Privacy policy
This policy will describe what is collected, why, how long it is kept, and who it is shared with — with particular care for message content, which concerns a third party who never agreed to anything.
Not yet in force
What is collected
Account data (email address, authentication material), transaction data (orders, balance movements), and technical data (session metadata, approximate location derived from IP for security purposes).
Pending: Requires the final data inventory to be fixed and reviewed.
Message content
A message received on a number you rented is shown to you and retained only as long as the order needs it. It is treated as the most sensitive category of data held, and internal access to a message body is a separately-authorised, time-boxed and audited action rather than an ordinary permission.
Pending: Requires a decided lawful basis and retention period. The sender of a verification message is a third party who consented to nothing, which constrains both.
Retention
How long each category is kept, and what is deleted rather than anonymised when an account is closed.
Pending: Requires the retention schedule to be fixed per category.
Sharing and processors
The categories of processor engaged to run the service, and the safeguards applied to any transfer of personal data across borders.
Pending: Cannot be completed before the processor set is fixed; no supplier has cleared the onboarding gate.
Your rights
Access, correction, deletion, portability and objection, and how to exercise each.
Pending: Requires the responsible entity and a working request channel to be named.
Security
Encryption in transit and at rest, second-factor authentication, session visibility and revocation, and scoped credentials.
Pending: Written last, so it describes the system as shipped rather than as intended.