Privacy Policy

01 Information We Collect

Depending on how you use NizoraSMS, we may collect and process the following categories of information:

• Account & Profile Information: Full name, verified mobile number, email address, company or business name, and profile settings.
• Authentication & API Credentials: Securely hashed passwords, API secret tokens, session tokens, and IP address audit trails.
• DLT Onboarding Materials: Business registration proof, PAN/GST documents, Entity/PE identifiers, sender headers, and content templates submitted for telecom registration.
• Billing & Transaction Metadata: Payment order references, plan purchase records, invoices, and transaction statuses. We do not store sensitive card or UPI credentials.
• Messaging Telemetry & Logs: API request timestamps, recipient mobile numbers, delivery status receipts (DLR), routing provider identifiers, and network error codes.

02 How We Use Information

We process the information collected strictly for legitimate operational, security, and contractual purposes:

• To operate and maintain our OTP delivery APIs, billing services, and customer console.
• To route transactional messages across vetted telecom and SMS gateway partners with maximum deliverability.
• To submit authorized customer details, headers, and templates to official telecom DLT portals as requested.
• To detect, investigate, and prevent fraud, OTP bombing, phishing, unauthorized API access, and security incidents.
• To maintain audit trails, verify payments, and comply with statutory accounting and tax regulations in India.

03 Recipient & OTP Messaging Data

Recipient mobile phone numbers are processed solely for the purpose of dispatching requested SMS messages and maintaining delivery logs.

Developers and enterprise clients are responsible for maintaining a valid lawful basis (such as user consent or contractual necessity) to transmit messages to recipient phone numbers, and for implementing application-side OTP verification and expiry logic.

04 DLT & Business Verification Documents

When you request custom sender headers or dedicated DLT onboarding, we collect required business identity documents (e.g., Certificate of Incorporation, GST certificate, PAN, Letter of Authorization).

These documents are stored in access-controlled environments and transmitted strictly to authorized telecom operators (such as Jio, Airtel, Vodafone Idea, BSNL) and DLT governance portals to fulfill regulatory registration under TRAI guidelines.

05 Payment & Financial Information

When you purchase prepaid plans or bulk packages, payments are handled directly by PCI-DSS compliant payment gateways (e.g., Cashfree, Razorpay, or authorized banking partners).

NizoraSMS never captures, handles, or stores sensitive credit/debit card numbers, CVVs, net-banking passwords, or UPI MPINs. We retain only order IDs, payment amounts, dates, and gateway reference tokens needed for accounting and fulfillment.

06 Third-Party Data Sharing

We do not sell, rent, or trade your account data or message logs to advertisers or data brokers. Data is shared strictly with:

• Telecom Operators & SMS Aggregators: To transmit SMS messages and receive real-time delivery status reports.
• DLT Portals: To register and verify your sender IDs and messaging templates.
• Payment Processors: To complete financial transactions and verify payments.
• Cloud Infrastructure Providers: Secure hosting, server facilities, and database storage with high-grade security standards.
• Law Enforcement & Regulators: Solely when strictly required by applicable Indian law, court order, or formal regulatory demand.

07 Technical & Operational Security

We enforce multi-layered security controls to protect your data from unauthorized access, loss, or alteration:

• Transport Encryption: All API communication and web traffic are encrypted using modern Transport Layer Security (TLS 1.2/1.3).
• API Key Protection: API keys are hashed and authenticated on every dispatch. Developers can rotate compromised keys instantly from the console.
• Rate Limiting & Anti-Abuse: Automated throttling prevents brute-force attempts and traffic anomalies.
• Access Control: Administrative access to production databases and documents is strictly restricted, monitored, and logged.

08 Data Retention Policies

We retain records only for as long as necessary to fulfill operational delivery, customer support, and legal obligations:

• API Message Logs: Delivery receipts and request telemetry are maintained for a limited operational window (typically 30–90 days) for developer debugging and routing analytics, after which they are archived or purged.
• Financial & Tax Records: Invoices, payment receipts, and billing ledgers are retained as required by Indian accounting and taxation laws.
• DLT Records: Approved entity identifiers and template mappings are preserved for the lifecycle of your active sender configuration.

09 Your Choices & Rights

You have full visibility and control over your account details:

• You can review and edit your business profile and notification preferences inside the NizoraSMS dashboard.
• You can regenerate API keys at any time to invalidate old credentials.
• You may request the closure of your account and deletion of non-statutory records by contacting our support team. Certain financial, audit, and DLT registration records must be maintained under statutory obligations.

10 Changes to This Privacy Policy

We may update this policy periodically to reflect platform enhancements, regulatory changes, or provider requirements. When changes are made, we will revise the “Last updated” date at the top of this document. We encourage you to review this page periodically.

11 Contact & Grievance Redressal

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please reach out to us: