Privacy Policy

1. Who is responsible

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], is the controller of your personal data. Contact: support@covesms.com.

2. What we collect

Account: email, password (stored only as a hash), optional name, and how you found us.

Usage: numbers you buy, messages they receive, balance movements, tickets you send.

Payments: amount, method and status. Card details are handled by Stripe; we never receive the full card number. For crypto, the transaction reference.

Technical: IP address, device and browser data, and security logs used to prevent fraud.

Country: the country you choose at sign-up (optional), and a country estimated from your IP address. The estimate is calculated on our own servers from a public IP-to-country table — your IP is not sent to any lookup service.

3. IP addresses and fraud prevention

We record the IP address used when you sign up and when you use your account, to prevent fraud, abuse and repeat sign-ups after a ban (legitimate interest). If an account is banned for abuse, the IP addresses linked to it may be blocked from creating new accounts for a limited time. IP addresses can be shared or change, so blocks are reviewed and can be removed; contact us if you think you were blocked by mistake.

IP-to-country data: geo-whois-asn-country (CC0), based on statistics from the Number Resource Organization (nro.net), licensed under CC BY 4.0.

4. Why we use it

To provide the service (contract); to keep it secure and prevent fraud and abuse (legitimate interest); to keep tax and accounting records (legal obligation); and, only with your consent, to measure visits with analytics cookies.

5. Messages received on numbers

SMS sent to a number you bought are shown only to your account. We keep them so you can see your history, and delete them after [X] months or when you close your account.

6. Who we share it with

Service providers that run parts of the service for us: hosting and database (Supabase), card payments (Stripe), crypto payments (NOWPayments), email (Resend), website hosting (Vercel), sign-in with Google (Google, only if you choose it), and our number supplier HeroSMS (no personal data — only which app and country, to deliver the SMS). We share data with authorities when the law requires it. We don’t sell your data.

7. International transfers

Some providers process data outside your country. Where required, we rely on safeguards such as the EU Standard Contractual Clauses.

8. How long we keep it

Account data: while your account is open. Billing records: as long as tax law requires (usually 5–10 years). Security logs: up to 12 months. IP addresses linked to your account: up to 180 days after they were last seen; for accounts banned for fraud or abuse, while the ban is in force.

9. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, California law or Brazil’s LGPD), you can ask to access, correct, delete or export your data, object to some uses, and withdraw consent. Close your account from Account settings or email us. You can also complain to your data protection authority.

10. Cookies

Essential cookies keep you logged in and protect your account. Analytics cookies run only if you accept them; change your choice anytime with “Cookie settings” in the footer.

11. Children

The service is for adults (18+). We don’t knowingly collect data from children.

12. Changes

We’ll post updates here and tell you about material changes in advance.