Privacy Policy

1. Who we are

kartesim rents real mobile phone numbers backed by physical SIM cards. Business partners receive one-time verification codes through our API. kartesim is the controller of the personal data described in this policy. You can reach us at support@kartesim.com.

2. Information we collect

Information you give us

• Account details: your email address, your name if you provide it, and your password. Passwords are stored only as a one-way hash; we cannot read them.
• Sign in with Google: your name, email address and Google account ID. See section 3.
• Payment details: We never see or store your full card number.
• Support messages: the emails you send us, and the messages you write in the chat on our website, with the email address you give there, the page you were on, and our replies.
• Partner accounts (businesses using our API): company and contact details, API keys, webhook URLs, balance, and billing records.

Information created when you use the Service

• SMS received on your numbers: the sender, the message text and the time it arrived. We store these so we can show them in your private inbox.
• Verification codes delivered to partners: the service, the code, the number used and the time, for delivery and billing.
• Technical data: IP address, browser or device type, and request logs, used for security, abuse prevention and fixing errors.

Cookies and local storage

We use one essential cookie to keep you signed in, a second one that remembers your website-chat conversation if you use the chat, a third one that remembers, for 30 days, which site sent you to us and the first page you opened (so we know which pages bring customers; it never leaves our site), and your browser's local storage to remember your light or dark theme. We count visits and measure page speed with Vercel Web Analytics and Speed Insights, which use no cookies and do not identify you. We do not use advertising cookies or advertising trackers.

3. Google user data

If you choose "Sign in with Google", we request only the basic sign-in permissions (openid, email and profile). From Google we receive and store only:

• your email address, to create your account, sign you in and send you service emails such as receipts;
• your name, to address you in the dashboard and in emails;
• your Google account ID, to recognise you the next time you sign in with Google.

We do not access your Gmail, contacts, Drive, calendar or any other Google data, and we do not store your profile photo or any Google access token after sign-in. Google user data is used only to provide and secure your kartesim account. It is never sold, never used for advertising, never used to train AI models, and never shared with anyone except as needed to run the Service (for example our database host), to comply with the law, or with your consent.

kartesim's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove kartesim's access at any time from your Google Account permissions page, and delete your kartesim account and its data as described in section 7.

4. How we use your information

• To create and secure your account and sign you in.
• To provide the Service: reserve and activate your number, deliver its SMS to your inbox, and deliver codes to partners.
• To take payments and keep billing and tax records.
• To send service emails, such as welcome, receipt and account-closure messages.
• To send occasional product news or offers. Every such email has an unsubscribe link, and you can also unsubscribe here.
• To answer your support requests.
• To prevent fraud, spam and abuse, enforce our Terms, and keep the Service reliable.
• To meet legal obligations, such as tax, accounting and lawful requests from authorities.

We rely on these legal bases: performing our contract with you, our legitimate interest in running a secure service, your consent (for example marketing emails, which you can withdraw at any time), and legal obligations.

5. How we share information

We do not sell or rent your personal data. We share it only with service providers that help us run kartesim, under contracts that limit their use of it:

• Vercel — website and application hosting.
• Supabase — database hosting.
• Upstash — rate limiting and background job queues.
• Pusher — real-time updates that show new SMS in your inbox instantly.
• Resend and our email provider — sending and receiving email.
• Telegram — new website-chat messages are forwarded to our support team's Telegram so we can answer quickly.
• Google (Gemini API) — our support team may use it to help draft replies, in which case the text of your support email is processed to write the reply.

We may also disclose information if required by law or a valid legal request, to protect the rights and safety of our users and the Service, or as part of a merger or sale of the business, in which case this policy continues to apply.

6. How long we keep it

• Account details, rentals and the SMS in your inbox are kept while your account is open.
• When you close your account, we delete your account, rentals, messages and website-chat history from our systems.
• Website-chat conversations from visitors without an account are kept while we may need them to help you; ask us and we will delete yours.
• Payment and invoice records are kept for as long as tax and accounting law requires, even after your account is closed.
• Security and error logs are kept only for a limited period and then deleted.

7. Your choices and rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct data that is wrong;
• delete your data;
• object to or restrict certain uses, and withdraw consent at any time;
• complain to your local data protection authority.

Delete your account: in the dashboard, open Account settings and choose "Close account". This permanently deletes your account, rentals and messages. You can also email support@kartesim.com and we will do it for you. For any other request, email us from the address on your account and we will reply within 30 days.

8. Security

All traffic is encrypted with HTTPS. Passwords are hashed, and access to personal data is limited to the people who need it to run the Service. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authorities of a breach where the law requires.

9. International transfers

Our service providers may process data in the United States, the European Union and other countries. Where data leaves your country, we rely on the safeguards those providers offer, such as standard contractual clauses.

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We will update the date at the top when this policy changes. If a change is significant, we will tell you by email or in the dashboard before it takes effect.

12. Contact us

Questions or requests about your privacy: support@kartesim.com. See also our Terms of Service and Refund Policy.