SMSPOOL.NET PRIVACY AND COOKIE POLICY

Most recent updated version October 2026

INTRODUCTION

This Privacy and Cookie Policy explains what SMSPool B.V. (“SMSPool”, “we”, “us”) collects when you use smspool.net, the API at api.smspool.net, and proxyapp.net, and why. It covers temporary SMS verification numbers, long-term rentals, eSIMs, proxies, carrier lookup, deposits, the public API, business accounts, and support.

SMSPool is the controller for the personal data described here. We are established in the Netherlands:

• Legal name: SMSPool B.V.
• Address: Olympia 2 D, 1213NT Hilversum, the Netherlands
• Chamber of Commerce (KvK): 42005953
• RSIN: 869249599
• VAT (BTW): NL869249599B01
• Privacy requests: [email protected]

This Policy is written for the EU General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”). We do not sell personal information, and we do not share it for cross-context advertising.

ARTICLE 1. DATA WE COLLECT

An account needs a username and a password. The password is stored as a bcrypt hash. Email is optional. A guest account is a 16-digit number and has no email. We also store the account balance, an API key, the date you registered, and, if you arrived through one, the referral or affiliate code.

Account extras you choose

• Sign in with Apple: the Apple identifier, and the email and name Apple sends us.
• Telegram: your Telegram user id and chat id, and whether notifications are on.
• Two-factor authentication: a secret and recovery codes. These stay on the account and are left out of the downloadable export.
• A webhook address, an invoice name, a VAT country, favourites, price limits, and which number sources you have turned off.
• A push-notification token, if a device registers for notifications.

Orders and messages

When you buy an SMS verification we store the country, the service, the phone number, the verification code, and the text of the SMS. Rentals store the number and the messages received on it. The Ticketmaster tool also stores the email address and message it pulls out of an SMS. That history stays on the account until the account is deleted.

An eSIM purchase stores the plan, country, data amount, duration, price, and our order reference. The eSIM provider receives the plan and that reference. It does not receive your name or email.

A proxy purchase stores the proxy username, whether it is active, when it expires, and the package you bought. A carrier lookup sends the phone number you type to the lookup provider. We keep the price and the time, not a copy of the number.

Applications and support

• Service whitelist: first name, last name, email, the service, and what you intend to use it for.
• Business account: organisation name, description, website, and contact email, plus sub-account usernames and daily spend limits.
• Whitelabel enquiry: the message you send and the price you discuss.
• Support tickets: the subject, the messages, and files you attach. Attachments are stored so the ticket can be read. Staff may use tools on our own systems that read a ticket in order to draft a reply.
• Affiliate code and commission history, and promo codes you create or redeem.

Technical data

The site reads your IP address to apply rate limits, to block jurisdictions we cannot serve, and to suggest a VAT country from a country database kept on our own servers. The address is not sent to the database vendor, and it is not written in the clear onto your account. Where we need a record, such as a blocked visit or an abuse counter, we store a one-way hash that cannot be turned back into the address.

Email login codes remember a browser with a random device token, not with your IP address. The login history stores the time and whether that browser was confirmed.

ARTICLE 2. PAYMENTS

Deposits record the amount, the method, the time, fees, and the VAT country and rate. Card, Apple Pay, Google Pay, iDEAL, and UnionPay payments are entered in Stripe. We send Stripe your user id, username, and email if the account has one. We do not store the card number. If you turn on automatic top-up we store a card label, such as the last digits, the amount, and the threshold.

Cryptocurrency deposits are handled by the processor shown at checkout. Depending on the coin and network that is Confirmo, CoinGate, CoinPayments, Heleket, Cryptomus, or 0xProcessing. They receive a payment reference tied to your account. CoinPayments also receives your username in the payment description. A deposit address assigned to you is stored on the account. Purchases made through Apple are processed by Apple, and we keep the transaction reference.

Confirmo asks for sender details under the EU Travel Rule the first time you use it. For a person that is your name, date and place of birth, street, city, country, and postal code. For a company it is the registered name, registration number, and the same address fields. That form is sent to Confirmo with your user id and, if you have one, your email. We do not keep a copy of those details. We only record that you submitted them, whether the profile is a person or a company, and when.

The optional rewards page loads AdGate and places your account id in the page address so a completed offer can be credited. Opening that page is optional.

ARTICLE 3. WHY WE USE IT

We use the data above to run the account and deliver the product you buy: numbers, messages, rentals, eSIMs, proxies, lookups, deposits, and support replies. Email is used for login codes, password resets, and ticket replies. We do not sell address lists and we do not send third-party marketing.

The legal grounds are:

• Contract. Creating the account and providing the service you order, including the API, business sub-accounts, and support you open.
• Legal obligation. Bookkeeping and tax records, sanctions restrictions, and passing Travel Rule details to Confirmo when a crypto payment requires them.
• Legitimate interests. Keeping the service secure, stopping fraud and abuse, applying rate limits, and crediting a referral you followed. You can object to processing on this ground; see Article 6.
• Your choice. Adding an email, connecting Apple or Telegram, opening the rewards page, and setting a webhook. A guest account can be created with no email. You can disconnect Apple or Telegram, and you can skip the rewards page.

Number suppliers receive the country and service needed to issue a number, and they return the number and the SMS. They do not receive your username or email. We may disclose account and order records when the law requires it, including to a competent authority or to a payment partner investigating fraud, sanctions, or money laundering. That practice is also described on our compliance page.

