We take your privacy
seriously.

Who We Are

Smsvital is an online platform that provides disposable virtual phone numbers for the purpose of receiving SMS verification codes. We are operated by Smsvital (“we”, “us”, or “our”).

If you have any questions about this Privacy Policy, please contact us at support@smsvital.com.

What Information We Collect

We collect only the minimum information needed to operate the service:

Account information

• Email address — required to create your account and send transactional emails (payment receipts, password resets).
• Password — stored as a one-way cryptographic hash (bcrypt via Supabase Auth). We cannot read your password.

Transaction and usage data

• Wallet top-up amounts and the payment reference issued by our payment processor.
• Records of numbers purchased: the service name, country, price paid, and timestamp.
• SMS verification codes received on numbers you purchased — visible only to you and automatically deleted when the order expires.

Technical data

• IP address — logged at the server level for security monitoring and rate limiting. Not linked to your profile.
• Standard HTTP request metadata (browser type, referring page) — collected in server logs, not stored in your account.

We do not collect your real name, physical address, date of birth, or any government-issued identification. You are identified solely by your email address.

How We Use Your Information

We use your information only to:

• Provide and operate the Smsvital service, including processing payments and delivering virtual numbers.
• Send transactional emails you explicitly trigger: account confirmation, password reset, payment receipts.
• Detect and prevent fraud, abuse, and violations of our Terms of Service.
• Comply with applicable laws and respond to lawful requests from authorities.
• Maintain and improve service reliability and performance.

We do not use your data for advertising, analytics profiling, or any form of marketing targeting. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Data Storage and Security

Your account data is stored in Supabase, a cloud database provider with SOC 2 Type II certification. All data is encrypted at rest and in transit (TLS 1.2+).

Access to your account data is restricted by Row-Level Security (RLS) policies — meaning database queries automatically enforce that you can only ever read your own records.

Payment processing is handled by TransactPay. We do not store card numbers, bank account details, or any raw payment credentials on our servers. All payment data is handled entirely within TransactPay's PCI-compliant environment.

Despite our best efforts, no system is 100% secure. In the event of a data breach affecting your personal information, we will notify you by email within 72 hours of becoming aware of the incident.

Third-Party Services

We share data with the following third parties only to the extent necessary to operate the service:

Each third party has their own privacy policy governing how they handle data. We encourage you to review them if you have concerns.

Emails We Send You

We send only the following transactional emails — no newsletters, no marketing:

• Account confirmation email when you sign up.
• Password reset email when you request one.
• Payment receipt when a top-up is successfully processed.
• Security notices in the event of suspicious activity on your account.

All transactional emails can be identified by the sender address noreply@smsvital.com. If you receive marketing emails claiming to be from Smsvital, please report them to support@smsvital.com.

Data Retention and Deletion

We retain your data for as long as your account is active. Specifically:

• SMS codes received on virtual numbers are deleted automatically when the order expires (within 10 minutes of purchase).
• Transaction history is retained for 24 months to support dispute resolution and regulatory compliance.
• Server logs containing IP addresses are retained for 30 days and then purged.
• Account data (email, balance) is retained until you request account deletion.

To delete your account and all associated data, email support@smsvital.com with the subject line “Account Deletion Request”. We will process your request within 14 business days. Note that we may retain some transaction records for the minimum period required by applicable law.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate data.
• Deletion — request deletion of your personal data.
• Portability — request your data in a machine-readable format.
• Objection — object to processing of your data in certain circumstances.

To exercise any of these rights, contact us at support@smsvital.com. We will respond within 30 days.

Cookies

Smsvital uses only strictly necessary cookies. We use a session cookie to keep you logged in, and a short-lived cookie to protect against CSRF attacks. We do not use advertising cookies, analytics cookies, or any third-party tracking cookies.

Because we only use strictly necessary cookies, no cookie consent banner is displayed. Disabling cookies entirely will prevent you from staying logged in to your account.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Your continued use of Smsvital after the effective date of changes constitutes acceptance of the revised policy.