Privacy Policy
1.Who we are
CLAVESMS SERVICES, of [REGISTERED ADDRESS], Nigeria, is the data controller for personal data processed through clavesms.com. We are subject to the Nigeria Data Protection Act 2023.
Contact us about privacy at [email protected].
2.What we collect
Very little, deliberately.
| What | Why |
|---|---|
| Your email address | To create your account, verify it, and contact you about your orders |
| Your password | Stored hashed by our authentication provider. We never see it |
| Your order history | The numbers you rented, for which service and country, what you paid |
| Your wallet transactions | Payments in, orders out, refunds |
| API keys you create | Stored as a hash. We cannot recover a key and never see it after you do |
| Verification messages sent to your rented numbers | See section 4. This is the sensitive one |
We do not collect your name, your real phone number, your address, your date of birth, or any identity document. We do not require KYC to use the service.
We do not knowingly collect data about anyone under 18.
3.Payment information
We never see your card details. Card and transfer payments are handled entirely by Flutterwave, and cryptocurrency payments by NOWPayments. Each has its own privacy policy and each holds the payment data directly.
We record that a payment happened, its reference, and what it credited to your wallet.
4.Messages sent to your rented numbers
When you rent a number, we can see the messages sent to it. That is unavoidable, because the service works by receiving those messages and showing them to you.
We handle them as follows.
The full message text is encrypted and kept for 7 days, then permanently deleted.
The extracted code, along with the time, country and service, is kept for 90 days, then permanently deleted. We keep this so we can resolve a dispute about whether a code arrived.
After 90 days nothing about the content of any message remains.
Do not use our numbers to receive anything you would not want us to be able to see during that window. They are shared, temporary numbers rented from third parties. They are not private and they are not yours.
We do not read messages except where it is necessary to operate the service or to investigate a report of abuse.
5.Who we share data with
Our upstream suppliers, who provide the numbers. They necessarily see the messages sent to their own numbers. We share no information about you with them, because they receive a request for a number rather than a customer.
Flutterwave and NOWPayments, for payments.
Supabase for database hosting and Vercel for application hosting, as infrastructure providers.
Law enforcement, where we are legally required to, or where there is a serious and immediate risk to a person's safety.
We do not sell your data. We advertise on Snapchat, and to measure those ads our public pages (the home page, sign-in and sign-up) load Snap's pixel, which tells Snap Inc. that the page was visited and when an account is started. We do not send Snap your email address, your balance, your orders or anything from the pages you use after signing in.
6.How long we keep the rest
Your account is kept while it is open, and for a period after closure to meet our legal and accounting obligations.
Your order and wallet records are retained as financial records. These are a record of a transaction and they are not deleted on request. Section 7 explains what happens instead.
Message content is handled as section 4 states.
7.Your rights, and one honest limit
Under the NDPA you may ask us to give you a copy of your data, correct it, or delete it. Contact [email protected].
On deletion we need to be specific about what we can do.
We will erase your personal data, meaning your email address and anything identifying you. What we do not delete is the underlying transaction record: that an order was placed, what it cost, and what the ledger says. Those records are anonymised rather than removed, for two reasons. They are financial records we are required to keep, and deleting them would break the integrity of an accounting ledger that other records depend on.
After erasure, nothing in our systems identifies you. The transactions remain, attached to nobody.
8.Security
Passwords are hashed by our authentication provider. API keys are stored hashed and shown once. Message content is encrypted at rest. Access to our production systems is limited to the operator.
No system is perfectly secure. If we suffer a breach affecting your data we will notify you and the Nigeria Data Protection Commission as the NDPA requires.
9.Cookies
We use our own cookies only to keep you signed in and to make the site work. Our public pages (the home page, sign-in and sign-up) also load the Snap Pixel from Snap Inc. to measure our Snapchat ads; it can set Snap's own cookies, and Snap handles that data under its own privacy policy. It is not loaded on any page after you sign in. You can block it with your browser's tracking or ad-blocking settings without affecting your use of the site.
10.Changes
We will post changes here and update the date above. Material changes will be emailed to you.
11.Complaints
If you are unhappy with how we have handled your data, contact us first at [email protected]. You also have the right to complain to the Nigeria Data Protection Commission.