Skip to content

Data Processing Addendum

For business customers who need a written processor agreement. Last updated 2026-06-26

Plain-language summary

This addendum supplements our Terms and Privacy Policy. You (the customer) are the data controller of the recipient data you send through SMSKit; we are the data processor, acting only on your documented instructions.

This is scaffolding pending legal review, not legal advice. A counsel-reviewed, countersignable DPA is issued on request before launch.

1. Roles

SMSKit processes personal data (message content, recipient phone numbers, delivery metadata) solely to provide the service on your behalf. You are responsible for having a lawful basis and recipient consent for the messages you send.

2. Scope & purpose of processing

  • Subject matter: routing and delivery of SMS through phones and SIMs you supply.
  • Duration: for the term of your account, plus your plan's retention window.
  • Data categories: recipient numbers, message content, device telemetry, and account contact details. When you opt in on a phone, also the contacts you import: names, phone numbers, emails, addresses, organizations, websites, dates, notes, groups, photos and the account each contact is stored in.

Messages, jobs and received SMS follow your plan window: 1 day on Free and 30 days on Standard. Webhook delivery history and device logs are kept 30 days; phone heartbeats are kept 7 days. Contacts stay until you delete them or the account is deleted. A deleted record leaves backups and webhook delivery history within 30 days.

3. Security

Phone numbers and message content are masked in our operational logs. Secrets are held in a managed key vault.

4. Subprocessors

  • Paystack: billing.
  • Twilio Verify: recovery phone verification.
  • Firebase / FCM: push wake-ups to your phones.

5. Data subject rights & deletion

We assist you in responding to access, correction, and deletion requests. Owners can close an account from Settings, using Close account. Service stops immediately and the subscription stops renewing. We delete the account's data and the account 30 days after paid time ends, or 30 days after closure if no paid time remains. Signing in before the deletion date allows reactivation. After paid time ends, reactivation returns the account to Free with 1-day message history.

A Free account with no sign-in, dashboard use, phone heartbeat or API activity for more than 365 days gets a warning email. It is deleted 30 days after the email is accepted unless activity resumes. Any activity cancels the deletion. Paying accounts, including those in the payment grace period, are excluded. Moving to Free restarts the inactivity clock.

6. Requesting a signed DPA

To receive a countersignable copy, email support@uwapi.com with your legal entity name.