Café Wi-Fi Login Email Collection: Doing It Properly

Somebody will sell you this as a growth hack: put a sign-in page in front of your guest Wi-Fi, ask for an email address before the internet unlocks, and in six months you have a few thousand contacts. The pitch is not wrong about the volume. It is wrong about what the volume is worth, and it skips the part where you are now holding other people's personal data on the basis of a tick box you did not write and cannot explain. Both halves of that are fixable in an afternoon, and both are much harder to fix afterwards.

What a login page can reasonably ask for

Far less than the form builder offers you. Every field is another second at the door, another reason for somebody to close the tab, and another piece of personal information you are responsible for keeping safe. The rule worth holding to is that you ask only for what you will genuinely use within a month, which in practice is one field and sometimes two.

Social sign-in buttons deserve a separate word. "Connect with Facebook" looks frictionless and quietly pulls across more about a person than you would ever have asked for on a form, which leaves you holding data you did not want and cannot justify. Offer the plain email box, or offer a password printed on the receipt and no page at all — the honest answer for many cafés, and the one the guest side of a café network lands on once you have seen what a captive portal actually costs you in support.

Consent that is specific rather than buried

Here is the mistake almost every default portal makes. The page has one checkbox, it says something like "I agree to the terms and conditions", and ticking it is the only way to get online. The person in front of you has agreed to the internet. They have not agreed to receive marketing from your café, and you cannot later point at that box and say they did — because the only thing it demonstrates is that they wanted Wi-Fi.

Separate the two. One line grants access. A second, distinct, unticked box says what you want to do with the address, in your own words: something like "Email me occasionally about new coffee and what's on at the café". Nobody who ticks that is in any doubt about what they agreed to, which is the whole point of consent, and the people who do not tick it still get their Wi-Fi. You will collect fewer addresses. Every one of them will be worth something.

Record it properly too, because consent you cannot evidence is consent you do not have. What you want stored against each address is the date, how it was collected, and the exact wording they agreed to — so that if the question ever comes up, you can produce the answer rather than reconstruct it. The consent section of building a café customer list goes through the same ground for the list you build at the till, and the two should work the same way.

Where the UAE rules sit, roughly

Two separate things apply, and it is worth knowing which is which. The first is personal data generally: the UAE has had a federal personal data protection law in force since the start of 2022, and its detailed executive regulations were still not published when this was written — so the operational specifics are still settling and worth checking rather than assuming. Some free zones run their own separate data protection regimes, so which rules reach you depends partly on where the business is licensed. The principles underneath are stable and unlikely to move: collect the minimum, say what it is for, use it only for that, keep it secure, and let people see what you hold and have it deleted.

The second is marketing messages, which carry their own layer. Promotional email and SMS in the UAE require the recipient's consent before anything is sent, that consent has to be recorded in a form you could actually produce, every message needs a free and working way to unsubscribe, and there are restrictions on when messages may go out. Confirm the current requirements with the telecoms regulator or with whoever you use to send, and take proper advice before you build anything larger than a small list. This article is not that advice, and neither is the vendor selling you the portal.

One practical line that resolves most of it: an address somebody typed in to get online is not permission to market to them, in exactly the way that a phone number given for an order is not. Different purposes need different permissions. Keep them apart on the form and the rest of this gets much simpler.

Keep the list somewhere you control

Captive portal products are happy to hold your list for you, show you a dashboard, and send the emails too. The question to ask on day one is the only one that matters in year two: can you export every address, with its consent date and wording, as a file, without asking anybody's permission? If the answer is no, or is a support ticket, the list is not yours in any useful sense — and the day you change router vendors or stop paying, it goes.

So export it on a schedule, keep the copy somewhere access-controlled rather than on a personal phone, and make sure more than one person can reach it without going through a staff member's account. This is the same lock-in question as whether you could actually get your data out of your POS, and the answer is worth knowing before it matters rather than on the morning you need it.

What you may then send, and how often

What you promised on the tick box, and no more. If the box said new coffee and what's on at the café, that is the mandate — a single-origin arriving, a change of hours over a holiday, the Saturday morning thing you are starting. It is not a weekly newsletter, and it is certainly not somebody else's offer because a partner asked nicely. Renting out a list that people joined to hear from you is the fastest way to turn it into a liability.

Once or twice a month is plenty for most single-site cafés, and there will be months with nothing worth saying, which is fine. Emailing a café's customers without annoying them covers what actually earns an open; the short version is that the test is whether a regular would be mildly pleased to know this. If the only reason for the email is that it is Thursday, don't send it.

Send the first one soon, though. A welcome message while somebody still remembers signing in to your Wi-Fi is the one email people reliably read, and it is where you set the expectation for how often you will write. Leave it eight months and your first message arrives from a café they cannot place, which produces unsubscribes and the occasional complaint.

Unsubscribing, and the part that quietly destroys trust

Every message needs a working one-click way out, and the only acceptable handling of it is immediate and permanent. Not a preference centre that requires a password. Not a reply-to-this-address instruction that lands in an inbox nobody reads. And never the thing that happens by accident: somebody unsubscribes, then uses your Wi-Fi again three weeks later, and the portal cheerfully puts them back on the list because the form does not know the difference between a new address and a returning one.

Check that specific behaviour before you launch, because it is the default in more products than it should be, and it is the one that turns a mild annoyance into somebody telling their friends your café spams people. A suppression list the portal respects on re-signup is a five-minute configuration and the single most important setting on the page.

Why 400 real addresses beat 4,000 harvested ones

A list collected as a toll on the Wi-Fi is mostly people who wanted the Wi-Fi. It contains throwaway addresses, typos, visitors who were in Dubai for a week, and people who will not recognise your name. Mail it and you get low opens, high unsubscribes, and spam complaints, which is how a sending platform starts to treat your messages as suspect — and that damage is not confined to the bad half of the list. It lands on the regulars too.

The small list behaves in the opposite direction. Four hundred people who deliberately ticked a box in your café open your messages, and a message that gets opened by half of four hundred beats one ignored by nine-tenths of four thousand — on the only measure that matters, which is whether the shop was busier. Which is also the argument against treating sign-ins as a target: a portal optimised for capture rate produces the worse list, every time.

There is a side effect worth naming. A sign-in page that demands an email is also a small, daily piece of friction for the person who just sat down with a laptop, and in a café where people work for hours that friction is felt more than you think — the zoning and socket decisions in a laptop workers policy do more for turnover than a captive portal ever will. If the page is annoying your best weekday trade to build a list you send to twice a year, it is not earning its place.

Where MidaOne fits

Plainly: MidaOne is not a Wi-Fi portal and it does not send email. Both of those are separate tools and should be. What the till gives you is the better half of this problem — stamp-card loyalty recorded at the moment somebody is already being served, so the list comes from people who actually bought coffee rather than people who wanted bandwidth, and sales reports by day, by hour and by item, so the quiet slot you are thinking of writing to is a number instead of a hunch. Afterwards those same reports are how you find out whether the message did anything. It is all inside the flat AED 200 a month, every feature included.

Frequently asked questions

The interesting thing about doing this properly is that it costs you almost nothing except volume, and volume was never the point. A second checkbox, a form with one field, a suppression list that works and one export a month: an hour of configuration in total, and what you end up with is a few hundred people who chose to hear from you and will. The alternative is a much bigger file that nobody wants to be on, which you will eventually be nervous about using — and a list you are nervous about using is not an asset, it is a thing you are storing.