four digits. We never see your full card number.
• Request logs: our servers log each request's IP address, user agent, time, path and response status.

To sign you in, register your devices to your organization, show their status and carry out the commands you queue. We also use it to keep FreeACS secure: rate limiting, spotting abuse and fixing faults.

We don't use it for advertising and we don't sell it.

• WorkOS runs sign-in and sends sign-in emails. If you choose to sign in with Google, Google receives that sign-in.
• Paystack takes payment for paid plans and receives your email address with each payment.
• Laravel Cloud hosts the website, the dashboard and the database. Hetzner hosts the server your devices connect to. Cloudflare provides DNS for freeacs.net and protects the website. They store or carry data on our behalf.

Nobody else receives it unless the law requires us to share it.

The database and the servers are in Singapore. WorkOS, a US company, holds sign-in data. We transfer data outside Kenya under section 48 of the Data Protection Act, 2019, only to providers that protect it.

We keep account and device data while your account is open.

• Removing a device from the dashboard deletes it and its command history.
• You can delete your user account in Settings. To delete your whole organization and its devices, email us.
• We keep request logs only as long as we need them for security and troubleshooting.

Under the Data Protection Act you can ask to see, correct or delete your personal data, or object to how we use it. Email us and we'll answer.

If your data reached us through your ISP's devices, ask your ISP first. We help ISPs answer these requests.

We set only the cookies needed to keep you signed in and to protect forms. We use no analytics or advertising cookies.

When this policy changes we update this page and its date. Questions and requests: [email protected].