Privacy Policy

1. Who is responsible for what

WISPHero is software that you install on a server you provide and control. We do not host it, and we cannot see the information in it.

• Information inside your copy of WISPHero, including information about your customers and staff, belongs to you and is controlled by you. You decide what WISPHero connects to, what it keeps and for how long, and you are responsible for your own privacy notices and for following the laws that apply to you (see our Terms of Service). If one of your customers asks about their information, you are the one who can answer, because only you can see it.
• Information that reaches us, such as the update check, visits to our website and emails you send us, is our responsibility, as described in sections 6 and 7.

Sections 2 to 5 describe what the software does on your server, so that you can decide how to use it and what to tell your own customers.

2. What WISPHero keeps about your customers

WISPHero keeps only the customer information it needs to monitor a connection.

Kept in WISPHero's database

• the account number from your CRM (for example, Sonar account 5001), and a label made from it that is used as the device's name, so alerts and notifications say which account without saying who;
• the IP address and MAC address of the customer's equipment;
• the exact map position of the customer's location, which the map and the RF tools need;
• the plan name and speeds, the UISP site and device IDs and the device model;
• readings from the customer's radio, such as signal, noise and LAN ports, and the history of ping checks; and
• notes your staff type, such as call-center notes.

Read when needed, but never stored

• The customer's name. WISPHero asks your CRM for the name only when someone opens that customer or searches by name, shows it, keeps it in the server's memory for a few minutes and then drops it. The name is never written to the database, a log file, a backup, an export, a notification or the browser's storage.
• Install photos from Sonar are passed straight through to the screen.
• The plan is compared on the screen with what Preseem reports. Only "the plans match" or "the plans do not match" is saved with a logged call.

Never asked for and never stored

• card numbers, bank accounts, balances, credit, invoices, payments, prices, discounts, taxes or billing status; and
• the customer's street address, phone numbers, email addresses and other contacts.

One honest exception: some CRM systems, such as UISP CRM, cannot be asked for fewer fields, so their answers do include some billing and contact fields. Those answers travel over an encrypted (HTTPS) connection, and WISPHero removes everything except the fields listed above the moment each answer arrives, before anything is stored or logged.

Notes show a reminder not to type customer personal or payment details, and WISPHero refuses a note that contains something that looks like a payment card number. Notifications about a new call-center note say that a note was added, but not what it says.

A customer from your CRM is never listed on the public status page.

When a customer leaves your qualifying CRM list, WISPHero switches that device off and, after 90 days by default, clears its map position, MAC address and CRM details. You can change the number of days in Settings.

3. What WISPHero keeps about your staff

For each person who has a WISPHero account, WISPHero keeps:

• their name or username, email address and role;
• their password, stored only as a one-way hash;
• an optional profile picture and their display preferences;
• two-step sign-in settings, with the key stored encrypted and recovery codes stored only as hashes; and
• security and audit records, such as sign-ins and important changes, which can include IP addresses and times.

WISPHero uses cookies only for signing in and security, such as keeping a person signed in and recognizing a browser that has signed in before. It stores the light or dark theme choice and some display choices in the browser. It uses no advertising or tracking cookies.

When the first account is created, WISPHero records the version and date of the Terms of Service and Privacy Policy that were accepted. It records nothing else about the person.

4. Your network, backups and how long data is kept

WISPHero keeps information about your network, such as devices, sites, addresses, readings, alerts and history. Passwords and API keys you enter for devices and connected services are stored encrypted.

Backups contain the same information as the database. You decide where they go: on the server, downloaded to your computer or copied to your own Dropbox account. Set a backup password so that every backup is encrypted, and delete old backups you no longer need.

You control how long history is kept in Settings > System. Deleting a device, site or note in WISPHero removes it from the database. Copies in older backups remain until you delete those backups.

