Privacy Policy

1. Who we are and what this policy covers

WIFIGATE is a smart access-control product made up of the WIFIGATE mobile app for Android and iOS, the WIFIGATE gate controller that is installed at a gate, door or barrier, the website at wifigate.io, and the WIFIGATE web portal. The product is operated by EATS SYSTEMS TECH ("WIFIGATE", "we", "us"). You can contact us at support@wifigate.io.

This policy applies to personal data processed through the app, the controller, the website and the portal. It does not apply to third-party websites or services that are linked from our product, which have their own policies.

2. Summary

• We do not sell personal data, we do not show advertising, and the app does not collect advertising identifiers.
• The gate controller works over Bluetooth Low Energy and has no internet connection. The residents, guests and access history stored on a controller stay on that controller and are not sent to us.
• Personal data you keep in the app is stored on your phone in encrypted form.
• Our servers receive only what is needed to run your account, the web portal and firmware updates, and usage statistics that contain no advertising identifiers.
• You can delete your account at any time in the app, on the website or by email, as described in section 11.

3. Our role and the role of gate administrators

For account data, app usage statistics, firmware-update requests, the website and the web portal, EATS SYSTEMS TECH is the controller of your personal data.

A gate controller is managed by its administrator, such as a property owner, building committee, property manager or business. The administrator decides who is enrolled on the controller, what details are recorded about them and how long people keep access. For the data stored on a controller, the administrator is responsible for having a lawful basis, informing the people concerned and responding to their requests. We provide the technology, but we have no access to the data stored on a controller.

4. Personal data we process

Account data. You sign in to the app and the portal with Google or Apple. We receive your account identifier, name, email address and profile photo address, and the sign-in provider you used. If you use Apple's "Hide My Email", we receive a relay address instead of your email. Your acceptance of the Terms & Conditions and this policy is recorded in the app.

Profile details you enter. The phone number you enter in your profile is used to identify you on gates and in invitations. It is not verified by SMS.

Data you enter in the app. Gate names, icons, groups, notes and an optional gate address, and the details you enter when you invite someone: name, phone number and, if you choose, floor, apartment, parking space, vehicle number and a comment.

Contacts. If you choose a contact to invite, the app opens your phone's contact picker and reads the name, company and phone numbers of that one contact to fill in the invitation. We do not read, copy or upload your address book.

Camera. The camera is used only to scan the QR code on a controller label or in the administrator panel. Images are processed on your phone and are not stored or transmitted.

Bluetooth and location permission. The app communicates with controllers over Bluetooth Low Energy. Android requires a location permission for Bluetooth scanning, and iOS asks for Bluetooth and, where applicable, location permission for the same purpose. The app does not read your GPS position and does not track your location.

Auto Open. If you turn on Auto Open, your phone broadcasts a Bluetooth identifier that the gate controller recognises, including while the app is in the background, so that the gate can open when you approach it. The identifier is linked to your record on that controller only. You can turn Auto Open off at any time.

Data stored on a gate controller. When you are enrolled on a controller, it stores your name, phone number, email address if provided, floor, apartment and parking space if provided, your permission level and, if used, your Auto Open identifier. Controllers with history storage keep an access log of who opened or held the gate, when, how, and whether a request was refused. Names and phone numbers in the log are encrypted.

Usage statistics. The app uses Google Firebase Analytics with automatically collected events only, such as app opens, sessions, app version, device model, operating system and approximate country or region derived from the IP address. We do not set a user identifier, we do not log custom events, and advertising identifiers, advertising storage and ad personalisation are disabled.

App integrity and firmware updates. When the app checks for or downloads firmware for a controller, it sends an app-integrity token from Firebase App Check (Google Play Integrity or Apple App Attest) together with the update channel and hardware variant. Our cloud providers process the IP address and technical request data needed to deliver the file.

Web portal. If you are approved to use the portal, we store your account identifier, name, email address, whether your email is verified, your sign-in providers, your access status and role, and timestamps. Security audit records store an identifier and a one-way hash of your email address rather than the email itself.

Website. Browsing does not require an account. Our hosting provider processes technical data such as your IP address to deliver pages. The website stores your accessibility and cookie choices; it does not store a language choice. If you allow analytics, Google Analytics measures visits, page views and technical device information to help us improve the website. You can withdraw consent through Cookie settings in the footer. Details are in our Cookie Policy.

Communications. If you contact us by email or WhatsApp, we process your message, your contact details and the information you choose to share.

