Privacy Policy

SmsGate ("we," "us," or "our") operates a platform that provides users with real, non-VoIP phone numbers for the purpose of receiving SMS verification codes from third-party platforms. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website or use our Service.

By accessing or using SmsGate, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.

We collect different types of information depending on how you interact with our Service:

We collect information through the following methods:

• Directly from You: When you register an account, purchase credits, rent phone numbers, contact support, or interact with our Service.
• Automatically: When you browse or use our platform, we automatically collect technical and usage data through cookies, log files, and similar technologies.
• From Phone Numbers: When you rent a phone number and it receives an SMS message, we capture and display the message content (including verification codes) on your dashboard.
• Payment Processors: When you make a purchase, our third-party payment processors may share transaction confirmation details with us.
• Third-Party Analytics: We may use analytics services (e.g., Google Analytics) that collect data about your usage of the Service.

We use the information we collect for the following purposes:

• Service Delivery: To provide phone numbers, display received SMS verification codes, manage your rentals, and process transactions.
• Account Management: To create and manage your account, authenticate your identity, and process credit purchases.
• Communication: To send transactional notifications (rental confirmations, credit purchases, code receipts), service updates, and respond to support inquiries.
• Security & Fraud Prevention: To detect and prevent fraudulent activity, monitor for abuse, protect against unauthorized access, and enforce our Terms of Service.
• Service Improvement: To analyze usage patterns, improve our platform features, optimize number availability, and enhance the user experience.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.
• Marketing: With your consent, to send promotional materials about new features, credit offers, or platform updates. You can opt out at any time.

We process your personal information based on the following legal grounds:

• Contract Performance: Processing is necessary to fulfil our agreement with you — providing phone numbers, processing payments, and delivering verification codes.
• Legitimate Interest: We have a legitimate business interest in improving our Service, preventing fraud, and ensuring platform security.
• Consent: Where required by law, we obtain your consent before processing your data, particularly for marketing communications and non-essential cookies.
• Legal Obligation: We may process your data when required to comply with laws, regulations, or court orders.

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

• Service Providers: We share data with trusted third-party providers who assist in operating our platform, including payment processors, cloud hosting services, analytics providers, and customer support tools.
• Carrier Partners: We work with telecommunications carriers to provide phone numbers. We may share limited data necessary for number provisioning and management.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of the transaction.
• With Your Consent: We may share your information with third parties when you provide explicit consent.

Given the nature of our Service, SMS and verification data deserves special attention:

• SMS Content: When a phone number you rent receives an SMS message, the full message content (including verification codes, sender information, and timestamps) is captured and displayed on your dashboard.
• Temporary Storage: SMS messages received on rented numbers are stored temporarily and are typically purged within 24–72 hours after your rental period expires.
• No Outbound SMS: We do not store or process any outbound SMS data because our numbers are receive-only.
• Shared Number Visibility: On shared numbers, SMS messages may be visible to multiple users who have rented the same number. We recommend using dedicated numbers if the privacy of received codes is important to you.
• Verification Logs: We maintain logs of which numbers were rented, by which user, and when. These logs are used for billing, dispute resolution, and fraud prevention.
• Platform Identification: We may identify the sending platform of SMS messages (e.g., "Google," "Amazon") for categorization purposes, but this information is derived solely from the SMS content and sender ID.

We use cookies and similar tracking technologies to enhance your experience on our platform:

You can manage your cookie preferences through your browser settings. Please note that disabling essential cookies may prevent you from using certain features of the Service.

We retain your information for as long as necessary to fulfil the purposes described in this Privacy Policy:

• Account Data: Retained for the duration of your account and up to 30 days after deletion to allow for recovery.
• SMS & Verification Data: Temporarily stored and typically purged within 24–72 hours after your rental period ends. Summary logs (number, timestamp, sender) may be retained for up to 90 days.
• Payment & Transaction Records: Retained for up to 7 years to comply with financial regulations and tax obligations.
• Usage & Analytics Data: Retained in aggregated, anonymized form for up to 3 years for trend analysis.
• Support Communications: Retained for up to 2 years after the last interaction.
• Security Logs: Retained for up to 1 year for fraud detection and investigation purposes.