5. What WISPHero sends to other services

To do its job, your WISPHero server contacts other services. Each one sees your server's IP address, and each has its own privacy policy. WISPHero contacts:

• Systems you connect, such as UISP, your CRM, cnMaestro, Preseem, Tarana, MikroTik routers and Dropbox, using the addresses and keys you enter.
• Public data sources, once you set your network operations center (NOC) location: NOAA and the National Weather Service, for weather alerts, lightning and radio ducting forecasts, which receive the NOC location or an area around it; and utility power outage maps, which receive the area around your towers. For the Customer Diagnostic weather, the National Weather Service receives the customer's position rounded to about 1 km, never the exact home.
• Other public services: CelesTrak for public satellite data, which receives nothing about you; NASA POWER for solar data, which receives a location rounded to about 11 km when you load sun data; radar status, space weather and flight data services when someone opens the DFS Center, some of which receive the NOC location or an area around it; OpenStreetMap search and map data services and terrain services when you use the map tools; public news, security and weather sources, only while someone has the Dashboard's briefing open; and Let's Encrypt, which receives your domain name and email address if you set up an HTTPS certificate through WISPHero.
• Notification services you turn on: your email server, Slack and web push services. Alerts name devices by their label, such as the CRM account number, not by the customer's name.

The web browser of each person using WISPHero also loads fonts from Google Fonts, some scripts from public code libraries (jsDelivr and unpkg), map images from OpenStreetMap by default and, on secure (HTTPS) pages, Google's Cast library. Those providers see the browser's IP address.

Settings > System > Network activity in WISPHero lists what it sends and lets you turn many of these off.

6. What reaches us

• The update check. Unless you turn it off, your server asks wisphero.com once a day whether a new version is available. The first check happens about 10 minutes after the server starts, and never before the first account exists. The request carries only the WISPHero version number and the update channel (stable or beta). It carries no cookie, no installation ID, no host name and no customer or network data. Like any web request, it shows our website your server's public IP address. When a super admin chooses to download an update, the update file is downloaded from wisphero.com the same way. You can turn the check off during setup or in Settings > System > Updates & Release Notes.
• Nothing else from the software. WISPHero sends us no telemetry, no analytics, no crash reports and no usage statistics. The managed support item in Settings is only a link; your server never contacts us through it.
• Email. If you email us, we receive what you send, and we keep it to answer you and for our records.
• Managed support. If you hire WISPConsult for managed support, our staff may access your WISPHero server and the information in it as your separate written agreement allows. We use that access only to provide the service, and we keep what we see confidential.

7. The wisphero.com website

wisphero.com uses no cookies, no analytics, no tracking and no third-party scripts or fonts. Everything on it is served from wisphero.com itself.

If you switch the site between light and dark mode, that choice is saved in your own browser's storage on your device. It is never sent to us.

Like any website, the company that hosts wisphero.com may keep standard server logs, such as the IP address, the page requested, the time and the browser type, for security and to keep the site running. We do not use them to identify or profile visitors.

8. Selling and sharing

We do not sell personal information, and we do not share it for advertising. We never receive your customers' information from WISPHero. We may disclose information we hold if the law requires it, to protect rights, property or safety, or as part of a business transfer, such as moving the business into a company we form.

9. Security

WISPHero includes protections such as hashed passwords, encrypted stored credentials, signed updates and limits on sign-in attempts. However, it is largely written with AI coding tools ("vibe coded") and has not had an independent professional security audit, and no system is perfectly secure. You are responsible for securing your server, your network and your accounts, as our Terms of Service explain.

10. Your choices and requests

• If you are a customer of an internet service provider that uses WISPHero, contact that provider about your information. We cannot see or change it.
• If you use WISPHero, you can see, change and delete what it keeps: edit or delete devices, sites, notes and accounts; change how long history is kept; delete old backups; turn off CRM sync, the update check and other connections; or remove WISPHero from your server.
• For information we hold, such as emails you sent us or managed support records, you can ask to see, correct or delete it by emailing tim@wispconsult.com. We may need to confirm who you are. We will answer within the time the law requires, and we will not treat you differently for asking. Residents of some states have specific privacy rights by law, and we honor those requests where they apply.

11. Children

WISPHero and wisphero.com are for businesses and are not meant for children. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, email us and we will delete it.

12. Where we are

We are based in the United States, and WISPHero is built for use in the United States. Information we hold is kept in the United States. If you use WISPHero outside the United States, the information in it stays on your own server, and you are responsible for following local law.

13. Changes to this policy

We may change this policy. When we do, we will publish the new version with a new effective date on wisphero.com and in the next WISPHero update. If a change affects what WISPHero sends or keeps, we will say so in the release notes.

14. Contact us

Timothy Steele, doing business as WISPConsult. Email: tim@wispconsult.com. Our mailing address is available on request by email.