Privacy Policy

1. Controller

XYZ Sp. z o.o. — smsport.support@gmail.com, ul. Przykładowa 1, 00-001 Warszawa, Polska.

Phone numbers and SMS content processed for Customers: processor role — DPA.

2. Data

Account data (email, organisation), authentication, billing, and technical logs needed to operate the service.

3. Purposes and legal bases (GDPR)

Purpose	Legal basis
Provide the service	Art. 6(1)(b) GDPR
Billing and legal obligations	Art. 6(1)(c) GDPR
Security and abuse prevention	Art. 6(1)(f) GDPR
Analytics cookies	Consent — Cookie Policy

4. Recipients

Subprocessors (hosting, authentication, payments).

5. Location

Primarily AWS eu-central-1 (Frankfurt) in the EEA. Transfers outside the EEA only with appropriate safeguards and subprocessor updates.

6. Retention

Operational message data — up to 90 days (TTL). After workspace removal — marked for deletion after 30 days. Account and billing data — while the account is active; payments via Stripe.

7. Rights

Access, rectification, erasure, restriction, objection, complaint to your authority — smsport.support@gmail.com.

8. Changes

Current version on this page (date in header).