Privacy Policy

1. At a glance

• This policy explains what personal information SMSGELY collects, why we use it, who we share it with, how long we keep it and the choices you have.
• We collect what we need to run your account, verify identity for masking and Sender IDs, confirm manual payments, deliver your SMS and keep the platform safe.
• For the recipient numbers and message content you send through SMSGELY, you decide who is messaged and what is said. We process that information on your instructions.
• We do not sell personal information. We share it only with providers that help us run and deliver the service (including SMS providers and mobile operators), with professional advisers, and with authorities when the law requires.
• Our systems are hosted outside Bangladesh, including in Singapore.
• You can view, correct and request deletion of your information from your dashboard or through Support. Some records must be kept for legal, financial, security or regulatory reasons.

2. Who we are and what this policy covers

SMSGELY is a business SMS platform operated by Naimur SMS BD under the SMSGELY brand ("SMSGELY", "we", "us" or "our").

This policy applies when you:

• visit our website;
• create or use an account, the dashboard or the SMS API;
• recharge your wallet, receive invoices or request a Sender ID;
• complete identity verification (KYC);
• contact Support, or submit an abuse report about a message sent through SMSGELY.

Our role

For information about our customers and their use of the service, such as account, verification, billing, support and security records, SMSGELY decides how and why the information is used.

For the contacts, recipient numbers and message content that customers upload or send, SMSGELY acts on the customer's instructions in order to provide the service. The customer decides who receives messages and what they say, and is responsible for that information (see section 7).

This policy does not cover other companies' websites or services, even if we link to them.

3. Information we collect

Account information

• Full name, email address, Bangladesh mobile number (+880), address and, optionally, company name.
• Your password, which we store only as a one-way hash. We cannot read it.
• Your language preference and notification preferences.

Verification information

• Email verification codes (OTP). We store them only in hashed form, and they expire.
• For KYC: a profile photo and images of the front and back of your National ID (NID) card.
• Business documents, such as a trade licence, and authorization letters or other proof supporting a Sender ID request.
• The review status of your documents and notes made by our staff during review.

Our KYC & Verification Policy explains this in detail.

Sender ID information

• The sender names you request, the business or brand they represent, supporting documents and our review decisions.

Payment and billing information

Wallet recharges are made manually through bKash or Nagad. We record:

• the amount, the payment method and the Transaction ID you provide;
• the status of each recharge and our staff review of it;
• wallet ledger entries (credits, charges and refunds) and the invoices we issue.

We do not collect card numbers. We will never ask for your bKash, Nagad or Rocket PIN or OTP. Do not share them with anyone who claims to represent SMSGELY.

Messaging information

• SMS content, recipient numbers, Sender ID, send or schedule time, number of message parts, cost and campaign details.
• Delivery reports and status updates returned by SMS providers and mobile operators.
• Contacts, groups and templates you upload or create, including any custom fields you add.
• Campaign consent confirmations you give before sending (for example, confirming that recipients agreed to receive your messages).

API and integration information

• API keys. The full key is shown to you only once; we store it only in hashed form.
• API request logs, including IP address, request path, response status and time.
• Webhook addresses you configure and records of our delivery attempts.

Support and abuse reports

• Support tickets, your messages, attachments and our replies.
• Abuse reports. When someone reports a message sent through SMSGELY, we collect the name, mobile number and email address they give us and any evidence they provide, such as screenshots. These reports may also contain information about the customer who sent the message.

Technical, security and audit information

• IP address, browser user agent and session information, such as sign-in time.
• Security events, such as sign-ins, failed sign-in attempts, password changes and API key creation or revocation.
• Audit logs of significant actions by customers and staff. Audit logs are append-only: entries cannot be edited.
• Information used by CAPTCHA and rate limits to stop automated abuse.

Policy acceptance records

When you accept our Terms, this Privacy Policy or other policies, we record which document and version you accepted, the time, the language, your IP address and your user agent. This lets us show what you agreed to and when.

Risk and compliance signals

To protect message recipients and the platform, our systems create internal signals, such as the results of content and link checks, unusual sending patterns and account risk levels. These signals are used by our systems and staff and are not published.

