Avis de confidentialité
This notice explains what personal data otp.rip ("we") collects when you use otp.rip, why we collect it, and what rights you have. We are the data controller for that data.
We collect deliberately little. Creating an account needs an email address and a password — no name, no phone number, no address, no identity documents.
1. What we collect
| Data | Why | Basis |
|---|---|---|
| Email address | Account identity, password reset, service notices | Contract |
| Password (hashed with Argon2id — never stored in readable form) | Authentication | Contract |
| IP address and approximate access times | Security, fraud and abuse prevention, rate limiting | Legitimate interests |
| Order records: service, country, number or mailbox address issued, price, timestamps | Providing the service, billing, disputes | Contract |
| Verification codes and message text received on a number you purchased | Delivering to you the thing you bought | Contract |
| Emails received on a mailbox you purchased: sender, subject, content, and the code or link found in it | Delivering to you the thing you bought | Contract |
| Payment records: amount, time, processor reference | Crediting your balance, accounting | Contract / legal obligation |
| Support tickets and messages you send us | Answering you | Contract / legitimate interests |
What we do not collect
- We do not ask for your real name, home address, date of birth or identity documents.
- We do not receive or store your card details or crypto wallet keys. Payments are handled entirely by our payment processor.
- We do not use advertising trackers, analytics pixels or third-party marketing cookies. The site loads no scripts, fonts or images from any external domain.
2. Message content
To deliver what you bought, we necessarily receive the content of messages sent to a number or mailbox you have purchased, and store it against your order so you can read it. We do not read this content for any other purpose, do not sell or share it, and do not use it for profiling.
You should assume that anything sent to a temporary number or mailbox is not private and not secure. Do not use these numbers for anything sensitive, for account recovery on an account that matters to you, or for anything you would be harmed by losing access to.
3. How long we keep it
| Data | Retention |
|---|---|
| SMS content and codes | 90 days from receipt, then deleted automatically |
| Email content, subject and codes | 7 days after the mailbox closes, then deleted automatically; the remaining record (sender and time) after 30 days |
| Order records (without message content) | Up to 6 years, for accounting and dispute resolution |
| Payment and transaction records | As required by tax and accounting law, typically 6 years |
| Security and access logs | 12 months |
| Account data | Until you close your account, or after 365 days with no sign-in, whichever comes first. We email you 30 days beforehand. Your sign-in details, API tokens and recovery codes are then erased; records we are required to keep, above, are retained against an anonymised account |
| Support tickets | 24 months after closure |
4. Who we share with
We share the minimum necessary with:
- Telecom and email networks — to connect a number or mailbox and receive the messages sent to it. They receive only the service (and, for SMS, the country) requested, never your identity or contact details.
- Our payment processor — to take deposits. They receive the amount and a reference; we receive confirmation, not your payment credentials.
- Our email provider — to send the small number of transactional emails described in section 6.
- Our hosting provider — which stores the data on our behalf.
- Authorities — where we are legally required to, or where necessary to establish, exercise or defend legal claims.
We do not sell personal data, and we do not share it for anyone else's marketing.
5. International transfers
Our providers may process data outside Moldova. Where they do, transfers are made under appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.
6. Email we send
We send transactional email only: password resets, email address checks, a welcome message, notices about your account's safety or closure, and — unless you switch them off under Account → Notifications — payment receipts, failed orders that were refunded, support replies and affiliate payouts. We do not send marketing email and there is no mailing list to unsubscribe from.
7. Cookies
We set one essential cookie to keep you signed in, plus a preference cookie for your chosen language and, if you arrive through a referral link, a cookie recording that referral. When you sign in we also set a random device identifier, used only to detect accounts being operated together for fraud — it is not a fingerprint, it is not shared, and clearing your cookies ends it. We use no analytics or advertising cookies. See the Cookie Policy.
8. Security
- All traffic is encrypted in transit with TLS.
- Passwords are hashed with Argon2id and are not recoverable by us.
- Access to production systems is restricted and key-based.
- Balance and order operations are transactional and audited.
No system is perfectly secure. If a breach affects your rights we will notify the relevant supervisory authority and, where required, you.
9. Your rights
Depending on where you live you may have rights to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; and withdraw consent where processing relies on consent.
To exercise any of these, email support (at) otp.rip from the address on your account. We respond within one month. If you are in the UK or EEA and are unhappy with our response, you may complain to your local supervisory authority.
If you are a California resident, you may request disclosure or deletion of personal information and are entitled not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
10. Children
The Service is only for adults — at least 18, or the age of majority where they live if that is higher (see the Terms, clause 2). We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes
We will post any updated version here with a new effective date, and give notice of material changes.
12. Contact
Des questions sur ce document ? support (at) otp.rip