Privacy Policy

LubFy provides a Tanzania-first cloud product for MikroTik HotSpot operators: billing, vouchers, agents, portal pages, router enrollment, and health timelines.

When this policy says “we”, “us”, or “LubFy”, it means the LubFy service operated for customers who create an organization on lubfy.online.

This policy covers personal and account data processed when you visit our marketing site, create an account, use the reseller or agent workspace, enroll a router, or operate a captive portal that talks to LubFy APIs.

Wi‑Fi end customers who only buy a package on your portal are primarily your customers. We process the minimum technical and payment data needed to deliver the session you sold.

We collect information you provide and information generated by using the product.

• Account profile: name, email, phone (if provided), organization and site names, role memberships.
• Authentication: password hashes (never plain passwords), Google OAuth subject and verified email when you choose Google sign-in, session tokens, device/session metadata.
• Network operations: router identity, enrollment tokens, install job status, health events, RADIUS session summaries needed for HotSpot delivery.
• Commerce: packages, vouchers, payment references, wallet and withdrawal requests, agent commissions.
• Support and security: audit logs, IP addresses, user agents, and abuse signals used to protect accounts.

We use data to provide the service you signed up for, keep networks and payments trustworthy, and communicate about your account.

• Create and secure workspaces, sites, routers, vouchers, and team access.
• Process payments, entitlements, commissions, and withdrawals.
• Diagnose install and AutoPilot health issues you ask us to investigate.
• Send transactional email (verification, security, billing) and product notices you can manage where settings allow.
• Detect fraud, credential stuffing, and misuse of the platform.

We do not sell personal data. We share data with infrastructure and payment partners only as needed to run LubFy, or when law requires it.

• Hosting, database, and email delivery providers under contract.
• Payment partners (for example mobile-money processors) to settle transactions you initiate.
• Google, only if you choose Google sign-in, limited to authentication identity.
• Authorities when we have a good-faith belief disclosure is required by applicable law.

We keep account and ledger records for as long as your organization is active and for a reasonable period afterward to meet reconciliation, dispute, and legal obligations.

Router credentials and secrets are stored encrypted. Access to production systems is restricted. No method of transmission or storage is perfectly secure — report suspected incidents to hello@lubfy.com promptly.

You can update profile details in the product. Organization owners can invite or remove team members.

To export or delete an organization account, contact us. We may retain anonymized or legally required records (for example completed payment ledgers) even after a deletion request.

LubFy is built for business operators. We do not knowingly collect personal data from children for consumer social use. If you believe a child provided data inappropriately, contact us and we will take appropriate steps.

We may update this Privacy Policy as LubFy grows. Material changes will be posted on this page with a new “Updated” date. Continued use after the effective date means you accept the revised policy.