Privacy Policy
1.Who we are
GETOTPCODE SERVICES, of Crown Estate, Sangotedo, Lagos, Nigeria, is the data controller for personal data processed through getotpcode.com. We are subject to the Nigeria Data Protection Act 2023.
Contact us about privacy at [email protected].
2.What we collect
Very little, deliberately.
| What | Why |
|---|---|
| Your email address | To create your account, verify it, and contact you about your orders |
| Your password | Stored hashed by our authentication provider. It passes through our server on its way there, and we never store or log it |
| Your order history | The numbers and email addresses you rented, for which service and country or email provider, what you paid |
| Your wallet transactions | Payments in, holds placed for orders, holds released, orders paid |
| Your IP address | Cloudflare sees it on every request (section 5). We keep it only as a one-way hash, to limit repeated guesses at a sign-in code, and delete it when that limit lapses |
| API keys you create | Stored as a hash. We cannot recover a key and never see it after you do |
| The verification code sent to your rented number or email address | See section 4. We keep the code, not the message |
| The name on the bank account you pay from, its bank, and the last four characters of its account number | Taken from our payment processor's confirmation of each bank transfer (Bachs or Flutterwave, section 3), to prevent fraud and to answer lawful requests from law enforcement and regulators. Kept as section 6 states |
Apart from the name on the bank account you pay from, we do not collect your name, your real phone number, your address, your date of birth, or any identity document. We do not require KYC to use the service, but we may ask you for further proof of identity where we reasonably suspect fraud or abuse.
We do not knowingly collect data about anyone under 18.
3.Payment information
You pay by bank transfer in naira, through one of two payment processors: Bachs, which the wallet offers first, or Flutterwave. Each has its own privacy policy and holds the payment data directly.
- Bachs. To open a transfer we send it your email address, or the customer reference Bachs gave your account once we have it, the amount and an internal reference. It gives you an account number to pay into, on its own payment page or on ours, and it sees the bank account you pay from. If you open its payment page, it also sees the requests your browser makes to that page. We keep the customer reference it gives your account, so that we do not need to send your email address again.
- Flutterwave. To open a transfer we send it your email address, which it requires, the amount and an internal reference. It gives you an account number to pay into, and it sees the bank account you pay from.
From the processor's confirmation of each transfer we record that the payment happened, its reference, the amount that arrived, what it credited to your wallet, and the name on the bank account it came from, that account's bank and the last four characters of its account number. We use that name to prevent fraud and to answer lawful requests, and we never show it to anyone else using the service. We do not keep the full account number.
Before October 2026 you could also pay in cryptocurrency through NOWPayments. We no longer take new crypto payments, but a payment made before then is still credited, and NOWPayments still processes it. For those payments we sent NOWPayments the amount, the currency and an internal reference, and we recorded the reference, the amount and currency that arrived, and the notices it sent us.
4.Messages sent to your rented numbers and email addresses
When you rent a number, the supplier that owns it receives the messages sent to it and passes us the verification code for your order. That is how the service works. When you rent an email address, the same is true of the emails sent to it: the supplier that provides the address receives them and passes us the verification code for your order.
We keep the code, not the message. We do not store the full text of any message. This applies to emails as it does to text messages.
The code, along with the time, the country or email provider, and the service, is kept for 90 days, then permanently deleted. We keep it so we can resolve a dispute about whether a code arrived.
After 90 days nothing about the content of any message remains.
Do not use our numbers or email addresses to receive anything you would not want us or our suppliers to be able to see. They are shared, temporary numbers and addresses rented from third parties. They are not private and they are not yours.
We do not read messages except where it is necessary to operate the service or to investigate a report of abuse.
