Privacy & Data Protection

1. Who is responsible

For your own account information, the operator of this SAMT deployment ([your-company]) is the data controller. For the recipient lists, numbers and message content you upload and send, you are the controller and SAMT processes that data on your behalf and under your instructions.

2. Information we process

We process the following categories of data:

• Account data — your name, email address, hashed password and role.
• Recipient data — the phone numbers, email addresses and names you add to lists or campaigns.
• Message data — the content of campaigns and their delivery results.
• Provider credentials — the API keys you connect, stored encrypted at rest (AES-256-GCM).
• Technical data — logs needed to operate, secure and troubleshoot the Service.

3. How we use it

We use this information to:

• Provide the core features — number checks, list management, sending and tracking.
• Authenticate you and secure your account.
• Maintain, monitor and improve the reliability of the Service.
• Meet legal and regulatory obligations.

4. Lawful basis & your responsibility

For recipient data, you are responsible for ensuring you have a lawful basis to contact each person and for handling their data fairly. You should only upload data you are permitted to use for the purpose of your outreach.

5. Sharing

To deliver messages, relevant data (such as a destination number and message body) is shared with the messaging providers you connect. We do not sell personal data. We may share data with service providers who help us run the platform, under appropriate confidentiality and data-protection terms.

6. Storage & security

Data is stored in the database configured for this deployment. We apply technical and organisational measures appropriate to the risk, including encryption of provider credentials at rest, access controls and rate limiting. No system is perfectly secure, but we work to protect your data.

7. Retention

We keep account and campaign data for as long as your account is active or as needed to provide the Service, then delete or anonymise it within a reasonable period unless a longer period is required by law. You can delete lists, campaigns and numbers from within the app at any time.

8. Your rights

Depending on your location, you and the people in your lists may have rights to access, correct, delete or restrict the use of personal data, and to object to certain processing. Requests relating to your account can be sent to [your-contact-email]; requests from your recipients should be directed to you as the controller of that data.

9. International transfers

Depending on where your database and providers are hosted, data may be processed in countries other than your own. Where required, appropriate safeguards are applied to such transfers.

10. Changes & contact

We may update this notice as the Service evolves; material changes will be communicated through the Service. For privacy questions, contact [your-contact-email].