Privacy Policy

01 Scope & Acceptance

This Privacy Policy applies to www.smsgatewayhub.com (the “Site”) and to the Bulk SMS, WhatsApp Business API, RCS, OTP, Voice SMS, Email, Missed Call, IVR and related Services offered by SMSGATEWAYHUB TECHNOLOGIES PVT LTD (“smsgatewayhub”, “we”, “us”). It is incorporated into, and read together with, our Terms & Conditions. By visiting the Site or using the Services, you accept the practices described here.

This Policy is drafted primarily for compliance with the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Act”), which apply to processing of digital personal data of individuals in India. Where relevant to specific Services (e.g. our International SMS offering), we also address obligations under other applicable data protection law.

02 Definitions

Personal Data

Any data about an individual who is identifiable by or in relation to such data — for example, name, email address, mobile number, or billing details.

Data Principal

The individual to whom the Personal Data relates (e.g. a User of the Site, or a Recipient of messages sent through a Client's account).

Data Fiduciary

The entity that, alone or with others, determines the purpose and means of processing Personal Data. smsgatewayhub is the Data Fiduciary for Personal Data of Site visitors and Users of their own accounts.

Data Processor

An entity that processes Personal Data on behalf of a Data Fiduciary. smsgatewayhub acts as a Data Processor in respect of Client Data, which is processed strictly on the instructions of the relevant Client.

Client / User

A business or individual that registers for and uses the Services — see our Terms & Conditions for the full definition.

Client Data

Recipient phone numbers, message content, templates, call data, and other information a Client uploads to, or transmits through, the Services for delivery to their own end-recipients.

Recipient

An individual who receives an SMS, WhatsApp message, RCS message, voice call, or email sent by a Client using the Services.

03 Information We Collect

Information You Provide

When you register for an account, request a demo, or contact support, we collect your name, company name, business email, mobile number, billing/payment details, and — where relevant to DLT/TRAI registration — your business PAN/GST and entity/header/template details filed with the DLT platform.

Client Data

If you are a Client using the Services to send messages or calls, the Services process the Recipient phone numbers, message content, and related delivery data you upload or transmit — as a Data Processor, on your instructions, to deliver the Services (see Section 08).

Automatically Collected Information

When you use the Site, dashboard, or APIs, we automatically log IP address, browser/device type, pages visited, API request/response metadata, and timestamps, using cookies, log files, and similar technologies.

Information from Third Parties

We may receive information from payment gateways, the TRAI DLT platform, Meta and our WhatsApp Business Solution Provider, and — where you sign in with a third-party account — basic profile information from that provider.

04 How We Use Your Information

• Operations — to provide, operate, and maintain the Services: routing your messages/calls, processing payments, provisioning your dashboard and API keys, and providing customer support.
• Improvements — to understand usage trends, diagnose issues, and develop new features and Services.
• Communications — to send administrative notices, and — where you have not opted out — updates about new features, offers, and Services.
• Compliance — to meet our obligations under the TRAI Regulations, DLT framework, the IT Act 2000, the DPDP Act, and other applicable law, including KYC checks for business registration.
• Security — to detect and prevent fraud, spam, unauthorized access, and misuse of the Services.

05 Legal Basis for Processing

Under the DPDP Act, we process Personal Data primarily on the basis of your consent (e.g. when you register for an account or opt in to promotional communications) or where processing falls within a legitimate use recognised by the DPDP Act — such as performing our contract with you, complying with a legal obligation (DLT/TRAI record-keeping), or responding to a request you have voluntarily made.

You may withdraw consent for any consent-based processing at any time; this does not affect processing already carried out, or processing that continues on a legitimate-use basis.

06 Cookies & Tracking Technologies

• Essential cookies — required for login, session management, and core Site functionality.
• Functional/preference cookies — remember your dashboard settings, language, and similar preferences.
• Analytics cookies — help us understand aggregate usage (e.g. via Google Analytics) to improve the Site and Services.
• Advertising cookies — used, where applicable, for remarketing our own Services on other platforms.

You can control cookies through your browser settings, and opt out of Google Analytics using Google's Analytics Opt-out add-on.

07 Third-Party Processors & Data Sharing

We work with a limited set of trusted processors to deliver the Services. Each processes data only on our instructions, under a data-processing agreement, only to the extent necessary for its function.

We do not sell Personal Data to third parties.

