1. Introduction
otpbase provides an API that lets businesses send and verify one-time passwords (OTPs) by SMS and email, for sign-up verification, passwordless login, two-factor authentication and similar uses.
This policy explains what personal data we process, why we process it, how long we keep it, who we share it with and what rights you have. It is written to meet the transparency requirements of Articles 12 to 14 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applies equally to the UK GDPR.
2. Who we are and how to contact us
The controller of personal data described in this policy is OTPBASE LLC, operating the website otpbase.net ("otpbase", "we", "us").
| Company | OTPBASE LLC, a Delaware limited liability company |
|---|---|
| Registration number | Delaware File No. 7738215 |
| Registered office | 4415 Harbor Pointe Boulevard, Suite 210 Wilmington, DE 19801, United States |
| Privacy contact | privacy@otpbase.net |
For any question about this policy or about your personal data, contact us at:
- Email: privacy@otpbase.net
- Post: OTPBASE LLC, Attn: Data Protection, 4415 Harbor Pointe Boulevard, Suite 210, Wilmington, DE 19801, United States, or any of the offices listed on our homepage
Before answering a request, we may ask you to confirm your identity so we don't disclose data to the wrong person.
3. Our role: controller and processor
We process personal data in two different roles:
- As a controller for data about visitors to our website, people who contact us, and our customers' business contacts. We decide why and how this data is used.
- As a processor for data about our customers' end users (the people who receive OTP codes). When a business uses otpbase to send you a code, that business is the controller. We process your phone number or email address only on its instructions, under a data processing agreement, to deliver and verify the code.
Received a code from an app or service? That company decides how your data is used. Its own privacy policy applies, and it should be your first contact for requests about your data. If you contact us instead, we will pass your request on to them and help them respond.
4. What personal data we process
Website visitors
Technical data sent automatically by your browser: IP address, browser type, device type, pages requested, the referring page, and the date and time of the request. Our website does not use analytics or advertising trackers, and our fonts are served from our own domain.
People who contact us
Your name, email address, company, job title, and anything you include in your message or later correspondence.
Customers and their representatives
Names and business contact details of account holders and their staff, account and login data, API usage records, billing details, invoices and payment information, and communications with us.
End users of our customers (processed on their behalf)
- The phone number or email address a code is sent to
- The one-time code itself, stored only in protected (hashed) form until it expires or is used
- Delivery and verification records: time sent, channel, delivery status, number of attempts, and the country and network of the phone number
- Technical data our customer chooses to send with a request, such as an IP address or device identifier, for fraud prevention
We do not ask for, and ask our customers not to send us, special categories of personal data (such as health or biometric data).
5. Purposes and legal bases
We only process personal data where we have a legal basis under Article 6 GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Running a secure, working website, and preventing abuse and attacks | Website technical data | Legitimate interests (Art. 6(1)(f)): keeping our site available and secure |
| Replying to your enquiries | Contact data, messages | Legitimate interests (Art. 6(1)(f)), or steps taken at your request before a contract (Art. 6(1)(b)) |
| Setting up and managing customer accounts and providing the service | Customer and representative data, usage records | Performance of a contract (Art. 6(1)(b)) |
| Billing, accounting and tax records | Billing and payment data, usage records | Legal obligation (Art. 6(1)(c)) |
| Sending and verifying OTP codes | End-user data | Processed on our customer's instructions (Art. 28). The customer, as controller, is responsible for the legal basis. |
| Fraud prevention, rate limiting and protecting telecom networks | Delivery records, technical data | Legitimate interests (Art. 6(1)(f)): stopping SMS fraud and misuse of the service |
| Sending product and service updates to business contacts | Business contact data | Legitimate interests (Art. 6(1)(f)), or consent where the law requires it (Art. 6(1)(a)). You can opt out at any time. |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Any relevant data | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. You can ask us for more detail and object at any time (see section 11).
