Privacy Policy

PlugNApps LLC, a Washington limited liability company, runs PlugNKiosk, visitor sign-in for offices. An office (our customer) puts a tablet at its front desk; visitors check in on it, can sign the office's agreement, and the person they're visiting is told they've arrived. This policy explains what we collect, how we use it, who receives it and how we protect it.

Two kinds of information

For our customers' accounts, we decide how information is used. For visitors and the people they visit, the office decides what its kiosk collects and how that information is used, and we process it on the office's behalf. Visitors should send requests about their information to the office they visited first.

Information we collect

• Customer accounts: the office's name, the names and email addresses of people on its team and their roles, its locations, kiosks, logo, colors and settings, and the time it accepted our terms. Sign-in uses the shared PlugNApps login, which keeps a hash of your password and, if you use them, your sign-in code secret or passkeys.
• Visitors: the name, email address and company a visitor enters, who they came to see, when they checked in and out, and which kiosk they used. If the office uses an agreement, the visitor's typed name, their signature and the signed copy of the agreement. If the office turns it on, a photo taken by the kiosk's camera at check-in, which the visitor can skip. It's an ordinary photo: we don't use face recognition or make any biometric template from it.
• The people visitors come to see ("hosts"): name, email address and, if the office adds it, a mobile number.
• Kiosks: a device code stored only as a hash, the browser type, and when each kiosk last checked in.
• Support and technical data: messages you send us, and server logs that can include IP addresses and browser type.

Text messages

An office can ask to text a host when their visitors arrive. We email the host (we never text them first) a link to a sign-up page, where they enter their own mobile number and tick a box agreeing to the texts. Texts begin only after they do, with one confirmation text. We keep the mobile number, when they agreed, the IP address the form came from and the wording they agreed to, as the record of consent. Message frequency varies with how many visitors they have. Message and data rates may apply. Reply STOP at any time to stop the texts, or HELP for help. You can see the sign-up page at plugnkiosk.app/texts/example.

We use mobile numbers only to send the visitor-arrival texts that the number's owner has agreed to receive. We don't sell or share mobile numbers or text-message consent with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data is never shared with anyone except the provider that delivers the messages.

How we use it

• To provide the service: check visitors in and out, keep the signed agreements, and tell hosts their visitors have arrived by email, pop-up or text.
• To send account messages, such as kiosk-offline alerts.
• To keep the service secure, limit abuse, fix problems and restore from backup.
• To meet legal obligations.

We don't sell personal information, use visitor or host information for our own marketing, or run advertising or analytics scripts.

Who receives it

We share information only as the service needs, over encrypted connections to these providers' systems:

• Vultr: hosts our servers.
• Cloudflare: provides our domain name service and carries traffic to the app.
• Microsoft: delivers our emails through Microsoft 365.
• Twilio: delivers text messages to hosts who have agreed to receive them.
• Stripe and its Link service: sell and collect payment for subscriptions, when an office pays for the service, and handle sales tax, receipts and billing support. Card details go to Stripe directly and never reach our servers.

The office a visitor checks in with can view and export that visit, including the signed agreement. We may also disclose information when the law requires it, to protect people or the service, or as part of a sale or transfer of the business.

How long we keep it

Visits, photos, signatures and signed agreements are deleted after the period each office sets: one year by default, and between three months and three years. When an office deletes its account, we delete its data, and backups clear within 30 days.

How we protect it

• The app uses encrypted HTTPS connections.
• Photos, signatures and signed agreements are private files, shown only to people signed in to the office's account.
• Kiosk device codes and passwords are stored only as hashes.
• Backups are encrypted, and server access is limited to our administrator.

No system is completely secure, so we can't guarantee absolute security.

Cookies

The dashboard uses a cookie to keep you signed in and protect your forms, and each kiosk keeps a cookie that pairs it with its office. We don't use advertising or tracking cookies.

Your choices and rights

Depending on where you live, you may have the right to access, correct or delete your personal information. Email us to make a request. If you're a visitor or a host, we may refer your request to the office concerned.

Children

PlugNKiosk is for businesses and isn't directed to children. We don't knowingly collect children's information for our own purposes.

Where information is processed

We're based in the United States. We and our providers may process information in the United States and other countries.

Changes

We'll post any changes on this page with a new version label, and tell customers by email about significant ones.

Version 2026-11-10. Questions or requests: support@PlugNKiosk.com