08 Client Data & Your Recipients

If you are a Client, smsgatewayhub has no direct relationship with the individuals whose Personal Data you upload as Client Data (your message Recipients). As Data Fiduciary for that Client Data, you are responsible for giving Recipients appropriate notice and obtaining any consent required under the TRAI Regulations, the DPDP Act, or other applicable law — see Sections 04, 09(c), and 12(c) of our Terms & Conditions.

A Recipient who wants to access, correct, or delete data held about them as Client Data should approach the Client that messaged them directly.

09 Disclosure — Legal Process & Compliance

• (a). We may disclose Personal Data where required by law, or in the good-faith belief that disclosure is necessary to comply with a valid court order, regulatory (TRAI/DLT) directive, or to cooperate with law enforcement.
• (b). We may also disclose Personal Data to take precautions against liability, protect against fraud/abuse, defend against third-party claims, protect Service security, or enforce our Terms & Conditions.

10 Business Transfers

If smsgatewayhub is involved in a merger, acquisition, debt financing, sale of assets, insolvency, or similar transaction, Personal Data may be transferred to the successor entity, subject to that entity agreeing to protect the data on terms substantially consistent with this Policy.

11 Your Rights as a Data Principal

Under the DPDP Act, 2023 and DPDP Rules, 2025 (notified 13 Nov 2025, in force on a phased timeline), you have the following rights:

• Right to access — a summary of the Personal Data we hold about you.
• Right to correction and erasure — to correct inaccurate data or request erasure, subject to our legal retention obligations.
• Right to grievance redressal — to raise a grievance about our processing — see Section 19.
• Right to nominate — another individual to exercise these rights on your behalf in case of death or incapacity.
• Right to withdraw consent — as described in Section 05.

To exercise any of these rights, write to support@smsgatewayhub.com.

12 How We Protect Your Information

We use reasonable technical and organisational measures including TLS/SSL encryption in transit, restricted and logged access to production systems, and 2FA available on user accounts. Card data is handled by our PCI-DSS-compliant payment gateway partner(s) and is not stored on our own servers.

13 Data Retention

• (a). Account and Client Data are retained while your account is active, and thereafter as long as necessary for the purpose collected, unless a longer period is required by law.
• (b). Closed-account data is deleted within [6] months of closure, except records required for DLT/TRAI, tax, or dispute-resolution purposes.
• (c). Backups are retained for a rolling [2] months.
• (d). Transaction records are retained for [5] years or as required under Applicable Law.

14 Cross-Border Data Transfer

Our primary infrastructure processes and stores data [within India]. Any transfer outside India will follow the DPDP Act's cross-border provisions, including any country list the Central Government notifies. As of this update, no such list has been notified; we will update this section if that changes.

15 Data Fiduciary vs. Data Processor Roles

For Site visitors and account holders, smsgatewayhub is the Data Fiduciary. For Client Data (Recipient data uploaded by a Client), smsgatewayhub acts solely as a Data Processor, processing only on the Client's instructions. The Client remains the Data Fiduciary for that Client Data.

16 Children's Privacy

The Services are intended for business/individual users at least 18 years old, or otherwise competent to contract. We do not knowingly process a child's Personal Data except with verifiable parental/guardian consent, as required under the DPDP Act. Contact support@smsgatewayhub.com if you believe otherwise.

17 Third-Party Websites & Links

The Site and Services may link to third-party websites not operated by us. We are not responsible for their privacy practices. Review any third-party site's policy before sharing information with it.

18 SMS, WhatsApp & Voice-Specific Disclosures

• Opt-out — Recipients can typically reply “STOP” to opt out, subject to the sending Client's configuration and the TRAI DND registry.
• Promotional SMS window — restricted to 10:00 AM–9:00 PM IST.
• WhatsApp messaging — requires the Recipient's prior opt-in, obtained and managed by the Client, per Meta's Business Messaging Policy.
• Voice calls — call recordings/DTMF data are processed solely to deliver that Service and for billing/compliance.

19 Grievance Redressal

Per the IT Act 2000, the IT (Intermediary Guidelines) Rules 2021, and the DPDP Act 2023, our Grievance Officer's details are below. Complaints are acknowledged within 24 hours and resolved within 15 days where possible.

20 Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be notified via your registered email or a Site notice, and will update the “Last updated” date above. Continued use after such changes constitutes acceptance.

21 Contact Us

For questions about this Privacy Policy, or to exercise the rights in Section 11, reach out below.