6. How long we keep personal data
We keep personal data only as long as we need it for the purposes above:
| Data | Retention period |
|---|---|
| One-time codes | Deleted when used or when they expire, usually within minutes |
| OTP delivery and verification records | 12 months, unless the customer's agreement sets a shorter period |
| Website server and security logs | Up to 30 days |
| Enquiries from people who don't become customers | Up to 2 years after our last contact |
| Customer account data | For the length of the contract, then up to 3 years to handle claims |
| Invoices and accounting records | As long as tax and accounting law requires, usually 5 to 10 years |
When a retention period ends, we delete the data or anonymise it so it can no longer identify you.
7. Who we share personal data with
We do not sell personal data. Only staff who need it for their work can access it, and they are bound by confidentiality. We share data only with:
- Hosting and infrastructure providers: Cloudflare, Inc. hosts our website and protects it from attacks, and also routes our email.
- Messaging partners: SMS aggregators, mobile network operators and email delivery providers that carry codes to the recipient. Delivering a message requires passing on the phone number or email address and the message content.
- Business tools: email, accounting, invoicing and payment providers that support our operations.
- Professional advisers: lawyers, auditors and accountants, under a duty of confidentiality.
- Authorities: courts, regulators and law enforcement, when the law requires it.
- A buyer or successor if our business is reorganised, merged or sold, under the same protections described in this policy.
Service providers acting for us (processors) are bound by written agreements under Article 28 GDPR. These agreements allow them to use the data only on our instructions and require them to keep it secure. A current list of our sub-processors is available on request.
8. International transfers
We have offices in Egypt, Saudi Arabia, Malaysia and Indonesia, and some of our providers work outside the European Economic Area (EEA). Codes are often delivered through networks in the recipient's own country. Personal data may therefore be transferred to countries outside the EEA and the UK.
When we transfer personal data out of the EEA or UK, we protect it with one of the following:
- an adequacy decision by the European Commission (or the UK government)
- the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with extra safeguards where needed
- certification under the EU-U.S. Data Privacy Framework
- where none of these is available, a derogation under Article 49 GDPR, for example where the transfer is necessary to deliver a message the recipient asked for
You can ask us for a copy of the safeguards that apply to your data.
9. How we protect personal data
We use technical and organisational measures that fit the risk, including:
- encryption of data in transit (TLS) and protected storage of data at rest
- storing one-time codes only in hashed form and expiring them automatically
- role-based access control, the least access each person needs, and multi-factor authentication for staff
- rate limiting and monitoring to detect abuse
- checking our suppliers before we use them, and binding them to data protection agreements
If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours where Article 33 GDPR requires it. Where there is a high risk to you, we will also tell you without undue delay. When we act as a processor, we notify the affected customer without undue delay.
11. Your rights
Under the GDPR you have the right to:
- Access: get confirmation of whether we process your data, and a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted when we no longer have a valid reason to keep it.
- Restriction: ask us to limit how we use your data, for example while we check a complaint.
- Data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another provider, where processing is based on consent or a contract.
- Objection: object to processing based on legitimate interests. You can object to direct marketing at any time, and we will then stop.
- Withdrawal of consent: where we rely on consent, withdraw it at any time. This does not affect processing that already took place.
- Complaint: lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work, or where the alleged infringement took place. In the UK, this is the Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first.
12. How to make a request
Email privacy@otpbase.net with your name, the email address or phone number your request is about, and which right you want to use. You can also ask someone to make the request on your behalf, with your written authorisation.
- We respond within one month of receiving your request. For complex or numerous requests, we may extend this by up to two more months. If we do, we will tell you within the first month and explain why.
- Requests are free. If a request is clearly unfounded or excessive, for example repetitive, we may charge a reasonable fee or decline it, and we will explain why.
- We may ask for information to confirm your identity before acting on a request.
- If the request concerns data we process for one of our customers (see section 3), we will forward it to that customer and help them respond.
13. Automated decision-making
We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.
To protect the service, we use automated rate limiting and fraud checks. These can temporarily block code delivery to a phone number or email address, for example after too many requests. If you think you have been blocked by mistake, contact the service you were using or write to us, and a person will review it.
14. Children
Our website and services are aimed at businesses and are not directed at children under 16. We do not knowingly collect personal data from children through our website.
15. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last changed. If we make significant changes, we will tell our customers directly before they take effect.
Questions? Write to privacy@otpbase.net.