Introduction
SMSERP ("we", "our", "us") operates the SMS ERP platform (the "Service"). This Privacy Policy describes how we collect, use, store, share, and protect your information when you use our Service.
By using the Service, you consent to the data practices described in this policy. If you do not agree with any part of this policy, please discontinue use of the Service.
This policy applies to all users, including business owners, admins, staff members, and any end-users whose data is stored in the system by a business account holder.
Information We Collect
We collect several types of information to provide and improve the Service:
2.1 Information You Provide
- Account Data: Name, email, phone, password, company name, business type.
- Business Data: Information you enter into the system (students, customers, invoices, products, staff, financial records, etc.).
- Payment Data: Billing address, payment method details (processed by secure third-party payment gateways).
- Communications: Any messages, feedback, or support tickets you send us.
2.2 Information Collected Automatically
- Usage Data: IP address, browser type, device info, pages visited, time spent, actions performed.
- Log Data: Access logs, error logs, audit logs for security purposes.
- Cookies: Session cookies, preference cookies, and analytics cookies (see Section 8).
2.3 Information from Third Parties
- Authentication providers (if you sign up via Google, etc.).
- Payment processors (to confirm transaction status).
- Analytics providers (aggregated, anonymized data).
How We Use Your Data
We use the information we collect for the following purposes:
| Purpose | Data Used |
|---|---|
| Provide the Service | Account data, business data |
| Process payments | Payment data, billing info |
| Customer support | Account data, communications |
| Security & fraud prevention | Usage data, log data, IP address |
| Improve the Service | Aggregated usage data, feedback |
| Send notifications & updates | Email, phone (with consent) |
| Legal compliance | Any data required by law |
We never sell your personal data to third parties for marketing or advertising purposes. Your business data belongs to you — always.
Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Contractual Necessity: To fulfill our agreement with you (providing the Service).
- Legitimate Interests: To improve our Service, ensure security, and prevent fraud.
- Consent: For marketing communications (you may withdraw consent at any time).
- Legal Obligation: To comply with applicable laws, regulations, or court orders.
Data Sharing & Disclosure
We do not sell your data. However, we may share data with trusted third parties in the following circumstances:
- Service Providers: Hosting providers, cloud storage, email delivery, payment gateways — bound by strict data processing agreements.
- Legal Requirements: When required by law, subpoena, or to protect our rights, property, or safety.
- Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. You will be notified.
- With Your Consent: Any other sharing will be done only with your explicit permission.
Business Account Owner Responsibility: If you are a business owner, you are responsible for obtaining consent from your students, staff, customers, or other individuals whose data you enter into the system.
Data Security
We implement industry-standard security measures to protect your data:
- Encryption in Transit: All data transmitted via HTTPS/TLS encryption.
- Encryption at Rest: Sensitive data stored using AES-256 encryption.
- Access Controls: Role-based access, multi-factor authentication.
- Regular Audits: Security audits, penetration testing, vulnerability scans.
- Monitoring: 24/7 monitoring for suspicious activity.
- Backups: Regular encrypted backups stored in geographically separate locations.
No Guarantee: While we take every reasonable precaution, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.
Data Retention
We retain your data for as long as your account is active and as needed to provide the Service. Specific retention periods:
| Data Type | Retention Period |
|---|---|
| Active account data | While account is active |
| After account cancellation | 30 days (for data export) |
| Backups | Up to 90 days |
| Financial records | As required by law (typically 7 years) |
| Audit logs | 12 months |
| Support tickets | 3 years |
After the retention period, your data is either anonymized for analytics or permanently deleted from our systems and backups.
Cookies & Tracking
We use cookies and similar tracking technologies to enhance your experience:
- Essential Cookies: Required for login, session management, and security. Cannot be disabled.
- Preference Cookies: Remember your settings (language, theme, dashboard layout).
- Analytics Cookies: Help us understand how users interact with the Service (e.g., Google Analytics).
- Performance Cookies: Monitor load times and detect errors.
You can control cookies through your browser settings. However, disabling essential cookies may prevent you from using certain features of the Service.
We do not use third-party advertising cookies or trackers for targeted ads. Our analytics are for internal improvement only.
Your Data Rights
Depending on your location, you may have the following rights regarding your personal data:
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectify
Correct inaccurate or incomplete personal data.
Right to Erase
Request deletion of your personal data (with limitations).
Right to Restrict
Limit how we process your personal data.
Right to Portability
Receive your data in a portable, machine-readable format.
Right to Object
Object to processing based on legitimate interests.
To exercise any of these rights, contact us on WhatsApp at +923160442966. We respond to all requests within 30 days.
Children's Privacy
Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you are under 18, please do not use the Service.
However, business account holders (such as schools) may enter data about minors (e.g., students under 18) into the system. In such cases:
- The business is responsible for obtaining proper parental/guardian consent.
- We process such data solely to provide the Service.
- We implement additional safeguards for data of minors.
If you believe we have inadvertently collected data from a child without proper consent, please contact us immediately so we can take appropriate action.
International Data Transfers
Your data may be transferred to and processed in countries other than your own, including countries where our servers or service providers are located. When we transfer data internationally, we ensure appropriate safeguards are in place:
- Standard contractual clauses approved by relevant authorities.
- Verification that the recipient country provides adequate data protection.
- Data processing agreements with all third-party providers.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page.
- Notify you via email and/or in-app notification at least 30 days in advance.
- Provide a summary of the key changes.
Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you disagree with the changes, you may close your account and stop using the Service.
Contact Our Data Protection Officer
If you have any questions, concerns, or complaints about this Privacy Policy, or wish to exercise your data rights, please contact our Data Protection Officer (DPO):
We're Here to Help
Our Data Protection team responds to all privacy-related inquiries within 30 days.