Legal
Privacy notice
What personal data Elmetry collects through this website, the client console and the API, why, who it goes to, how long we keep it, and the rights you have over it.
On this page
- Version
- 2026-11
- Effective
- 1 November 2026
Section 1
Who is responsible for your data
ECTELECO CARRIER MOBILE LIMITED is the controller of the personal data described in this notice, except where section 2 says we act as a processor.
- Controller
- ECTELECO CARRIER MOBILE LIMITED, trading as Elmetry
- Group
- A member of Elmsworth Communications Group plc (An Elmsworth company)
- Company registration
- Registered in England & Wales No. 17475876
- Registered office
- Tenace, 106-2 Regus Atterbury Lakes, Fairbourne Drive, Atterbury, Milton Keynes, Buckinghamshire MK10 9RG, United Kingdom
- Data protection contact
- [email protected]
- General enquiries
- [email protected]
We have not appointed a Data Protection Officer. For anything in this notice, contact our data protection lead at [email protected].
Section 2
The personal data we collect
We only collect what we need to run accounts, bill for the service, keep it secure and answer enquiries.
Data we hold as controller
- Account data: your email address, username, password (stored only as a one-way hash, never in readable form), display name, the company name on the account, and which version of this notice you have seen and when.
- Sign-in and security data: the time and IP address of your most recent sign-in, the time and IP address an API key was last used, and the email address and IP address behind each verification-code request.
- Google sign-in data, only if you sign in with Google or link a Google account: the account identifier Google gives us for you, the email address Google reports, the time you linked it, and whether it was linked when the account was created or later. We ask Google for nothing else — no name, photo, contacts or password — and never receive your Google password.
- Account activity: a log of actions taken in the console (for example creating or revoking an API key, changing a password or inviting a team member), with who did it and when.
- API and usage records: which checks and API calls the account made, when, and what each was charged.
- Billing and payment records: top-ups, charges, refunds and balances; card payment references from our payment processor (we never see or store full card numbers); for USDT payments, the deposit address, transaction ID and sending wallet address; and any bank-transfer receipt you upload.
- Website enquiries: the name, business email and company you enter on the contact form, plus the optional traffic type, monthly volume, destination markets and message.
- Device storage: the few items the website and console keep in your browser, listed in section 10.
Data we process for our customers
When a customer submits phone numbers, Sender IDs, landing URLs, message content or files through the console or the API, we process that data on the customer's behalf and on their instructions. For that data the customer is the controller and we are a processor under UK GDPR Article 28; the Data Processing Agreement in our contract governs it. If your number or message is in a customer's submission, contact that customer first. We will pass on any request that reaches us.
Section 3
Why we use it, and our lawful basis
UK GDPR Article 6 requires a lawful basis for each purpose. These are ours.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and run your account, sign you in, provide the console and API | Account data, API and usage records | Contract (Art. 6(1)(b)) |
| Send verification codes and service messages about your account | Email address | Contract (Art. 6(1)(b)) |
| Charge for usage, take payments, issue refunds | Usage records, billing and payment records | Contract (Art. 6(1)(b)) |
| Keep accounting and tax records | Billing and payment records | Legal obligation (Art. 6(1)(c)): Companies Act 2006 and HMRC record-keeping rules |
| Secure the service: rate-limit sign-ins and code requests, detect account takeover, fraud and abuse, investigate incidents | Sign-in and security data, account activity | Legitimate interests (Art. 6(1)(f)): keeping customer accounts and the platform secure |
| Answer website enquiries and follow up with prospective business customers | Website enquiries | Legitimate interests (Art. 6(1)(f)): responding to and developing B2B sales enquiries |
| Establish, exercise or defend legal claims | Any of the above, as relevant | Legitimate interests (Art. 6(1)(f)): protecting our legal position |
| Process customer-submitted numbers, Sender IDs, URLs and content | Customer submissions | The customer's basis, as their processor |
We do not rely on consent for any of the above, and we do not send marketing email to individuals without it. Where we rely on legitimate interests we have weighed them against your rights; you can ask us for that assessment and you can object (section 7). If you do not give us the account data we ask for, we cannot open or run an account for you.
Section 4
Who we share it with
We do not sell personal data. We share it only with the categories of recipient below. Service providers that process data on our behalf (hosting, email delivery) are bound by data processing terms to use it only on our instructions. Payment processors, the web-font service, professional advisers and our group companies may act as separate controllers under their own privacy notices and duties; public blockchains, authorities and any buyer are not acting on our behalf, and we share with them only what the payment itself, the law or the transaction requires.
- Cloud hosting and data-centre providers that run our servers, databases and storage.
- Our email delivery provider, which sends verification codes and account email.
- Payment processors, for example Stripe, which handle card payments on their own hosted checkout pages under their own privacy notices.
- Google, only if you choose to sign in with Google: you sign in on Google's own page, under Google's privacy policy, and Google tells us who you are (see section 2). We send Google nothing about you.
- The public blockchain network used for USDT payments. A transfer you make is recorded on a public ledger that anyone can read; this is a feature of the network, not a disclosure by us.
- The web-font service that delivers this website's typefaces. Your browser requests the fonts directly, so the service receives your IP address and browser details; it sets no cookies.
