Privacy policy

1. Controller

The controller of your account data is ITWorks Katarzyna Bańcer, ul. Sikorskiego 9a, 02-864 Warsaw, Poland, tax ID (NIP) 1231178164. Data protection contact: support@smsportal.app.

For the data in your messages (recipient numbers, contacts, SMS content) you are the controller, and we process it on your behalf under section 8 of the terms of service.

2. What data and why

• Account: name, email address, password (stored as a hash that cannot be read back). To create and run your account. Legal basis: contract (Article 6(1)(b) GDPR).
• Payments: plan, subscription status, invoices and your Stripe customer ID. We never see card details; Stripe collects them. Legal basis: contract and tax obligations (Article 6(1)(b) and (c)).
• Phones: brand, model, Android and app version, the name you give it, sending settings, message counters and last connection time. To deliver messages and show you the phone’s status. Legal basis: contract.
• Messages: sent and received SMS, numbers, contacts and delivery statuses. We process them on your behalf (section 1).
• Security: the IP address and country the account was used from (dashboard, API, phone) and the type of API client. To detect taken-over accounts and copied keys. Legal basis: legitimate interest (Article 6(1)(f)).
• Correspondence: messages to support and the reason given for an account deletion request. Legal basis: contract and legitimate interest.

We send the emails your account needs: address confirmation, password reset, and notices about limits, payments and phone status. You can reduce notifications in account settings.

3. Who receives data

• Contabo GmbH (Germany): the server the service runs on, in a data centre in France.
• Stripe Payments Europe Ltd. (Ireland): payments and invoices. Stripe may transfer data to the US under standard contractual clauses and the EU-US Data Privacy Framework.
• Services you connect yourself (for example Convs, BooksyAudit, n8n, your own webhooks): only the data you tell them to receive.
• Public authorities: only where the law requires it.

We send email from our own mail server. We do not sell data or share it for advertising. SMS content does not go to third-party SMS providers: your phone sends it through your carrier.

4. How long we keep data

• Account, phone and message data: until the account is deleted.
• IP addresses from section 2: 180 days after an address was last used.
• Invoices and billing data: 5 years from the end of the year the invoice was issued (tax law).
• Database backups: from the last 10 updates of the service. Deleted data disappears from them as older backups are replaced by newer ones.

5. How we protect data

Connections are encrypted (HTTPS). Passwords are stored as hashes, and you can revoke API keys at any time. The database is not reachable from the internet. Only the people who maintain the server can access it.

6. Cookies

We use only the cookies the site needs to work: the sign-in session and your chosen language (smsportal_locale). We use no analytics or advertising cookies, so we do not ask for consent to them.

7. The Android app

The app needs permission to send and receive SMS, show notifications and run in the background. It connects only to the smsportal.app server. It uses no third-party analytics or crash reporting. It downloads updates from smsportal.app and checks their checksum before installing.

8. Your rights

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on legitimate interest. Write to support@smsportal.app; we reply within one month.

You can complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or to the authority in your country.

Giving data is voluntary, but you cannot create an account without an email address. We make no solely automated decisions with legal effects on you.

9. Changes

We announce material changes by email. This policy applies from 28 October 2026.