Privacy Policy

1. Overview & Scope

Welcome to OTPWala ("we," "our," or "us"). We provide an automated platform allowing verified users to provision temporary virtual phone numbers for receiving SMS verification codes (One-Time Passwords / OTPs) from third-party applications and web platforms.

This Privacy Policy explains how we collect, store, use, and disclose information when you visit our website (https://otpwala.me), access our dashboard, top up your account wallet, or authenticate using third-party identity providers such as Google OAuth.

By accessing or using OTPWala, you consent to the practices described in this Privacy Policy. If you do not agree with any portion of this policy, you must discontinue using our services.

GOOGLE API SERVICES COMPLIANCE

2. Google User Data & OAuth Policy

OTPWala offers single-sign-on (SSO) authentication using Google OAuth 2.0. Our use and transfer of information received from Google APIs to any other app will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

✓

What We Access: When you sign in with Google, we only request standard basic profile information: your email address, display name, and optional profile avatar URL. We never request access to your Google Drive, Gmail messages, contacts, or calendar data.

✓

Strict Purpose of Use: Your Google account information is used exclusively to create your authenticated OTPWala account, maintain your secure login session, associate your wallet balance, and send essential transactional receipts.

✓

No Sale or Third-Party Marketing: We strictly DO NOT sell, rent, monetize, or transfer your Google user data to advertisers, data brokers, or external analytics firms.

✓

Revocation: You can revoke OTPWala's access to your Google account at any time by visiting yourGoogle Account Permissions settings.

3. Information We Collect

We only collect information necessary to deliver and secure our virtual number services:

A. Account Information

When you register directly or via Google SSO:

Your verified email address
Account creation timestamp & user identifier (UUID)
Optional profile name

B. Wallet & Payment Data

When you add funds to your wallet:

Transaction amount and currency (INR)
Payment method used (e.g., UPI)
Bank/UPI transaction reference numbers (UTR) for reconciliation
Note: We do NOT collect or store your UPI PIN, banking passwords, or card CVVs.

C. Service Usage Data

When you request a virtual number:

The service requested (e.g., WhatsApp, Telegram, Google)
Country selected
The temporary virtual phone number provisioned
Order status (Waiting, Code Received, Completed, Cancelled)
Cost and timestamps

D. Technical & Security Logs

To detect abuse and prevent fraudulent attacks:

IP address and approximate geolocation
Browser type, device operating system, and user agent
Access timestamps and failed request logs

E. Referral & Attribution Data

When participating in the Refer & Earn program:

Unique referral codes and referral tracking identifiers
Attribution linkage between the referring account and referred user
Referral Privacy Guarantee: In the referrer's dashboard, only the referral's display name and joining date are shown. Private contact details (full email addresses, phone numbers, or specific purchases) are never disclosed to referrers.

4. How We Use Information

The information we collect is processed for the following lawful business purposes:

Core Service Provision: Allocating temporary virtual numbers from upstream carriers and delivering the incoming verification SMS code to your private dashboard.
Account Security: Verifying user identity, preventing automated brute-force attempts, and preventing unauthorized account takeover.
Billing & Wallet Management: Crediting deposited funds, deducting purchases according to live pricing, and issuing automatic refunds when an SMS code is not received within the timeout window.
Customer Support: Investigating failed orders, resolving payment inquiries, and assisting users via our official support channels.
Legal Compliance & Abuse Prevention: Detecting and mitigating malicious activities such as spam, fraud, automated bot exploitation, or violations of our Terms of Service.

5. SMS & Data Retention Policy

We believe in data minimization. The temporary numbers provisioned through our service are disposable:

SMS Content: Verification SMS codes received on virtual numbers are displayed on your dashboard in real-time. We only retain the extracted verification code and transient notification text during the active activation window (typically 10 to 20 minutes).
Number Recycling: Virtual phone numbers do not belong to users permanently. Once an activation session ends or expires, the number is released and cannot be reused or retrieved.
Account Deletion: You can request full account deletion and erasure of your profile records by contacting our support team at support@otpwala.me.

6. Information Sharing & Third Parties

We do not sell, license, or trade your personal information. Information is only shared under strict circumstances:

Upstream Telecommunication Providers: We communicate with verified upstream carrier gateways (such as Tiger SMS) to query availability and request telephone numbers. We only transmit the required service code and country ID; we never transmit your personal identity, email, or Google account information to upstream carriers.
Payment Gateways & Banking Partners: When processing deposits, transaction details are handled securely by authorized banking and UPI infrastructure providers.
Legal & Regulatory Authorities: We may disclose data if required by a court order, applicable law, subpoena, or governmental regulatory authority to comply with legal obligations or prevent unlawful conduct.

7. Security Safeguards

We implement comprehensive physical, technical, and organizational security measures to protect your information:

End-to-End Encryption: All traffic between your browser and our servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
Token-Based Authentication: User sessions are managed using encrypted, short-lived JSON Web Tokens (JWT) stored securely and authenticated through Supabase Auth.
Role-Based Access Control: Strict database-level Row Level Security (RLS) policies ensure that users can only access their own orders, wallets, and profile records.

8. Your Rights & Choices

Under applicable data privacy regulations (including Indian IT Act rules and GDPR principles), you have the right to:

Access: Request a summary of the personal data we hold associated with your account.
Correction: Request correction of inaccurate or incomplete information.
Revoke Consent: Disconnect your Google OAuth authorization at any time through Google Account security settings.
Account Closure: Request closure of your account and purging of personal identity data.

9. Contact & Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please reach out to our team:

OTPWala Support Team
Email: support@otpwala.me
Telegram Support: @OTPWalaSupport
Website: https://otpwala.me