This Privacy Policy explains how OTPInbox (the "data controller" and "we") collects, uses, shares and protects your personal data when you use the service, and the rights you have over it. It reflects the requirements of the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
1. Data we process
- Account: your email address and a unique account identifier.
- Usage: the service and country you rent, order history and credit movements.
- Technical: IP address, browser type, strictly necessary cookies and security logs. For every sign-in, order and terms confirmation we record the time and IP address.
- Payment: payments are handled by our payment processor (Stripe); your card details never reach us and are not stored by us.
2. How and why we use your data
- To provide the service, rent numbers and deliver your verification code (performance of our contract with you).
- To keep accounts secure and prevent fraud and abuse (our legitimate interests).
- To process payments and keep billing records (performance of contract and legal obligation).
- To meet the legal obligations that apply to us.
- To keep a record of who used which number and when, so we can investigate abuse and respond to valid legal requests (legal obligation and legitimate interests).
3. Who we share data with
To run the service we share limited data with processors acting on our behalf: our number provider(s), our payment processor (Stripe), our email delivery provider and our hosting and infrastructure provider. They access it only as far as the service requires. Where data is transferred to another country, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We do not sell your personal information. We disclose account and order records, including IP addresses, to law enforcement or other authorities only when we receive a valid legal request.
4. Cookies and local storage
We use only cookies that are strictly necessary for the session and security, for example the CSRF token and your language preference. Session cookies are httpOnly and cannot be read by JavaScript. We use no advertising or third-party tracking cookies.
To keep the site secure and prevent abuse, we record page visits together with the IP address and browser information; these records are kept for 90 days. We do not use cookies for this. On your first visit, your browser keeps a small note of where you came from (the referring site, campaign tags, the first page you opened and the language), with no identifier in it. When you sign up, we store with your account which page and source brought you to us.
5. Retention and security
We keep personal data only as long as needed for the purposes above and as required by law, then delete or anonymise it. Sign-in, order and terms confirmation records, with their IP addresses, are kept for two years and then deleted; they are kept for that period even if you close your account, because they may be needed to answer legal requests. We do not store the content of the SMS messages you receive beyond the verification code shown to you, and a number is released after the transaction. Passwords are never stored; session and refresh tokens are stored only in hashed form. Access is strictly limited.
6. Your rights
Under the GDPR you can access, correct, delete, restrict or object to the processing of your data, ask for data portability, and withdraw consent at any time; you may also lodge a complaint with your local data protection authority. Under the CCPA/CPRA, California residents can know, delete and correct their personal information and opt out of its sale or sharing; we do not sell personal information, and we will not discriminate against you for exercising your rights. To exercise any right, contact us through our support channels and we will respond within the time the law allows.
7. Contact
The data controller is OTPInbox. For any privacy request or question, reach us through our support channels. You can email us at support@otpinbox.net.