Privacy Policy

Last updated: 30 August 2026

ApexTicket is hotspot billing software for internet service operators. You use it to create WiFi vouchers, manage your MikroTik routers, and sell internet access to your own customers. This policy explains what we collect, why, and who else can see it.

Who this policy covers

There are two different groups of people involved, and they are treated differently:

• Operators — businesses who sign up for an ApexTicket account to run their hotspot. If you created an account here, this is you.
• Hotspot customers — the people who buy an operator's vouchers and connect to their WiFi. They never create an ApexTicket account. ApexTicket processes their information on the operator's behalf; the operator, not ApexTicket, decides how their WiFi business is run.

What we collect from operators

• Account details — your business name and email address.
• Sign-in credentials — either a password, which is stored only as a bcrypt hash and never in readable form, or, if you sign in with Google, your Google account's unique ID and email address. We never receive or store your Google password.
• Router connection details — the address, API port, username and password for each router you add. The password is encrypted at rest and decrypted only in memory at the moment the service connects to your router, which it does to create and manage vouchers on your behalf. It is used for nothing else.
• Business data you create — your plans, prices, voucher codes and their status, and settings such as your customer status-page thresholds.
• Payment records — for your ApexTicket subscription we store the plan you chose, your renewal date, and a Paystack reference and authorisation token. We never see or store your full card number, expiry date or CVV — those go directly to Paystack and never touch our servers.
• Your own Paystack keys — if you enable customer top-ups, the keys you supply are stored so top-up payments can be verified against your own Paystack account. Your secret key is encrypted at rest and is never sent back to the browser once saved.

What is processed about hotspot customers

When someone connects to an operator's WiFi, ApexTicket handles the voucher code they entered, how much data and time that voucher has used and has left, and, if they buy a top-up, the amount paid and its Paystack reference. Device MAC addresses are handled by the router itself when free trials are enabled.

We do not ask hotspot customers for names, addresses, or any identity documents, and we do not build profiles of them or track their browsing.

Why we collect it

Only to run the service: to sign you in, to connect to your routers and manage vouchers as you instruct, to show you your own usage and revenue figures, to take subscription payments, and to send you necessary account emails (email verification and password resets). We do not sell your data, and we do not use it for advertising.

Who else is involved

ApexTicket relies on a small number of service providers, each handling only what it needs to:

• Paystack — processes subscription payments and, if you enable it, your customers' top-up payments. Card details are handled entirely by Paystack.
• Resend — delivers account emails such as email verification and password resets.
• Google — only if you choose to sign in with Google. Google tells us your email address, your Google account ID, and whether Google has verified that email. Nothing is sent back to Google about how you use ApexTicket.

Beyond these, we do not share your data with anyone, except where we are legally required to.

Security

The service is served over HTTPS, your sign-in password is stored only as a bcrypt hash, and sign-in uses signed session tokens. Credentials that the service has to be able to replay — your router's API password, your own Paystack secret key, and any saved card token — are encrypted at rest using AES-256-GCM with a key held outside the database, so a stolen copy of the database alone does not expose them. Every account's data is isolated, so one operator can never read another's routers, plans, vouchers or revenue. No system is perfectly secure, but access to stored data is restricted to what is needed to operate the service.

How long we keep it

Account and business data is kept for as long as your account exists. Voucher and revenue records are kept so your own historical reporting stays accurate. If you close your account, your data is deleted along with it.

Your choices

You can change your business name and settings from your dashboard, remove routers, plans and vouchers you no longer need, reset your password by email at any time, and request that your account and its data be deleted by contacting us.

Children

ApexTicket is business software and is not directed at children.

Changes

If this policy changes materially, the date at the top of this page will be updated.

Contact

Questions about this policy, or requests about your data, can be sent to elisagerafa900@gmail.com.