When data is no longer required, it is securely deleted or anonymized so that it can no longer be linked to you.

We implement industry-standard security measures to protect your personal information:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS). Sensitive data at rest is encrypted using AES-256.
• Access Controls: Access to personal data is restricted to authorized personnel only, using role-based access controls and multi-factor authentication.
• Infrastructure Security: Our servers are hosted in SOC 2-compliant data centers with physical security, redundant power, and 24/7 monitoring.
• Password Security: User passwords are hashed using bcrypt with unique salts and are never stored in plain text.
• Regular Audits: We conduct regular security assessments, penetration testing, and vulnerability scanning.
• Incident Response: We maintain an incident response plan to promptly address any security breaches.

SmsGate operates globally and may transfer your personal information to countries other than your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data Processing Agreements (DPAs) with all service providers.
• Ensuring recipient countries provide adequate levels of data protection.
• Implementing supplementary technical and organizational measures as needed.

By using SmsGate, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your own. We will always apply the protections described in this Privacy Policy regardless of where your data is processed.

Depending on your location and applicable laws, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format for transfer to another service.
• Right to Object: Object to the processing of your data for direct marketing or based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, please contact us at privacy@smsgate.dev. We will respond to your request within 30 days.

SmsGate is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take immediate steps to delete that information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@smsgate.dev so we can take appropriate action.

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is currently no universally accepted standard for how companies should respond to DNT signals, we do not currently respond to them. However, you can manage your tracking preferences through:

• Your browser's cookie settings and privacy controls.
• Opt-out tools provided by advertising networks (e.g., NAI, DAA).
• Our cookie consent management tool on the website.

We will update this policy if a uniform DNT standard is adopted in the future.

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).
• Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit: You may limit the use and disclosure of sensitive personal information when applicable.

To exercise your California privacy rights, contact us at privacy@smsgate.dev or call us at the number listed in the Contact section.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) grants you enhanced data protection rights:

• All rights listed in Section 12 (Your Rights & Choices) apply to you.
• We process your data based on the legal bases described in Section 5.
• We have appointed a Data Protection Officer (DPO) to oversee GDPR compliance. Contact: dpo@smsgate.dev
• For international transfers, we rely on Standard Contractual Clauses as described in Section 11.
• You have the right to lodge a complaint with your local supervisory authority.

Our Service may contain links to or references to third-party websites and platforms (such as Google, Amazon, eBay, and others for which you may use our numbers for verification). Please note:

• We are not responsible for the privacy practices of any third-party website or service.
• This Privacy Policy applies only to SmsGate and does not cover third-party platforms.
• We encourage you to review the privacy policies of any third-party service you use.
• We do not share your SmsGate account information with the platforms where you verify accounts.
• Third-party payment processors (e.g., Stripe, PayPal) have their own privacy policies governing how they handle your payment information.

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email within 72 hours of becoming aware of the breach, as required by GDPR and other applicable laws.
• Notify the relevant data protection authorities within the required timeframe.
• Provide a clear description of the breach, the data affected, and the likely consequences.
• Outline the steps we are taking to address and mitigate the breach.
• Offer guidance on steps you can take to protect yourself (e.g., changing passwords, monitoring accounts).
• Post a notice on our website if a large number of users are affected.

SmsGate may use automated systems to:

• Fraud Detection: Analyze account activity patterns to detect and prevent fraudulent use of our Service, including mass account creation, abuse of shared numbers, and unauthorized reselling.
• Number Assignment: Automatically assign available phone numbers based on your selected country, carrier, and platform preferences.
• Credit Refunds: Automatically process credit refunds when our system detects that a verification code was not delivered within the expected timeframe.
• Account Restrictions: Automatically flag or restrict accounts that exhibit behavior that violates our Terms of Service.

You have the right to request human review of any automated decision that significantly affects you. To request a review, contact us at support@smsgate.dev.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

• We will update the "Effective Date" at the top of this page.
• For material changes, we will notify you via email or a prominent notice on our platform.
• We will provide at least 30 days' notice before significant changes take effect.
• Your continued use of the Service after the updated policy takes effect constitutes acceptance.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: