Who is responsible
The operator of OTPPin runs this website, the dashboard and the API, and decides how the personal information described here is used. In data protection terms, the operator of OTPPin is the controller.
To contact the controller about your personal information, including to make a request under this policy, write to [email protected] or use the contact form at /contact.
This policy covers visitors, account holders and people who contact us.
What we hold
Account details: your email address, a hash of your password (never the password itself), your role, whether your email is verified, and account dates. If you choose to add them, also a Telegram handle, two-factor sign-in data, API keys and webhook settings.
Orders: the service and country you chose, the number assigned, the messages or codes received on it, the price, the order state and the times involved.
Money: top-up invoices, the amount, coin and status reported by the payment processor, charges, refunds, balance and any referral activity. We do not hold wallet keys or card numbers.
Security and technical data: IP address, browser and device details, sign-in sessions, API request logs and audit events.
Contact: the name, email, topic and message you send through the contact form, together with the IP address the request came from. Operator applications include the details entered on that form.
What we do not ask for
We do not ask for your own phone number or for identity documents in order to buy a number. We may ask for more information only where the law requires it or where it is needed to return funds safely.
Why we use it
To provide the service: signing you in, assigning numbers, showing you the messages received and keeping your order history.
To handle money: crediting top-ups, charging orders, paying refunds to your balance and keeping the records that accounting and tax rules require.
To keep the service safe: spotting fraud and abuse, applying rate limits and looking into account or payment problems.
To answer you when you contact us, and to send service messages such as verification emails and notices about policy changes.
To understand how the site is used and, with your consent, to measure advertising. This is described in the cookie policy.
Legal grounds
Where data protection law asks for a legal ground, we rely on the contract with you for running your account and orders, on our legitimate interests for security, fraud prevention and improving the service, on legal obligations for financial records, and on your consent for optional analytics, advertising storage and marketing email. Consent can be withdrawn at any time.
Other countries
Some of these providers process information in countries other than the one you live in. Where the law requires safeguards for such a transfer, we rely on recognised ones such as standard contractual clauses.
How long it is kept
Account, order and transaction records are kept while your account is open. After that they are kept only for as long as financial record-keeping rules, fraud prevention and the handling of disputes require.
Sign-in, verification and recovery tokens expire by themselves. Cookie lifetimes are listed in the cookie policy.
Closing an account from settings disables it, ends every session and replaces the email address and password stored on it. Order and transaction records linked to the closed account are retained for the reasons above. To ask for further erasure, contact support.
Your rights
Depending on where you live, you may have the right to see the information held about you, have it corrected or deleted, receive a copy in a portable form, object to or restrict certain uses, and withdraw consent.
Send a request to support from the email address on your account. We may need to confirm that the request really comes from the account holder. We answer within 30 days.
You can also complain to the data protection authority in your country.
Security
Passwords are stored only as hashes, traffic to the site is encrypted in transit, sign-in uses short-lived and rotating tokens, and administrative actions are logged. No system is perfectly secure, so use a unique password and turn on two-factor sign-in.
Children
The service is not for anyone under 16 and we do not knowingly collect information from children. If you believe a child has opened an account, tell us and we will close it.
Changes to this policy
We update this page when our practices change. For a change that materially affects how your information is used, registered users are emailed at least 14 days before it takes effect.
Contact
For questions about this policy or a specific account or order, contact [email protected] or use the contact form. Include the relevant order or invoice ID. Do not send passwords, API keys or one-time sign-in codes.