Privacy Policy

FastOTP is responsible for the personal data described in this policy. For anything about your data, write to [email protected].

This policy covers the website at fastotp.io, your account and the API.

Everything FastOTP stores about you is listed here. We use it to provide the service you asked for, to keep it secure, and to meet our legal obligations. We do not use it for anything else.

Email address

Given when you create an account.

WhyTo sign you in, to identify your account, and to write to you about your account or an order.

Password, as a hash

Stored only as a one-way hash. The password itself is not stored.

WhyTo check your password when you sign in.

Balance and transaction history

Every amount added, charged or refunded, with its date and the order it belongs to.

WhyTo keep your balance correct and to show you where your money went.

Order history

For each order: the service, the country, the number issued, the code received, the price, the outcome, and the times at which each step happened.

WhyTo deliver the code to you, to refund orders that end without one, and to measure delivery rates.

API keys, as a hash

A key is shown to you once. We keep a hash of it, its first characters, the name you gave it, and when it was last used.

WhyTo authenticate your API requests and let you tell your keys apart.

IP address and browser user agent

Recorded when you sign in, and in security logs of actions on your account.

WhyTo protect accounts, to limit automated abuse, and to investigate misuse.

Messages you send us

The emails you write to support, and our replies.

WhyTo answer you.

The delivery rates we publish are totals per route. They are counted from orders, but they contain nothing about any customer.

• Your name, postal address or own phone number. An account needs an email address and a password, nothing more.
• Card or bank details. These go to the payment processor and never reach our servers. See payments.
• Advertising or analytics data. The site runs no advertising trackers and no analytics scripts.

FastOTP sets cookies only when you sign in, and only the ones needed to keep you signed in. Reading the public pages without an account sets no cookies.

• Session cookies. Two cookies hold your sign-in: a short-lived one that proves who you are, and a longer-lived one that renews it. Both are marked HttpOnly, so scripts running in the page cannot read them, and both are removed when you sign out.
• No advertising or analytics cookies. None exist today. If that ever changes, this policy will be updated before any such cookie is set.

Because the only cookies are essential ones, there is no cookie banner. You can block cookies in your browser, but you will not be able to sign in without them.

Balance is added with a cryptocurrency payment (USDT or USDC), handled by a payment processor, not by FastOTP. You pay on the processor’s page from your own wallet. We never receive your wallet’s keys, and we do not handle card numbers or bank details.

What we keep is the record of the payment: the amount, the coin and network, the date, whether it succeeded, and the processor’s reference for it. Payments on a blockchain are public by nature. The processor handles your payment under its own privacy policy.

We do not sell personal data, and we do not share it with advertisers. It goes to:

• The number supplier, in a very limited form. To get you a number we pass on the service and the country of your order. That is all. The supplier never receives your email address, your IP address or anything else that identifies you.
• The payment processor. It receives what you enter when you pay, and the amount.
• Hosting providers. The servers and databases the service runs on are operated for us by infrastructure providers, which store the data on our behalf.
• Authorities. We disclose data when the law requires it, for example in response to a valid legal order.

The service you are verifying with gets the phone number from you, when you type it in. We send that service nothing.

Where data protection law such as the GDPR applies, we use your data on these grounds:

• Our contract with you: to run your account, fill your orders and handle your balance.
• Our legitimate interests: to keep the service secure, prevent fraud and abuse, and improve it using totals that identify no one.
• Legal obligations: to keep tax and accounting records and to answer lawful requests.
• Your consent, where we ask for it. You can withdraw consent at any time.

Our servers and providers may be outside the country you live in. Where data moves between regions, we rely on safeguards the law recognises, such as Standard Contractual Clauses.

• Account data (email address, password hash, API keys) is kept while your account is open and for 90 days after it is closed.
• Order, balance and payment records are kept for 24 months (payment records: 7 years, as tax law requires).
• Sign-in sessions are kept until you sign out or the session expires.
• Security logs (IP address, browser, action) are kept for 12 months. The counters that limit repeated requests from one IP address expire on their own after a short time.

• Passwords are stored only as one-way hashes.
• API keys are stored only as hashes. The full key is shown once, when you create it.
• Session cookies cannot be read by scripts, and a session can be ended from our side.
• All traffic is encrypted with TLS 1.2 or newer.
• Staff access to customer data is limited by role, and staff actions are logged.

No system is perfectly secure. If you think your account has been accessed by someone else, change your password and tell us at [email protected].

Depending on where you live, the law may give you the right to:

• get a copy of the data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• receive it in a form you can take to another service;
• object to how we use it, or ask us to restrict that use;
• withdraw your consent, where we rely on it;
• complain to the data protection authority in your country.

To use any of these rights, write to [email protected] from the email address on your account, so we know the request comes from you. We answer within 30 days.

Some records cannot be deleted on request. We have to keep order and payment records for the periods described under how long we keep it.

FastOTP is not meant for children. You must be at least 16 years old to hold an account. If you believe a child has opened an account, tell us at [email protected] and we will close it.

We will update this page before we change what we collect or how we use it, and in particular before any advertising or analytics cookie is added. We email registered users about a material change at least 14 days before it takes effect. The version in force is always the one on this page, and the date at the top shows when it last changed.

Questions about this policy or about your data go to [email protected]. See also the contact page and the terms of service.