Privacy Policy

1. Who is responsible

CoveSMS (covesms.com) is the controller of your personal data. Contact: support@covesms.com.

2. What we collect

Account: email, password (stored only as a hash), optional name, and how you found us.

Usage: numbers you buy, messages they receive, balance movements, tickets you send.

Payments: amount, method and status. Card details are handled by Stripe; we never receive the full card number. For crypto, the transaction reference.

Technical: IP address, device and browser data, and security logs used to prevent fraud.

Country: the country you choose at sign-up (optional), and a country estimated from your IP address. The estimate is calculated on our own servers from a public IP-to-country table — your IP is not sent to any lookup service.

3. WhatsApp usage request (Server 3, Brazil)

If you buy WhatsApp numbers on Server 3, we collect what you’ll use them for, your full name and your CPF, together with the date, IP address and browser of your request. We use them to prevent scams and fraud and to answer lawful requests from the authorities, who will receive this information if they ask (legal obligation and legitimate interest). We keep it while your account is open and for up to 5 years after it closes.

4. IP addresses and fraud prevention

We record the IP address used when you sign up and when you use your account, to prevent fraud, abuse and repeat sign-ups after a ban (legitimate interest). If an account is banned for abuse, the IP addresses linked to it may be blocked from creating new accounts for a limited time. IP addresses can be shared or change, so blocks are reviewed and can be removed; contact us if you think you were blocked by mistake.

IP-to-country data: geo-whois-asn-country (CC0), based on statistics from the Number Resource Organization (nro.net), licensed under CC BY 4.0.

5. Why we use it

To provide the service (contract); to keep it secure and prevent fraud and abuse (legitimate interest); to keep tax and accounting records (legal obligation); and, only with your consent, to measure visits with analytics cookies.

6. Messages received on numbers

SMS sent to a number you bought are shown only to your account. We keep them so you can see your history, and delete them after 12 months or when you close your account.

7. Who we share it with

Service providers that run parts of the service for us under contract: hosting and database, card and crypto payment processors, email delivery, review invitations after a top-up (Trustpilot, only your email address and name), sign-in with Google (only if you choose it), and the mobile carriers that deliver the SMS (no personal data — only which app and country). We share data with authorities when the law requires it. We don’t sell your data.

8. International transfers

Some providers process data outside your country. Where required, we rely on safeguards such as the EU Standard Contractual Clauses.

9. How long we keep it

Account data: while your account is open. Billing records: as long as tax law requires (usually 5–10 years). Security logs: up to 12 months. IP addresses linked to your account: up to 180 days after they were last seen; for accounts banned for fraud or abuse, while the ban is in force.

10. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, California law or Brazil’s LGPD), you can ask to access, correct, delete or export your data, object to some uses, and withdraw consent. Close your account from Account settings or email us. You can also complain to your data protection authority.

11. Cookies

Essential cookies keep you logged in and protect your account. Analytics cookies run only if you accept them: we use Google Analytics to count visits and sign-ups. Until you accept, it sets no cookies and only receives anonymous, cookie-free signals. We also count visits with a privacy-friendly analytics tool that uses no cookies and no personal data. Change your choice anytime with “Cookie settings” in the footer.

12. Children

The service is for adults (18+). We don’t knowingly collect data from children.

13. Changes

We’ll post updates here and tell you about material changes in advance.