Privacy Policy

SMSForwarding.com ("we", "us", "our") is a business-to-business (B2B) software platform and a product of Tulip Softwares. We provide a managed SMS gateway API service that enables developers and businesses to send and receive SMS messages through their registered Android devices — routed through our servers. Incoming SMS messages arrive at our infrastructure and are forwarded to the customer's configured webhook endpoint. Outgoing SMS messages are initiated by the customer's application via our REST API and delivered to end-users through the customer's registered Android device and SIM.

Our customers ("you") are businesses and developers who integrate our platform into their own products and services. This policy governs how we handle data related to your account, your use of our platform, and the Android gateway application ("SMS Forwarder App").

Parent company: Tulip Softwares (tulipsoftwares.com)
Registered address: Jorhat, Assam, India — 785001
Contact: [email protected]

We collect the following categories of data:

We use the data we collect exclusively to operate, maintain, and improve the SMSForwarding.com platform:

• Authenticating your account and securing access to the API and dashboard
• Registering and managing your Android gateway devices
• Routing outgoing SMS commands from your server to your Android device via FCM push or polling
• Forwarding incoming SMS from your Android device to your configured webhook endpoint
• Maintaining SMS delivery logs accessible in your dashboard
• Processing subscription payments and managing your billing cycle
• Sending transactional emails (account verification, password reset, billing receipts)
• Detecting and preventing abuse, fraud, or violations of our Terms of Service
• Providing technical support when you contact us
• Improving platform reliability, performance, and security

We do not use your SMS content for advertising, profiling, data mining, or any purpose beyond delivering the service you subscribed to.

As a B2B infrastructure platform, SMSForwarding.com acts as a data processor — not a data controller — for the SMS messages that pass through the system. You (our customer) are the data controller responsible for the message content you choose to process through our platform.

• SMS content is transmitted over TLS-encrypted connections at all times
• Messages are temporarily buffered in our infrastructure only as necessary for reliable delivery to your endpoint
• We do not read, analyse, index, or process message content for any purpose other than routing it to your configured endpoint
• Message metadata (sender, recipient, timestamp) is stored in your account log for the duration of your configured retention period (default: 30 days)
• Your webhook endpoint URL is under your full control — you are responsible for securing your webhook endpoint and validating incoming payloads
• If your webhook endpoint is unavailable, we retry delivery according to your configured retry policy before marking the message as failed

The SMS Forwarder Android app requests the following permissions. Each permission is used exclusively for the stated purpose and for no other reason:

We integrate with the following third-party services to deliver core platform functionality. Each third party operates under their own privacy policy:

We do not sell, rent, or share your personal data with any other third parties for marketing or advertising purposes.

• Account data (name, email, billing history) is retained for the lifetime of your active account and for 30 days after account deletion to allow for dispute resolution.
• SMS message logs are retained according to your configured log retention setting in the app (default: 30 days). You can clear logs at any time from the Settings screen.
• API request logs and IP access logs are retained for up to 90 days for security and abuse-prevention purposes.
• Device registration data (Android ID, phone number, FCM token) is deleted when you deregister your device or delete your account.
• After account deletion, all remaining personal data is permanently purged from our systems within 30 days.

We apply industry-standard security measures appropriate for a B2B API platform:

• All data in transit is encrypted using TLS 1.2 or higher
• Passwords are hashed using bcrypt — plaintext passwords are never stored
• API keys are hashed before storage and displayed only once at creation
• Access to production infrastructure is restricted to authorised personnel only
• Firebase Cloud Messaging tokens are rotated automatically by the Android app

You are responsible for:

• Securing your API keys and not exposing them in client-side code or public repositories
• Securing your webhook endpoint URL and validating incoming payloads
• Keeping the SMS Forwarder Android app updated to the latest version
• Ensuring your Android device is physically secure

If you discover a security vulnerability, please report it responsibly to [email protected].

As our customer, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about your account
• Rectification — request correction of inaccurate account data
• Deletion — request deletion of your account and all associated personal data
• Portability — request an export of your SMS logs and account data in machine-readable format
• Restriction — request that we restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Note that some data may need to be retained for legal, billing, or fraud-prevention purposes even after an account deletion request.

We may update this Privacy Policy from time to time to reflect changes in our platform, legal requirements, or industry standards. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to all registered account holders at least 14 days before the changes take effect
• Display a notice in the web dashboard

Continued use of the platform after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree with the revised policy, you may close your account before the effective date.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: