Privacy Policy

1. Information we collect

Account details

• Your name, e-mail address and mobile number, and a hash of your password (never the password itself).
• Optional details you add: company name, job title, website, address, a short bio and your TIN.
• Your 8-digit account number, referral code and who invited you, if anyone.

Verification

• Phone verification: a hashed one-time code that expires after 10 minutes.
• E-mail confirmation: the address confirmed, when, and hashed copies of the link and code we sent (they expire after 24 hours), plus a hashed form of the network address that asked for it.
• Identity verification (KYC): your legal name, National ID number, photos of the front and back of your ID, and the review history (dates, decisions and reasons).

Messages and contacts

• For every message: the recipient number, the text and signature, the time, how it was sent (dashboard, API, app, bulk campaign or Verify API), its status (accepted or failed, with the network's error), its message ID and the credits used. Codes sent with the Verify API are masked in your history.
• Contacts, groups, custom fields and templates you save, and the recipient lists of your bulk campaigns.
• If you switch on link tracking for a campaign, how many times its links were opened.

API and technical information

• API keys are stored as a one-way hash plus an encrypted copy so you can view a key again. We also keep each key's name, IP allow-list, when it was last used and the IP address that used it last.
• Webhook addresses, an encrypted signing secret, and recent delivery attempts with the response your server gave.
• A request log with the address called, the result, the time it took and a request ID — without message text or keys.
• For the app: the device name, platform, app version, a push-notification token and a hashed form of the network address.

Payments

• The package, amount, status and Chapa references of each payment; the payment method type; and the payer name, e-mail and phone number Chapa returns. We never receive card numbers or mobile-money PINs.
• For a refund: the account number and account name you give us so the money can be sent back.

Support and communication

• Support tickets and our replies.
• If you connect our Telegram bot: your Telegram chat ID and name, and the messages you exchange with the bot.
• The notifications and e-mails we send you, and whether you unsubscribed from announcements.

Security and content checks

• Sign-in attempts (stored as hashes of the e-mail and network address).
• Messages our checks blocked or flagged, with the reason, and the IP address and browser of that request — kept so a person can review the decision.
• Policy strikes and suspension records.

2. Why we use it

• To create and secure your account, confirm your phone number and e-mail address, and verify your identity before you can send.
• To deliver your messages, show your history and statistics, and run your bulk campaigns, webhooks and API requests.
• To take payments, add credits, issue receipts and statements, and handle refunds.
• To prevent spam, fraud and abuse — including checking messages before they are sent — and to keep SMSHub and the networks safe.
• To answer support requests and send service messages: receipts, verification results, security alerts and important changes. Announcements and offers are separate, and you can unsubscribe from them at any time.
• To meet our legal and accounting obligations.

We rely on the agreement with you (to provide the service), our legal obligations, our legitimate interest in keeping SMSHub secure and free of abuse, and your consent where we ask for it (for example, connecting Telegram).

3. Who receives your information

• Mobile networks and delivery partners: the recipient number, message text and signature go through the Hizcore SMS gateway to our licensed delivery partners and to Ethio Telecom or Safaricom Ethiopia.
• Chapa: payment and refund details, so it can process them.
• E-mail: our mail server sends receipts and verification e-mails; your e-mail provider receives them.
• Hosting: the website and database run on servers in Ethiopia.
• Other services you choose to use: Telegram (if you connect the bot or sign in with Telegram), Expo and Google Firebase (push notifications in the app), Google reCAPTCHA (on sign-up and sign-in pages) and Google Fonts (your browser downloads our fonts from Google).
• Your team: members of your workspace see what their role allows.
• Authorities: when the law requires it, or when necessary to address serious harm, as described in our Acceptable Use Policy.

We don't sell personal information, and we don't share it with advertisers.

Some of these providers (Google, Telegram, Expo) may process information outside Ethiopia.

4. Messages and contacts you upload

For the recipients' numbers, names and message content you upload, you decide what is sent and to whom; we process that information for you to deliver your messages. You are responsible for having permission to contact your recipients. If a recipient asks us about their data, we will refer them to you, unless the law requires us to act ourselves.

5. How we protect information

• Every page and API call uses HTTPS (with HSTS).
• Passwords are stored only as bcrypt hashes. API keys, two-step secrets and integration secrets are stored hashed or encrypted (AES-256-GCM).
• ID documents are kept in a private storage folder that the web cannot reach, under random file names. Administrators open them only through short-lived signed links, and documents are never sent by e-mail.
• Administrators have individual accounts with limited permissions; sign-in attempts are limited and their actions are logged.
• Sign-in, verification codes and the API are rate-limited; forms are protected against cross-site request forgery.

Message history, contacts and documents are protected by these access controls on our servers; they are not separately encrypted in the database. SMS itself is not encrypted on the mobile networks, so please don't send passwords or other secrets by SMS.

6. How long we keep it

• Your account, message history, contacts and ID documents: while your account exists. When you delete your account we remove them within 7 days, except as listed below. Old ID photos are deleted when you submit new ones.
• Payment records and receipts: as long as accounting and tax law requires, also after an account is deleted.
• Records of serious policy violations: kept to prevent fraud and repeat abuse.
• Request log: 30 days. Sign-in attempts: 7 days. Rate-limit counters: 2 days. Webhook delivery attempts: 14 days.
• Messages with our Telegram bot: 60 days. App sessions: removed 30 days after they expire or you sign out.
• E-mail confirmation links and phone codes stop working after 24 hours and 10 minutes respectively.

7. Your rights and choices

• See and correct: most details are in Dashboard → Account. You can download your message history and contacts as CSV and your statements as PDF.
• Ask for a copy of the information we hold about you, or ask us to correct or delete it.
• Object to or stop optional uses: unsubscribe from announcements with the link in any announcement, and disconnect Telegram in Account.
• Delete your account at any time — see “Delete your account” on our website.

Contact us at Telegram @hizkiel_23, e-mail support@smshub.et or phone 0941907682 (Mon–Sat, 8:00–20:00 EAT). We may ask you to confirm your identity first, and we answer as soon as we can within the time the law allows. Some information must be kept for legal or security reasons, as explained above.

8. Cookies

• A session cookie keeps you signed in and protects forms; it ends when you sign out or after 2 hours without activity.
• A language cookie (smshub_lang) remembers whether you chose English or Amharic.
• Google reCAPTCHA, on the sign-up and sign-in pages, may set its own cookies to tell people and bots apart.

We don't use advertising or analytics cookies.

9. Security incidents

If we learn of a security incident that affects your information, we work to stop it, find out what happened and reduce the harm. Where the law requires it, or where you need to take action to protect yourself, we will tell you and the relevant authority without undue delay.

10. Children

SMSHub is for people aged 18 and over. We don't knowingly collect information about children; if we learn that we have, we delete it.

11. Changes to this policy

We may update this policy as SMSHub changes. The date at the top shows the latest version, and material changes are announced on your dashboard or by e-mail.

12. Contact

Questions or requests about your information: Telegram @hizkiel_23, e-mail support@smshub.et or phone 0941907682 (Mon–Sat, 8:00–20:00 EAT).