5.Who we share data with, and where it is processed
We use a small number of providers. Each receives only what it needs to do its job for us.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| OVH | Hosts the server that runs our website and our background worker | Everything our application processes, on our server | London, United Kingdom |
| Cloudflare | Carries all traffic between you and our server, and protects it | Your IP address and the requests your browser makes | Its global network, including the United States |
| Supabase | Hosts our database and our sign-in service | Your email address, your hashed password, and the records in section 2 | Ireland, European Union |
| Resend | Sends our sign-in and verification emails | Your email address and the email, which carries a one-time code | United States |
| Bachs | Processes your bank transfers (the wallet's first choice) | Your email address or the customer reference it gave your account, the amount and an internal reference. It sees the bank account you pay from, and your browser's requests if you open its payment page. See section 3 | Nigeria, where the banks holding the accounts you pay into are, and the other countries Bachs operates in |
| Flutterwave | Processes your bank transfers (the wallet's second choice) | Your email address, the amount and an internal reference. It sees the bank account you pay from. See section 3 | Nigeria, and the other countries Flutterwave operates in |
| NOWPayments | Processed cryptocurrency payments made before October 2026. Kept while those payments may still settle | See section 3 | Outside Nigeria |
| Our virtual number and email suppliers | Provide the numbers and email addresses you rent | A request for a number for a service and a country, or for an email address for a service, and nothing about you. They necessarily see the messages sent to their own numbers and addresses | Outside Nigeria |
| WhatsApp (Meta) | Carries support conversations, only if you choose to contact us there | Your phone number, your WhatsApp profile and what you write to us | Outside Nigeria, including the United States |
We also share data, including the payer name in section 2, with law enforcement and regulators where we receive a lawful request or are legally required to, or where there is a serious and immediate risk to a person's safety.
Transfers out of Nigeria. Because of where these providers are, your data is processed outside Nigeria, in the United Kingdom, the European Union, the United States and elsewhere. The Nigeria Data Protection Act 2023 allows personal data to leave Nigeria where the recipient is bound by a law, binding rules or contract terms that protect it adequately, and on the other grounds the Act sets out. The United Kingdom and the European Union have data protection laws of that kind. For a provider in the United States or elsewhere, we rely on its data protection terms with us and, where those do not reach, on the transfer being necessary to provide the service you asked for. Ask us at [email protected] if you want to know more about the safeguards for any provider.
We do not sell your data. We do not share it for advertising. We have no advertising.
6.How long we keep the rest
Your account is kept while it is open, and for a period after closure to meet our legal and accounting obligations.
Your order and wallet records are retained as financial records. These are a record of a transaction and they are not deleted on request. Section 7 explains what happens instead.
The details of an order are not kept for ever:
- An order where no code arrived and the hold was released: the phone number or email address, and our supplier's reference for it, are deleted 30 days after you placed the order.
- An order that completed: the phone number is kept with the order record, so we can find the order if you or a platform asks about it, for six years after your account's last activity, then deleted. The code is deleted as section 4 states. A completed email order's address is kept and deleted in the same way as a number.
- The name on the bank account you paid from, its bank and the last four characters of its number: kept for six years after your account's last activity, then deleted.
Your account's last activity is the latest of when you opened it and its most recent wallet entry, which every payment, order and refund writes.
What stays is the record of the transaction: that the order was placed, for which service and country or email provider, when, what it cost, and every wallet entry it made. Your balance is never changed by this.
Codes are handled as section 4 states.
7.Your rights, and one honest limit
Under the NDPA you may ask us to give you a copy of your data, correct it, or delete it. There is no self-service option for this. Ask us at [email protected] or on WhatsApp at +2349160930294, and we will act on your request within one month.
On deletion we need to be specific about what we can do.
We will erase your email address and anything else that identifies you. What we do not delete is the underlying transaction record, which we keep as the law requires: that an order was placed, what it cost, and what the ledger says. Those records are anonymised rather than removed, for two reasons. They are financial records we are required to keep, and deleting them would break the integrity of an accounting ledger that other records depend on.
After erasure, nothing in our systems identifies you. The transactions remain, attached to nobody.
8.Security
Passwords are hashed by our authentication provider. API keys are stored hashed and shown once. We store verification codes, never the text of a message. Access to our production systems is limited to the operator.
No system is perfectly secure. If we suffer a breach affecting your data we will notify you and the Nigeria Data Protection Commission as the NDPA requires.
9.Cookies
We use cookies only to keep you signed in and to make the site work. We do not use advertising or tracking cookies, and we do not run third party analytics that profile you.
10.Changes
We will post changes here and update the date above. Material changes will be emailed to you.
11.Complaints
If you are unhappy with how we have handled your data, contact us first at [email protected]. You also have the right to complain to the Nigeria Data Protection Commission.