Privacy Policy

01Who We Are

AuthSMS (authsms.net) is the controller of the personal data processed through the Service. This policy explains what we collect, why, who receives it and what rights you have. For privacy questions or requests, use the contact page of our website or a support ticket.

02Data We Collect

We collect only the data we need to run the Service.

• Account data: email address, username, password (stored only as a salted hash), preferred language and currency, and optional profile details.
• Sign-in data: if you use Google or Apple sign-in, we receive your email address and basic profile identifier from that provider. For passwordless login we store a hashed one-time code for a short time.
• Transaction data: top-up and payment records (amount, currency, status, payment method and provider reference), balance history. We do not receive or store your full card number; card and bank details are handled by the payment provider.
• Service data: the numbers you activate or rent, the service and country, status, price, and the content of the SMS messages received on those numbers.
• Technical data: IP address, browser and device type, approximate location derived from the IP address, login attempts and security events, used for fraud prevention and security.
• Support data: messages and attachments you send us through tickets or the contact form.
• Usage and cookie data: pages visited and interactions with the Service, collected through analytics and essential cookies (see "Cookies").

03Why We Use Your Data

• To provide the Service: create and secure your account, process payments, assign numbers, deliver SMS codes and process refunds (performance of a contract).
• To prevent fraud, abuse and security incidents, and to enforce our Terms (legitimate interest).
• To meet legal, tax, accounting and regulatory obligations (legal obligation).
• To provide customer support and respond to your requests (contract and legitimate interest).
• To send service messages such as login codes, receipts, security alerts and important updates. Marketing emails are sent only with your consent and you can opt out at any time.
• To understand how the Service is used and to improve it (legitimate interest, or consent where required).

04Who We Share Data With

We do not sell your personal data. We share data only with the following categories of recipients and only as far as needed:

• Telecom and number suppliers: technical data needed to supply a number and receive messages for it (such as the service and country requested). We do not send your account identity to them.
• Payment providers: data needed to process your payment, such as the amount, currency and order reference. Payments are processed under the provider’s own privacy policy.
• Infrastructure and security providers: hosting, content delivery, email delivery, bot protection (CAPTCHA), error monitoring and analytics tools that process data on our behalf.
• Authorities: when we are legally required to do so, or to protect our rights, users or the public from fraud and abuse.

05International Transfers

Our providers may process data in countries other than your own, including outside the European Economic Area and Türkiye. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent protections.

06How Long We Keep Data

• Account data is kept while your account is active and deleted or anonymised after you ask us to delete the account, except for records we must keep by law.
• Transaction records are kept for as long as tax and accounting law requires.
• Received SMS content and activation details are kept only as long as needed to deliver the code, show your history and handle disputes, and are deleted or anonymised afterwards.
• Security logs and one-time login codes are kept for a short period and are removed automatically when they expire.

07How We Protect Data

• Traffic between you and the Service is encrypted with HTTPS/TLS.
• Passwords are stored as salted hashes, never in clear text; login codes and tokens are stored only as hashes.
• Access to production systems is restricted and logged; optional two-factor authentication is available for your account.
• We use rate limiting, bot protection and fraud monitoring to detect abuse.

08Cookies

We use essential cookies and local storage to keep you signed in, remember your language, currency and theme, and protect the Service from abuse. We also use analytics tools to measure traffic and improve the Service. You can block or delete cookies in your browser settings; the Service may not work correctly without essential cookies.

09Your Rights

Depending on where you live, including under the GDPR and the Turkish Personal Data Protection Law (KVKK), you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• request deletion of your data and your account;
• restrict or object to certain processing, including marketing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data protection authority.

10Children

The Service is not intended for anyone under 18. We do not knowingly collect data from minors; if you believe a minor has provided us data, contact us and we will delete it.

11Changes to This Policy

We may update this policy from time to time. The date of the latest update is shown at the top of the page, and we will notify you of significant changes by email or inside the Service.