- Other companies in our group, where needed to provide the service or administer the contract.
- Professional advisers such as lawyers, accountants, auditors and insurers.
- Law enforcement, regulators, courts and other authorities, where the law requires it or to protect our rights and users.
- A buyer or successor, if our business or assets are sold or reorganised.
Section 5
International transfers
Our service runs in the United Kingdom. Some providers above may process data outside it.
When personal data leaves the UK we make sure one of the following applies: the destination is covered by UK adequacy regulations (including the UK–US Data Bridge for certified US organisations); or the transfer is made under the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment. You can ask us for a copy of the relevant safeguards at [email protected].
| Data | How long |
|---|---|
| Account data | For as long as the account exists. After the account is closed you can ask us to delete or anonymise it and we will do so within one month, except what must be kept as a billing record. |
| Most recent sign-in time and IP | Only the latest sign-in is kept; each new sign-in overwrites it. Kept and deleted together with the account data. |
| API key last-used time and IP | Only the latest use is kept; each use overwrites it. Kept and deleted together with the account data. |
| Email verification codes | Stored only as a keyed hash. A code expires 10 minutes after it is sent; the record (email address, IP address, time) is deleted 24 hours after it was created. |
| Console sign-in token (in your browser) | Expires 24 hours after sign-in; deleted from your browser when you sign out. |
| Google sign-in link to your account | Until you unlink Google on your account page, or until it is removed: because the account's password was reset, the account was disabled or removed from its project, at your request, or by our staff on their own initiative (for example if they suspect misuse). When a link is removed that way, we keep a record of it (the Google email address, the reason and the time) for 30 days, and your account page shows it during that time, with the Google email address partly hidden (for example a***@gmail.com), unless you link Google again first; after 30 days the record is deleted by a clean-up that runs every hour. The account activity log keeps a record of each link and unlink, including the full Google email address, for as long as the account exists. |
| A Google sign-in in progress | Starting a Google sign-in stores nothing. Once you come back from Google, we keep a one-way fingerprint of that sign-in so it cannot be used twice; it becomes deletable 15 minutes after you started, and a clean-up that runs every hour deletes it, normally within about 75 minutes of the start. If your Google email address has no console account yet, we also hold a pending sign-up while you name your company: the account identifier Google gives us for you, the email address Google reports, and whether an emailed code is needed. It is deleted as soon as the account is created, replaced if you start again with the same Google account, and otherwise expires 30 minutes after you came back from Google and is deleted by the same hourly clean-up, normally within about 90 minutes. |
| Account activity log | For as long as the account exists. |
| API and usage records | For as long as the account exists, then 6 years after the end of the financial year they relate to, as billing records. |
| Billing and payment records | For as long as the account exists, then 6 years after the end of the financial year they relate to (HMRC and Companies Act 2006). |
| Customer-submitted numbers, Sender IDs, URLs and content | As processor: for as long as the customer's account exists, unless the customer asks us to delete it sooner; deleted or returned at the end of the contract as the DPA requires. |
| Website enquiries | Kept until our sales team has dealt with the enquiry, and then for 24 months after it was marked as handled, so we can pick up the conversation if you come back to us; after that it is deleted by a clean-up that runs every hour. You can ask us to delete it sooner at any time. Your IP address is not stored with the enquiry: it is only held in memory, as a one-way fingerprint, for an hour, to limit repeated submissions. |
We may keep data longer where the law requires it, or where it is needed for an ongoing dispute or investigation, and only for as long as that lasts.
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate or incomplete data corrected. You can change your display name yourself on the console account page, and a project admin can change the company name there.
- Erasure: have your data deleted where there is no longer a reason to keep it. Billing records we must keep by law are the usual exception.
- Restriction: ask us to stop using your data, other than storing it, while a concern is resolved.
- Portability: receive data you gave us, under contract, in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent: where we rely on consent, withdraw it at any time without affecting what was done before.
To exercise any of these rights, email [email protected], or use the data-rights link on your account page in the console, which fills in your account details for you. There is no charge. We will reply within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why within the first month. We may ask you to confirm your identity before acting on a request.
If you are unhappy with how we handle your data, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
Section 9
Automated decision-making
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Our spam checks classify phone numbers, Sender IDs and landing URLs that customers submit, on their behalf. That is processing of the numbers and URLs themselves; it is not a decision about the person a number belongs to, and what a customer does with a result is their decision.
Security controls such as limits on sign-in attempts and verification-code requests can temporarily block repeated requests. They have no legal or similarly significant effect, and our support team can review any block.
The website, console and API are not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe someone under 18 has given us personal data, contact [email protected] and we will delete it.
- Version
- 2026-11
- Effective date
- 1 November 2026
We review this notice when our processing changes. If we make a material change we will tell account holders by email or with a notice in the console before it takes effect, and publish the new version here with a new version number.
Related documents
- Terms of Service
- 2026-11
- Acceptable Use Policy
- 2026-10
- Data Processing Agreement
- 2026-11
- Sub-processors
- 2026-10
- Complaints Procedure
- 2026-10
- Accessibility Statement
- 2026-10