Privacy Policy

1. Introduction

EVERWOOD ("SmsCodeHub", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, SaaS platform, API, and related services (collectively, the "Service"), available at smscodehub.com and smsverificator.com. We comply with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Lei Geral de Proteção de Dados (LGPD), and other applicable laws.

Data controller: EVERWOOD, Henryka Sienkiewicza 43/17, 08-110 Siedlce, Masovian Voivodeship, Poland. NIP: 8212456275. REGON: 140955667.

2. Information We Collect

2.1 Personal Data — When you register, use our Service, or contact us, we may collect: name, email address, billing information, company name, VAT number, IP address, device identifiers, and any data you submit via forms or API.

2.2 Usage Data — We automatically collect information about your interactions with the Service: pages visited, features used, API request metadata, order history, and virtual number usage patterns (retention period, verification status, service type).

2.3 Cookies & Tracking — We use essential, functional, and analytics cookies (see our Cookie Policy). You may control cookie preferences via your browser settings.

2.4 SMS Message Content — Virtual numbers are used to receive verification codes (OTP) sent by third-party services. Message content is stored temporarily for delivery to your account and is automatically deleted within 20 minutes after delivery or expiry, whichever occurs first. We do not permanently store SMS content, we do not use it for marketing, and we do not share it with third parties except as required by law.

3. How We Use Your Information

We use collected data to: provide, maintain, and improve the Service; process payments and issue invoices; deliver SMS verification codes to your account; respond to inquiries and support requests; enforce our Terms of Service; prevent fraud, abuse, and unauthorized use; comply with legal obligations; and develop new features (anonymized or aggregated data only).

4. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA), we process personal data based on:

• Consent — e.g., marketing communications, non-essential cookies.
• Performance of a contract — providing our Service, processing orders, delivering SMS codes.
• Legitimate interests — improving security, preventing fraud, analyzing service performance.
• Compliance with legal obligations — tax, accounting, and AML regulations.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share information with:

• Service providers — payment processors (Stripe), cloud hosting, SMS gateway providers (GrizzlySMS, 5sim, SMS-Man, and similar) under strict confidentiality and data processing agreements.
• Legal authorities — if required by law, court order, or to protect our rights and safety.
• Business transfers — in the event of a merger, acquisition, or asset sale, with notice to affected users.

Our processors are located in Poland, EU/EEA, USA, and other jurisdictions — each adheres to applicable data protection laws.

6. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We implement Standard Contractual Clauses (SCCs) or equivalent safeguards for transfers from the EEA to third countries, in accordance with the GDPR. By using our Service, you acknowledge such transfers.

7. Data Retention

We retain personal data as long as your account is active or as needed to provide the Service:

• SMS message content: deleted within 20 minutes after delivery or expiry.
• Order and transaction records: retained per tax and accounting regulations (typically 5 years).
• Account data: until account deletion request, plus legal retention period.
• Usage logs and analytics: anonymized after 12 months.

You may request deletion of your data at any time (subject to legal retention obligations).

8. Your Rights

Depending on your jurisdiction (GDPR, CCPA, LGPD), you may have the right to:

• Access, rectify, or erase your personal data.
• Restrict or object to processing.
• Data portability (receive your data in a structured format).
• Withdraw consent at any time.
• Lodge a complaint with a supervisory authority (in Poland: UODO — Urząd Ochrony Danych Osobowych).
• Under CCPA: opt out of the "sale" of personal information (we do not sell data).

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Security Measures

We implement technical and organizational safeguards to protect your data:

• Encryption in transit (TLS 1.2+) and at rest.
• Encrypted backups and access controls.
• Regular security audits and vulnerability scanning.
• Payment processing via PCI DSS Level 1 certified providers (Stripe).
• Session security with HttpOnly, Secure, and SameSite cookies.

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on our website at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

12. Contact Us

For privacy-related inquiries, please write to: