Privacy Policy

SMS Activate (the “App”) and the website smsactivate.cloud (the “Site”) are operated by Montigate LLC (“we”, “us”, “our”), a company registered in England and Wales. We act as the data controller for the personal data described in this policy. You can reach us at dima@holylabs.net.

The App provides temporary virtual phone numbers that can receive SMS verification codes, so you can sign up for online services without sharing your personal phone number.

The Site offers the same service in the browser through a web account at smsactivate.cloud/app: one-time numbers for SMS codes, a balance you top up by card or cryptocurrency, and monthly rented numbers that can send and receive SMS and make and take calls.

• Account data. An anonymous account identifier created when you first open the App, and your email address if you choose to provide it. On the Site you create an account with an email address and password, or with Google Sign-In (see section 3a). Accounts are managed by Firebase Authentication; we never see or store your password in readable form.
• Purchase and balance data. Records of credit packs you buy in the App — payment is processed by Apple App Store or Google Play. On the Site, top-ups are paid by card through Stripe or by cryptocurrency through OxaPay; we receive the amount, currency, status and the provider’s payment reference, never your full card number or wallet keys. We keep a ledger of every balance change (top-ups, purchases, refunds).
• Rented number data. If you rent a number on the Site: the number, its renewal dates, the text, sender and recipient of SMS messages sent and received on it, and call records (other party’s number, direction, time, duration and cost). Call audio is not recorded.
• Activation data. The service, country, virtual number and the text of verification SMS messages received on that number, kept for the time needed to deliver the code to you and to resolve disputes.
• Device and usage data. Device model, operating system version, app version, language and crash or diagnostic logs.
• Support data. When you contact support we collect the content of your message and any contact details you give us. Live chat on the Site runs on Chatwoot, which we host ourselves at chat.holylabs.net; it stores the conversation and an identifier in your browser so the thread survives a page reload. Email support is handled through our email tooling. Both are used only to answer you.

If you choose “Continue with Google” on the Site, Google shares the following with us, with your permission: your name, email address, profile picture and Google account identifier (the “openid”, “email” and “profile” scopes). We request no other Google data and have no access to your Gmail, contacts, Drive or any other Google service.

• How we use it. Only to create your account, sign you in, and show which account you are signed in with. Your email is also used for receipts and support replies.
• Where it is stored. In Firebase Authentication (Google Cloud), linked to your account identifier.
• Sharing. We do not sell Google user data, do not use it for advertising, and do not share it with anyone except the processors needed to run your account (Google Firebase), or where required by law.
• Retention and deletion. Kept while your account exists and deleted when you delete your account (section 9). You can also remove the Site’s access at any time at myaccount.google.com/permissions.

SMS Activate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide virtual numbers and deliver verification codes to you (performance of a contract).
• To maintain your credit balance and restore purchases across devices (performance of a contract).
• To process top-ups, renew rented numbers and route their SMS and calls to you (performance of a contract).
• To answer support requests (legitimate interests / performance of a contract).
• To detect and prevent fraud, abuse and violations of our Terms of Service (legitimate interests).
• To fix bugs and improve the App using aggregated diagnostics (legitimate interests).

We do not sell your personal data. With your consent, we use analytics and advertising cookies on the Site — see section 5a.

Strictly necessary cookies keep the Site working and are always set. Beyond those, the Site can load two third-party tools, and neither runs until you accept them in the cookie banner:

• Google Tag Manager. Loads our measurement tags. Google receives your IP address, the pages you view and general device information.
• Meta Pixel. Measures the performance of our advertising and lets us reach similar audiences. Meta receives your IP address, the pages you view and, where you have a Meta account, may link that activity to it.

Declining means neither tool loads at all. You can change your mind by clearing this site’s data in your browser, which brings the banner back. Our legal basis for both is your consent, and you can withdraw it at any time without affecting the Site’s core functionality.

We share data only with service providers who process it on our behalf: cloud hosting and database providers (Vercel, Google Firebase), telephony providers that supply the virtual and rented numbers and carry their SMS and calls (5SIM, Twilio, DIDWW), Apple and Google for in-app purchases, Stripe and OxaPay for top-ups on the Site, email delivery tooling for support correspondence, and — only where you have consented — Google and Meta for the analytics and advertising tools described in section 5a. Each processor is bound by a data processing agreement. We may also disclose data where required by law.

Some providers are located outside the United Kingdom. Where data leaves the UK or the European Economic Area, we rely on adequacy decisions or standard contractual clauses to protect it.

Activation data, including received SMS text, is kept only as long as needed to operate the service and handle disputes, then deleted or anonymised. Account and purchase records are kept while your account is active and for the period required by tax and accounting law. Support correspondence is kept for up to 24 months after the request is closed.

Under the UK GDPR and the EU GDPR you have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, email dima@holylabs.net. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

You can delete your account directly in the App (Settings → Delete account), or delete your App or Site account by emailing dima@holylabs.net from the address on the account. Deletion removes your account identifier, sign-in details (including any Google Sign-In link), activation history, rented-number messages and call records and any stored email address within 30 days, except for payment records we must keep by law.

The App is not directed at children and is intended for users aged 18 or over. We do not knowingly collect data from children; if you believe a child has used the App, contact us and we will delete the data.

Data is encrypted in transit, access is restricted to personnel who need it, and our databases enforce row-level access controls. No system is perfectly secure, so we also keep the amount of data we hold to a minimum.

We may update this policy from time to time. Material changes will be announced in the App or on the Site, and the “Last updated” date above always reflects the current version.