Privacy Policy

What we collect

We collect three kinds of data:

• Account data — your name, email address and phone number, provided when you register or sign in with Google.
• Contact data — the names, phone numbers and any additional fields you upload in order to send messages.
• Usage data — campaigns sent, message content, delivery outcomes, credit balances and payment records.

How we use it

Account data identifies you and secures your account. Contact data exists solely to deliver the messages you ask us to send. Usage data lets us show delivery reports, calculate billing, and investigate problems. We do not sell personal data, and we do not use your contact lists for our own marketing.

Your contact lists belong to you

Contacts you upload are visible only to your account. They are protected by row-level security in our database, which means other users cannot query them even in principle. We do not share, rent or sell your contact lists to anyone.

You remain the data controller for the people on your lists. You are responsible for having a lawful basis to message them and for honouring opt-out requests.

Who we share data with

We share only what is necessary for the service to function, with:

• Our SMS provider — recipient numbers and message content, so messages can be delivered to the networks.
• Mobile network operators — who carry the message to the recipient's handset.
• Our payment processor — transaction details for credit purchases. We never see or store your full card number.
• Our hosting and database providers — who store the data on our behalf under contract.

How long we keep it

Contact data is kept until you delete it or close your account. Campaign history and delivery reports are retained so you can review past sends and produce receipts. Payment records are kept as long as required for accounting purposes.

Security

Data is transmitted over encrypted connections and stored in a managed database with row-level access controls. Access to production data is limited to what is needed to operate and support the service. No system is perfectly secure, but we take the protection of contact lists seriously — they are often the most sensitive thing an organisation holds.

Your rights

You can access, correct, export or delete your data at any time from the dashboard, or by contacting us. Deleting your account removes your contacts and campaign data, subject to any records we are required to retain for legal or accounting reasons.

Cookies

We use cookies that are necessary for the service to work — chiefly to keep you signed in. We do not use advertising cookies or sell browsing data.

Contact

Questions about privacy, or requests relating to your data, can be sent to support@whispersms.org or through the contact page.