4. How we collect information

• From you, when you register, complete your profile, submit documents, request a Sender ID, recharge your wallet, send messages or contact us.
• Automatically, when you use the website, dashboard or API (for example, logs and security events).
• From our customers, who upload contacts and send messages through SMSGELY.
• From SMS providers and mobile operators, which return delivery reports.
• From people who contact us, for example by submitting an abuse report.

5. How we use information

We use personal information to:

• Provide the service: create and manage your account, send your messages, show delivery reports, handle Sender ID requests and run your wallet.
• Verify identity and authorization: review KYC documents for masking, check that you may use a requested Sender ID, and require proof of authorization for protected brands.
• Handle billing: confirm manual recharges, keep the wallet ledger and issue invoices.
• Keep the platform safe: run content and link checks, monitor risk, apply rate limits and CAPTCHA, prevent fraud, spam and phishing, investigate abuse reports, and restrict or suspend accounts where needed.
• Provide support: answer tickets and enquiries.
• Meet legal and regulatory obligations: keep required records, meet telecom-provider requirements and respond to lawful requests.
• Send service emails: verification codes, recharge and billing notices, security alerts and notices of policy changes. We send marketing emails only with your consent, and you can withdraw it at any time.
• Improve the service: use technical and aggregated information to fix problems and improve features.

Automated checks

Some security and abuse controls are automated. For example, a content or link check may hold a campaign for staff review or block a message, and rate limits may slow or stop unusual traffic. If you think an automated check affected you wrongly, contact Support and a member of staff will review it.

6. Lawful basis

We process personal information on one or more of the following bases, as provided by applicable law, including the Personal Data Protection Act 2026 where it applies:

• Contract: to provide the service you signed up for under our Terms, and to take steps you ask for before signing up.
• Legal obligation: to keep financial records, meet regulatory and telecom requirements and respond to lawful requests.
• Protecting the service and others: to prevent fraud, spam and abuse, keep accounts and recipients safe and improve the service, where this does not override your rights.
• Consent: for example, for marketing emails and, where required, for identity documents. You can withdraw consent at any time. Withdrawal does not affect earlier processing, but it may mean we cannot provide features that depend on it, such as masking.

7. SMS content and recipient numbers

Customers use SMSGELY to send their own messages to their own recipients. The customer, not SMSGELY, is responsible for:

• the recipient list and how it was obtained;
• having any consent required to message each recipient, and honouring opt-outs;
• the content of each message and the Sender ID used;
• complying with marketing, telecom and data-protection laws.

We process this information only to provide the service: we store it, pass it to SMS providers and mobile operators for delivery, show it in your reports, run automated content and link checks, and review campaigns that are flagged. We may keep numbers that opted out or were reported for abuse on a suppression list so that they are not messaged again.

If you received a message through SMSGELY

The message was sent by one of our business customers. To stop messages or ask about your information, please contact the sender first. If you cannot reach the sender, or you believe a message is spam, fraud or phishing, report it on our Report abuse page. Our Abuse Reporting Policy explains what happens next.

8. Who we share information with

We do not sell personal information. We share it only where needed, with:

• SMS providers, aggregators and mobile operators: recipient numbers, Sender ID and message content, which they need to deliver messages. Sender ID details may also be shared with them when they are needed to register or approve a Sender ID.
• Hosting providers: our application is hosted on Vercel, and our PostgreSQL database is hosted on Neon in the AWS ap-southeast-1 region (Singapore).
• Our email delivery provider: which sends verification codes, notifications and support emails for us.
• Professional advisers: such as lawyers, accountants and auditors, who are bound by confidentiality.
• Authorities: law enforcement, regulators, courts or other public bodies when we are legally required to share information. See our Legal Requests Policy.

We share only the information each recipient needs for its role.

9. International transfers

Our application and database are hosted outside Bangladesh, including in Singapore, and our email and SMS providers may process information in other locations. This means your personal information is transferred to, and processed in, other countries.

We choose established providers, encrypt information in transit, limit who can access it and share only what each provider needs.

10. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, including legal, financial, security and regulatory purposes. Our current default periods are:

Our staff can change these periods. A legal hold can pause deletion, for example when we must preserve information for an investigation or legal claim.