5. Why we use personal data and our legal bases

• To provide the service you ask for: your account, gate access, invitations, firmware updates and the portal (performance of a contract).
• To keep the product secure, verify genuine app installations, prevent misuse and protect controllers and accounts (our legitimate interests).
• To understand overall app usage and improve reliability, using statistics without advertising identifiers (our legitimate interests; where the law requires consent, we ask for it).
• To measure website usage and improve the website with Google Analytics, only after your consent.
• To answer your questions and provide support (performance of a contract and our legitimate interests).
• To comply with legal obligations and to establish, exercise or defend legal claims.

We do not use personal data for automated decisions that produce legal or similarly significant effects on you.

6. When personal data is shared

Service providers that process data on our behalf under contract: Google (Firebase Authentication, Firebase Analytics, Firebase App Check, Cloud Firestore, Cloud Storage and Cloud Run), Apple (Sign in with Apple and App Attest) and GitHub (website hosting).

Gate administrators. If you are enrolled on a controller, its administrators can see your enrolment details and the controller's access history in the app.

Invitation links you share. A private invitation link contains, in signed and encoded form, the phone number it is intended for, and a guest pass contains the guest's name. Anyone who holds a link can read what it contains, so share it only with the intended person. Links are shared through the app of your choice, such as WhatsApp or SMS, under that app's own terms.

Navigation apps. If you tap a gate address, it is opened in the map or navigation app you choose, such as Google Maps or Waze.

Legal reasons. We may disclose personal data where required by law, court order or a competent authority, or to protect the rights, property or safety of people, our users or us.

Business transfers. If our business or assets are transferred, personal data may be transferred to the acquirer, subject to this policy.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

7. International transfers

Our service providers may process personal data in the United States and in other countries outside your country of residence and the European Economic Area. Where required, transfers rely on adequacy decisions or on appropriate safeguards such as the European Commission's standard contractual clauses.

8. How long we keep personal data

• Account data: until you delete your account.
• Data in the app: on your phone until you delete it, delete your account or uninstall the app.
• Usage statistics: for the retention period set in Google Analytics, which does not exceed 14 months.
• Data on a gate controller: until the administrator deletes it or the controller is reset to factory settings. The access log keeps about the most recent 90 days of activity and older records are deleted automatically, earlier if storage runs low. Deleting a person from a controller does not erase past log entries; they expire with the log.
• Portal data: while your portal access is active, and until you ask us to delete it.
• Support communications: as long as needed to handle your request and any follow-up.

We may keep data for longer where the law requires it or to establish, exercise or defend legal claims.

9. Security

We use technical and organisational measures appropriate to the risk. Personal data in the app is encrypted on the phone with AES-256-GCM, with keys kept in the iOS Keychain or Android Keystore. Communication between the app and a controller uses encrypted, authenticated sessions. Production controllers use secure boot and flash encryption, and the names and phone numbers in the access log are encrypted.

No system is completely secure. Keep your phone locked, keep the app up to date, and keep the controller's QR label physically protected, because scanning it grants administrator access.

10. Your rights

Depending on the law that applies to you, including the Israeli Privacy Protection Law and the EU General Data Protection Regulation, you may have the right to access your personal data, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time.

To exercise a right, email support@wifigate.io from the email address linked to your account. We may need to verify your identity. We answer within 30 days. For data stored on a gate controller, please contact that gate's administrator, who controls it.

You may also lodge a complaint with a data protection authority, such as the Israeli Privacy Protection Authority or the authority in your EU country of residence.

11. Deleting your account

In the app: open your profile and tap Delete account. You will be asked to sign in again to confirm. Your account is deleted from our authentication service, your Apple sign-in authorisation is revoked if you used Apple, and your profile, credentials and app data are erased from that phone.

On the website: sign in at wifigate.io, open your dashboard and choose Delete account. You type your email to confirm and may be asked to sign in again. Every subscription of an organization you alone own is cancelled automatically and that organization is closed; in an organization you share with other owners, only the products you alone own are cancelled. Your user is then removed from WIFIGATE systems: your memberships, portal access and profile are erased and your account is deleted from our authentication service.

Without the app: email support@wifigate.io from the email address of your account with the subject "Delete my WIFIGATE account". We will delete your account and any portal data within 30 days and confirm by email.

Account deletion does not remove you from gate controllers, because that data is held on the controllers. Ask the gate's administrator to delete you. Usage statistics are kept only for the retention period described in section 8, and we keep data where the law requires it.

12. Children

WIFIGATE is not directed to children under 16, and we do not knowingly collect personal data from them through accounts. An administrator who enrols a minor on a controller, for example a family member, is responsible for obtaining any consent required by law. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows the current version. If a change is material, we will tell you in the app or on the website before it takes effect.

14. Contact

Controller: EATS SYSTEMS TECH

Email: support@wifigate.io

This policy is published in English and Hebrew and may be shown in English on pages in other languages. If versions differ, the English version prevails.

Read our Cookie Policy

Read our Terms & Conditions