1. Overview & Scope

Welcome to OTPWala ("we," "our," or "us"). We provide an automated platform allowing verified users to provision temporary virtual phone numbers for receiving SMS verification codes (One-Time Passwords / OTPs) from third-party applications and web platforms.

This Privacy Policy explains how we collect, store, use, and disclose information when you visit our website (https://otpwala.me), access our dashboard, top up your account wallet, or authenticate using third-party identity providers such as Google OAuth.

By accessing or using OTPWala, you consent to the practices described in this Privacy Policy. If you do not agree with any portion of this policy, you must discontinue using our services.

3. Information We Collect

We only collect information necessary to deliver and secure our virtual number services:

4. How We Use Information

The information we collect is processed for the following lawful business purposes:

• Core Service Provision: Allocating temporary virtual numbers and delivering the incoming verification SMS code to your private dashboard.
• Account Security: Verifying user identity, preventing automated brute-force attempts, and preventing unauthorized account takeover.
• Billing and Wallet Management: Adding deposits, charging for orders at the shown price, and issuing eligible credits after cancellation or expiry is confirmed.
• Customer Support: Investigating failed orders, resolving payment inquiries, and assisting users via our official support channels.
• Legal Compliance & Abuse Prevention: Detecting and mitigating malicious activities such as spam, fraud, automated bot exploitation, or violations of our Terms of Service.

5. SMS & Data Retention Policy

We believe in data minimization. The temporary numbers provisioned through our service are disposable:

• SMS Content: Verification SMS codes received on virtual numbers are displayed on your dashboard in real-time. We only retain the extracted verification code and transient notification text during the active activation window (typically 10 to 20 minutes).
• Number Recycling: Virtual phone numbers do not belong to users permanently. Once an activation session ends or expires, the number is released and cannot be reused or retrieved.
• Account Deletion: You can submit a reviewed erasure request from Dashboard → Settings & Security. Authentication credentials and eligible personal content are removed after approval; pseudonymized financial records may be retained where required for accounting, fraud prevention, or legal compliance.

6. Information Sharing & Third Parties

We do not sell, license, or trade your personal information. Information is only shared under strict circumstances:

• Telecommunications Infrastructure: OTPWala processes the service and country selection required to allocate a number. Your personal identity, email, and Google account information are not attached to number-allocation requests.
• Payment Gateways & Digital Asset Partners: When processing deposits, transaction details are handled securely by authorized banking, UPI infrastructure providers, and digital asset networks (including the Binance Pay API ecosystem).
• Legal & Regulatory Authorities: We may disclose data if required by a court order, applicable law, subpoena, or governmental regulatory authority to comply with legal obligations or prevent unlawful conduct.

7. Cookies, Local Storage & Similar Technologies

OTPWala uses essential browser storage and similar technologies to keep you signed in, remember authentication settings, preserve referral attribution, protect sessions, and support fraud prevention. These technologies are necessary for core account and security functions.

We do not use Google OAuth data for advertising. We may use operational logs or privacy-respecting analytics only where configured and lawful. You can clear browser storage or block cookies, but doing so may sign you out or prevent parts of the service from working.

8. Security Safeguards

We implement comprehensive physical, technical, and organizational security measures to protect your information:

• Transport Security: We use HTTPS/TLS for traffic between supported clients and our services.
• Token-Based Authentication: User sessions are managed through Supabase Auth and protected using the security controls provided by the authentication platform and our application.
• Role-Based Access Control: Strict database-level Row Level Security (RLS) policies ensure that users can only access their own orders, wallets, and profile records.

9. Your Rights & Choices

Under applicable data privacy regulations (including Indian IT Act rules and GDPR principles), you have the right to:

• Access: Request a summary of the personal data we hold associated with your account.
• Correction: Request correction of inaccurate or incomplete information.
• Revoke Consent: Disconnect your Google OAuth authorization at any time through Google Account security settings.
• Account Closure: Request closure of your account and purging of personal identity data.

10. Contact & Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to our team: