Privacy Policy

B. FLORES ALVARIZA LTDA (CNPJ 62.639.487/0001-04), Pelotas, RS, Brazil, is the controller of the personal data described here. Privacy contact: [email protected].

• Account data: email address and a hashed password (never stored in plain text). With Google Sign-In we receive your email address from Google.
• Sign-up and security data: the IP address used to create the account, creation date, login sessions and password reset records.
• Attribution data: referring page, landing page, campaign parameters (UTM), a referral or promo code you used, and an optional 'how did you hear about us' answer.
• Analytics identifiers: Google Analytics client and session IDs linked to your account to measure sign-ups and purchases.
• Order data: numbers bought or rented, app and country selected, prices, status, timestamps and favorite services.
• SMS content: sender, text and verification code of messages received on your numbers.
• Payment and balance data: balance, transaction history and, for crypto top-ups, the token, amount, exchange rate, payment reference and transaction signature. We do not collect card or bank details.
• API data: a hashed version of your API keys, a short prefix and when each key was created, last used or revoked.
• Support data: ticket contents and attachments.
• Technical data: browser, device and usage information collected through cookies (see the Cookie Policy).

• To create and run your account, process top-ups, deliver numbers and codes, keep order history and provide API access (performance of a contract).
• To answer support tickets and handle refunds or disputes (contract and legitimate interests).
• To prevent fraud, abuse, multiple accounts and violations of the Acceptable Use Policy, and to secure the service (legitimate interests).
• To understand how visitors find and use the site and improve it (consent where required, otherwise legitimate interests).
• To send service emails such as password resets and order notices (contract), and occasional product emails with an unsubscribe option (legitimate interests or consent).
• To keep accounting and transaction records and respond to lawful requests (legal obligation).

Messages received on your numbers are shown only to you, in the dashboard and through the API, and stored as part of your order history so you can see past codes and so we can review a ticket. You can ask us to delete your SMS history at any time at [email protected]; it is deleted with your account. Staff access message content only to handle a support request, investigate abuse or meet a legal obligation. Codes are meant for one-time use; do not rely on SMS Nitro to store anything you need to keep.

We use essential cookies and local storage to keep you signed in and protect forms against bots. With your consent where required, we use Google Analytics 4 (visits, sign-ups, purchases), Microsoft Clarity (aggregated heatmaps and session insights, with form fields and the dashboard masked) and Cloudflare Turnstile or Google reCAPTCHA (bot protection). Details are in the Cookie Policy.

We do not sell your personal data and do not share it for cross-context behavioral advertising. We share data only with providers that help us run the service, under contracts that limit their use of it:

• Hosting and infrastructure providers that store our database and serve the website.
• Upstream number providers, which supply the numbers and pass incoming SMS to us. They receive only what is needed to fulfill an order (service and country), not your email address.
• Our transactional email provider, for account and service emails.
• Google (Sign-In, Analytics, reCAPTCHA), Microsoft (Clarity) and Cloudflare (Turnstile, network security).
• Stripe, our card processor. Card details are entered on Stripe's checkout and go directly to Stripe; we receive the payment status, amount, last four digits, card brand and Stripe's fraud signals.
• Public blockchain networks such as Solana: crypto top-ups are recorded on a public ledger that we cannot delete.
• Authorities or other parties when required by law, to respond to valid legal requests, or to protect our rights, users or the public.
• A buyer or successor if our business is involved in a merger, acquisition or asset sale.

Our providers may process data in countries other than yours, including the United States. Where the law requires it we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.

Account data is kept while your account is open. SMS content is kept in your order history while the account is open, as explained above. Order, transaction and payment records are kept as long as needed for accounting, tax, fraud prevention and dispute purposes, including after closure. Support tickets are kept while needed to resolve the issue and for a reasonable period afterwards. Data no longer needed is deleted or anonymized.

We use reasonable technical and organizational measures: encrypted connections (HTTPS), hashed passwords and API keys, and restricted staff access. No system is perfectly secure, so use a strong, unique password and keep your API keys private.

Depending on where you live, including under the LGPD (Brazil), GDPR, UK GDPR and the CCPA/CPRA, you may have the right to:

• Access the personal data we hold about you and receive a portable copy.
• Correct inaccurate data.
• Delete your data, subject to records we must keep by law.
• Object to or restrict certain processing, including processing based on legitimate interests.
• Withdraw consent at any time, for example for analytics cookies or marketing emails.
• Know what categories of data we collect and share, and opt out of any sale or sharing (we do neither).
• Not be discriminated against for exercising your rights.
• Lodge a complaint with your data protection authority (in Brazil, the ANPD).

Email [email protected] from the address linked to your account, or open a ticket. We may need to verify your identity first. We aim to respond within one month, or within the time required by the law that applies to you. An authorized agent may act on your behalf with proof of authorization.

The service is intended only for adults aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

We may update this policy as the service changes. The date at the top shows the latest version; significant changes are announced by email or in the dashboard before they take effect.

Email [email protected] or write to B. FLORES ALVARIZA LTDA, Pelotas, RS, Brazil.