When information is no longer needed, we delete or anonymise it. Deleted information may remain for a limited time in backups kept by our hosting providers before it is overwritten.

11. How we protect information

We use technical and organisational measures appropriate to the risk, including:

• HTTPS encryption for information in transit;
• passwords hashed with Argon2; OTPs and API keys stored only in hashed form;
• encryption of sensitive stored values, such as provider credentials;
• HttpOnly, secure session cookies;
• role-based staff access on a least-privilege basis, with a separate permission for viewing identity documents;
• append-only audit logs;
• rate limiting and CAPTCHA;
• private storage for identity and business documents, with no public links.

No system is completely secure, and we cannot guarantee the security of information. You can help by using a strong, unique password and keeping your API keys secret. Our Security & Responsible Disclosure page has more detail.

12. Your rights

As provided by applicable law, including the Personal Data Protection Act 2026 where it applies, you may be able to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• request deletion of your information (see section 13);
• withdraw consent where we rely on it, including for marketing emails;
• object to certain processing; and
• complain about how we handle your information.

How to use your rights

• Many details can be viewed and corrected directly in your dashboard, for example on your profile page.
• Deletion requests are made in Dashboard → Account & data.
• For anything else, contact Support from your dashboard, or use the privacy or support contact shown on this page or our Contact page.

We may need to confirm your identity before acting on a request. We respond within the time required by applicable law. Sometimes we may be unable to fully meet a request, for example where the law requires us to keep a record; if so, we will explain why.

If you are a recipient of messages sent by one of our customers, please contact that customer first, as they decide how your information is used. We will help where we can.

Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the relevant authority when a complaint mechanism under applicable law is in force.

13. Account and document deletion

You can request deletion of your account in Dashboard → Account & data. Each request shows one of these statuses:

• Requested: we have received your request.
• Under review: we are checking for outstanding balances, open investigations, legal holds or records we must keep.
• Approved: deletion will go ahead.
• Partially deleted: some information has been deleted and some must be kept.
• Completed: deletion is finished.
• Retained for legal reason: we cannot delete some or all information yet, because of a legal, financial, security or regulatory requirement.

What we delete

We delete or anonymise your profile, contacts, groups, templates, API keys, webhooks and identity documents.

What we may keep

Some records may need to be retained for legal, financial, security or regulatory purposes. These include billing records (payments, invoices and the wallet ledger), message and delivery records, audit logs, policy acceptance records and campaign consent records. We keep them only as long as required and protect them while we hold them.

Rejected or replaced KYC documents are deleted automatically after the period shown in section 10, even if you do not ask.

14. Data breach response

If we become aware of a security incident affecting personal information, we will:

• investigate what happened and contain it;
• take steps to limit harm and prevent it happening again;
• notify affected customers and the relevant authorities as required by applicable law; and
• keep a record of the incident and our response.

15. Legal requests

We may disclose information to law enforcement, regulators or courts when we are legally required to do so. We review each request, and disclose only what the law requires. Our Legal Requests Policy explains how we handle these requests.

16. Children

SMSGELY is a service for businesses and organisations, and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account or given us information, contact us and we will take appropriate action.

17. Cookies

We use a small number of essential and functional cookies, and we store your theme preference in your browser. We do not currently use analytics, advertising or tracking cookies. See our Cookie Policy for details.

18. Changes to this policy

We may update this policy when our service, providers or the law change. Each version has a version number and an effective date, shown on this page. When we make material changes, we will tell account holders by email or in the dashboard, and we may ask you to accept the new version before you continue to use the service.

This policy is published in English and Bangla. If the two versions conflict, the version designated by SMSGELY after legal review applies.

19. Important notice

SMSGELY provides messaging infrastructure and related technology services. Customers remain responsible for message content, recipient lists, recipient consent, sender identity and authorization, campaign legality, applicable marketing, telecom and data-protection obligations, and all applicable laws.

SMSGELY does not authorize unlawful use of its service. SMSGELY operates subject to applicable laws, regulations, telecom-provider requirements and contractual restrictions.

20. Contact us

For privacy questions, or to use your rights, contact us using the privacy or support contact shown on this page or on our Contact page. If you have an account, you can also open a ticket with Support from your dashboard.