Privacy policy

1. What this document covers

This policy describes the personal data VirtuNumber collects when you create an account and use the platform, what we do with it, who we share it with and how long we keep it.

It complements the terms of use. Where the two differ on a point of data processing, this document prevails.

2. Data you give us

You pass the following to us directly:

• At sign-up: your email address, your first name and a password. The password is never kept in the clear — only an irreversible fingerprint is stored.
• Your phone number: it is required when you create an account with an email address and a password, and stays editable at any time from your settings.
• If you sign in with Google: your email address, your name, your profile picture and your Google account ID, passed on by Google.
• If you write to us: the content of your message, your name and your reply address.

3. Data produced by your use of the service

Using the service generates more:

• Your number orders: service and country chosen, number assigned, start and end dates, amount debited.
• The SMS received on a number you ordered, recorded for the length of the order so they can be shown to you.
• Your credit ledger: top-ups, purchases, bonuses, refunds.
• Your payments: amount, currency, payment method and the provider’s reference. We neither see nor keep your bank or Mobile Money credentials.
• Technical data: IP address, timestamps and request IDs, kept for security and diagnosis.

4. Why we process this data

Each processing has a precise reason:

• Delivering the service: assigning you a number and passing on the codes received.
• Keeping your balance up to date and preserving the history of your transactions.
• Securing accounts: limiting the number of sign-in attempts, detecting abusive use.
• Writing to you: address verification, password reset, payment confirmations.
• Answering your support requests.

5. What we do not do

As important as the rest:

• We neither sell nor rent your personal data.
• We use no advertising cookie and no third-party audience tracker.
• We do not read the content of your SMS, unless you pass it to us yourself in a support request.
• We do not build an advertising profile from your activity.

6. Cookies

VirtuNumber sets only three cookies, all strictly necessary for the account to work. None is for advertising, none is set by a third party.

The session cookie and the sign-in cookie are out of reach of the page’s code; they therefore cannot be read by a script. All are sent only over an encrypted connection in production and are not sent from another site.

• Session cookie — keeps you signed in for 15 minutes.
• Sign-in cookie — saves you retyping your password for 7 days.
• Anti-forgery cookie — protects your actions against requests sent from another site. Duration: 7 days.

7. Providers that process data for us

Running the platform means entrusting some data to technical providers. Each one receives only what it needs:

• Database and application hosting: your account and order data are stored there.
• Email delivery: your address and the content of the transactional messages we send you.
• Cache and rate limiting: your IP address and your email address, as temporary counters.
• Image storage: your profile picture, if you upload one.
• Error logging: the technical context of an incident, including your account ID.
• Google sign-in: only if you choose that way of signing in.
• Payment: the mobile payment provider that collects your top-ups. It will be named here as soon as the service opens.
• Password checking: when you choose one, we may check with a specialised service that it does not appear in a known data breach. Only the first five characters of a fingerprint of the password are sent — never the password itself, nor your address.

8. How long we keep your data

The durations below are the ones the platform actually applies:

• Account data: for as long as your account exists.
• Verification and reset codes: 15 minutes, then deleted automatically.
• Technical payment logs: 90 days.
• Emails sent: 30 days after they are sent.
• After an account is deleted, only the payment rows remain, detached from your identity, because accounting requires it. Everything else is erased: profile, credit ledger, number orders, SMS received, notifications, messages sent to support, and the images you uploaded, including at our image host.
• Support messages: kept for as long as it takes to handle the request and to keep a record of it in case of dispute.

9. Your rights

You can access your data, correct it, ask for it to be erased, object to certain processing and obtain a copy of what you have given us.

Your name, your phone number and your picture are edited directly from your profile settings. Your password is changed from your security settings.

Deleting your account is requested from your profile settings. It is not immediate: your account enters a 30-day waiting period during which it works normally and during which you can cancel the request. Past that delay, the erasure is automatic and irreversible. An email confirms the request to you, so that you are warned if it did not come from you.

10. Security

Passwords are stored as an irreversible fingerprint. Exchanges with the platform are encrypted. Session cookies are out of reach of scripts, and every action that changes your account is protected against requests sent from another site. The number of sign-in attempts is limited per account.

No system is infallible. If we find a breach affecting your data, we will inform you.

11. Minors

VirtuNumber is not intended for people under 18 and we do not knowingly collect their data. If you find that an account was created by a minor, report it to us and we will delete it.

12. Changes

We may update this policy. The date it was last updated appears at the top of this page. A change that significantly affects your rights will be signalled to you by email.

13. Contact us

For any question, write to us at support@virtunumber.app.