ARTICLE 4. COOKIES

A cookie is a small file the browser stores. The cookies we set ourselves are there so the account works. There is no separate analytics cookie. You can block cookies in the browser; the site will then be unable to keep you signed in.

• Session cookie. Keeps you signed in for up to 30 days. It is HttpOnly, sent only over HTTPS, and limited to this site.
• sp_device. A random token, kept for about 90 days, so an email login code can remember this browser. It is HttpOnly. We store a hash of the token, not your IP address.
• request. For about two minutes, remembers the page you were opening so login can send you back.
• ref and refferer. The affiliate code or campaign you arrived with, so the referral can be credited.
• last_used_service and last_used_country. For 30 days, restores the last service and country you picked.
• apple_oauth_state. A short-lived check during Sign in with Apple.
• rl. For about five minutes, a rate-limit flag.

Cloudflare, Cloudflare Turnstile, hCaptcha, and Stripe may set their own cookies when the bot check, captcha, or card form loads. Their policies describe those cookies: Cloudflare, hCaptcha, and Stripe. Language choice may be stored in the browser rather than in a cookie.

ARTICLE 5. WHO ELSE RECEIVES DATA

We use the following providers to run the service. Each one receives only what that step needs.

• Cloudflare — content delivery, DDoS protection, the bot check in front of the site, and Turnstile. Ticket and blog files are uploaded through cdn.smspool.net, which sits behind Cloudflare. Cloudflare sees connection data such as IP address and the requested page. Privacy policy.
• Stripe — card and wallet payments. User id, username, and email if you have one. Card numbers are entered on Stripe’s form. Privacy policy.
• Confirmo — crypto invoices, including the Travel Rule details described in Article 2. Legal information.
• CoinGate, CoinPayments, Heleket, Cryptomus, and 0xProcessing — other crypto checkouts and deposit addresses. They receive a payment reference tied to your account. Older deposits may name a processor we no longer offer.
• Apple — Sign in with Apple, and payments you make through Apple.
• hCaptcha — bot checks on registration, login, some deposits, and new tickets. Privacy policy.
• Zoho (EU mail servers) — account and support email, such as login codes and ticket replies.
• Atlassian Jira Service Management — a copy of support tickets so staff can reply. Privacy policy.
• AdGate Media (Prodege) — only if you open the rewards page. Your account id is included so an offer can be credited. Privacy policy.
• eSIM Access — the eSIM plan and an order reference. Not your name or email.
• Number suppliers — the country and service for the number you order, and the SMS they return. Not your username or email.
• Telnyx and Twilio — the phone number you submit for a carrier lookup.

Some of these providers are in the United States or another country outside the European Economic Area. Where the GDPR requires a transfer tool, we rely on the safeguards the provider offers, such as standard contractual clauses.

ARTICLE 6. HOW LONG WE KEEP IT, AND YOUR RIGHTS

Order history, messages, rentals, eSIMs, proxies, tickets, and account details stay for as long as the account exists. You can download a JSON copy from Settings under “Export my data (GDPR)”. The file includes the profile, orders, payments, and support records. It leaves out passwords, the API key, session identifiers, and two-factor secrets.

You can delete the account from the same page. Confirm with your password, or with the 16-digit number on a guest account. The account is deactivated immediately. If it has no SMS orders and no rentals, deletion finishes in 1 day. Otherwise it finishes in 14 days. During that window you can cancel from the link shown when you try to log in, or by writing to [email protected]. A card deposit newer than 14 days blocks the request until that period has passed.

When deletion runs, data tied to the account is removed. Deposit records are kept with the account link cleared, because bookkeeping law requires us to retain payment records. Travel Rule details are not in our database; Confirmo holds the copy it received.

You can correct your email and password in Settings. For anything else, email support. You can also:

• ask whether we process data about you, and receive the copy described above;
• object to processing based on legitimate interests, and ask us to restrict processing in the cases the GDPR allows;
• withdraw a choice you made, for example by disconnecting Apple or Telegram or by not using the rewards page;
• lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority where you live.

If you are in California, you can use the same Settings tools or the support address to request access, correction, or deletion. We do not sell personal information and we do not share it for cross-context behavioral advertising. We will not treat you differently for making a request.

ARTICLE 7. SECURITY

Passwords are stored as bcrypt hashes. Session cookies are HttpOnly. Card numbers are collected by Stripe, not by us. IP addresses are stored as a one-way hash when a record is needed. You are responsible for keeping your password, API key, and guest account number to yourself.

No transmission over the internet is perfectly secure. If a breach is likely to result in a risk to people, we notify the Dutch Data Protection Authority within 72 hours where the GDPR requires that notice, and we notify affected users without undue delay when the breach is likely to result in a high risk. We may also post on the news page.

Providers listed in Article 5 have their own privacy policies. A link to Telegram, Discord, or another site leaves our service, and that site’s policy applies from there.

ARTICLE 8. CHILDREN

The service is for people who are old enough to enter a contract where they live. We do not knowingly collect personal data from children under 16. If we learn that an account belongs to a child under 16, we will delete it.

ARTICLE 9. CHANGES

We publish changes on this page and change the date at the top. Where a change requires fresh consent, we will ask for it. Check this page for the current version.