Privacy Policy

Overview

XTText ("we", "our", "us") operates a virtual number platform that allows users to receive OTP verification codes and to rent virtual numbers for sending and receiving SMS and voice messages. This Privacy Policy explains what personal data we collect, how we use it, and what rights you have over it.

This policy applies to all users of our website and platform. By using XTText, you agree to the practices described here. If you disagree with any part of this policy, please do not use the service.

Data We Collect

Information you provide directly

• Email address — used for account creation, wallet receipts, and service communications.
• Payment details — processed and stored by our third-party payment provider. XTText never stores your raw card number.
• Contact form submissions — name, email, and message content when you reach out to support.

Information collected automatically

• Number assignment and usage logs — which numbers were assigned to your account, when, and for which platform.
• Message delivery timestamps — when SMS or voice notes were sent or delivered. We do not log the content of OTP messages after they are displayed to you.
• IP address — logged at the time of account actions for fraud prevention, retained for 30 days.
• Browser and device type — collected in anonymised aggregate form for performance analytics only.

Information we do NOT collect

• We do not collect the content of SMS or voice messages sent through rented numbers after delivery confirmation.
• We do not collect government ID, physical address, or phone number of the account holder.
• We do not track your activity on other websites.

How We Use Your Data

We use the data we collect for the following specific purposes:

• Service delivery — to assign numbers, display incoming messages, process wallet funding, and maintain your account balance.
• Fraud prevention — to detect and prevent abuse of the platform, including account sharing, chargebacks, and mass registration fraud.
• Customer support — to respond to questions and resolve issues you raise through email or live chat.
• Service communications — to notify you of wallet top-ups, successful transactions, policy updates, and critical service alerts.
• Platform improvement — to understand usage patterns in aggregate (not individually) and improve reliability.

Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited cases:

• Payment processors — our payment partners receive payment details to process wallet funding. Their privacy policies apply to data they hold.
• Infrastructure providers — our cloud hosting provider stores data on servers. They do not have access to your data in a readable form.
• Legal requirements — we may disclose data if required by a valid court order, government request, or to prevent imminent harm. We will notify you where legally permitted to do so.
• Business transfers — in the event of a merger or acquisition, user data may be transferred to the new entity, who will be bound by this policy.

Cookies

We use a minimal set of cookies necessary to operate the platform:

• Session cookies — to keep you logged into your account. These expire when you close your browser.
• Preference cookies — to remember your dashboard settings (e.g. preferred country filter). These last 90 days.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You can clear cookies in your browser settings at any time — this will log you out of your account.

Data Retention

• Account data (email, balance, transaction history) is retained for as long as your account is active.
• Message delivery logs are retained for 90 days, then permanently deleted.
• IP address logs are retained for 30 days for fraud detection, then deleted.
• Payment records are retained for 7 years to comply with financial regulations.
• Deleted accounts — when you delete your account, all associated data is purged within 14 days, except payment records required by law.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of all personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request that we delete your account and associated data.
• Portability — request your data in a machine-readable format (JSON).
• Objection — object to any specific processing of your data.

To exercise any of these rights, email us at privacy@xttext.com. We will respond within 7 business days. We may ask you to verify your identity before fulfilling a request.

Security

We implement industry-standard security controls to protect your data:

• All data in transit is encrypted via TLS 1.3.
• Data at rest is encrypted using AES-256.
• Access to production systems is restricted to authorised personnel with multi-factor authentication enabled.
• We conduct regular security audits and penetration testing.

Policy Updates

We may update this Privacy Policy as the platform evolves or regulations change. Material changes will be communicated by email to registered users at least 14 days before taking effect.

The "Last updated" date at the top of this page reflects when the current version was published. Continuing to use the platform after the effective date constitutes acceptance of the updated policy.

Contact Us

For any privacy-related questions, data requests, or concerns, contact our privacy team:

• Email: privacy@xttext.com
• Response time: Within 7 business days
• Language: English

For general support questions unrelated to privacy, use the Contact page.