Privacy Policy

1. Who we are

DualSMS is run by DualSMS, which decides how your data is used (the “data controller” or “data fiduciary”). Contact details are at the end of this page.

2. What we collect

• Account: your email address, an optional name and profile photo, and your password (stored only as a secure hash); if you sign in with Google, your Google account id, email and name. 2-step verification settings if you turn them on.
• Orders: what you buy (service, country, price), the numbers and email addresses you receive, and the codes and messages that arrive for them; for ready-made accounts, the order and the account details delivered to you.
• Payments and wallet: amounts, dates and your balance history, and the payment provider's reference (such as a UPI transaction reference or a crypto transaction id). We never see or store card or bank login details.
• Support: your tickets, messages and the files you attach.
• Developers: your API key (stored so we can recognise it), your webhook address and a log of the webhooks we sent.
• Technical and security data: IP address, browser and device type, sign-in times and active sessions, used to keep your account safe, stop abuse and enforce limits.
• Bot protection: Google reCAPTCHA checks sign-up and sign-in forms; Google receives technical data about your browser for this.

3. How we use it

• To provide the service: deliver numbers and codes, keep your wallet, process top-ups and refunds, and answer support — this is needed to fulfil our agreement with you.
• To keep DualSMS safe: detect fraud and abuse (for example, several accounts collecting the same gift codes), secure accounts, and keep records of important actions.
• To send service emails: sign-in and password emails, receipts, support replies and important changes. We don't send marketing emails unless you agree.
• To meet legal obligations, such as tax and accounting records or lawful requests from authorities.

4. Who we share it with

We share data only with the service providers that help us run DualSMS, only as much as they need, and never sell it:

• Number and email providers supply the numbers and pass the codes to us. They don't receive your name or email.
• Payment providers (crypto) process your top-ups under their own privacy policies.
• Cloudinary stores images and files you upload (profile photos, support attachments).
• Google for Google sign-in and reCAPTCHA.
• Hosting and email providers that run our servers and deliver our emails.
• Authorities, when the law requires it, and professional advisers where needed to protect our rights.

Some of these providers may process data outside your country; where that happens we rely on their safeguards and the protections the law requires.

5. How long we keep it

• Account data: while your account is open.
• Orders, payments and balance history: as long as tax and accounting law requires (several years), even after an account is closed.
• Codes and messages received: as part of your order history; you can ask us to delete them sooner.
• Sign-in sessions: until they end; security logs of admin actions: up to 2 years.
• Support tickets: while needed to help you and to handle disputes.

6. How we protect it

Your data travels over encrypted connections (HTTPS). Passwords are stored as hashes, secrets such as API credentials are encrypted, and staff access is limited and logged. You can protect your account further with 2-step verification and by signing out devices you no longer use. No system is perfectly secure — if something goes wrong that affects you, we will tell you as the law requires.

7. Cookies and local storage

We use only what the site needs to work: a secure sign-in cookie, and a few settings kept in your browser (such as your theme). We don't use advertising or tracking cookies; Google reCAPTCHA may set its own cookies on the sign-in pages.

8. Your rights

Depending on where you live (for example under India's Digital Personal Data Protection Act or the EU GDPR), you can:

• see and get a copy of your data — your orders and balance history can be downloaded as CSV from your dashboard;
• correct data that is wrong — most of it in your account settings;
• ask us to delete your account and data, except what we must keep by law;
• withdraw a consent you gave, object to some uses, and complain to us or to your data protection authority.

To use these rights, contact us (below). We answer within the time the law sets, and may ask you to confirm it's you.

9. Children

DualSMS is not for anyone under 18, and we don't knowingly collect data from children.

10. Changes to this policy

We may update this policy; the date at the top shows the latest version, and for important changes we'll tell you by email or in your dashboard.

11. Contact and complaints

For privacy questions, requests or complaints can be reached here: