Privacy Policy

SMSRay is a product of Lacspace Corporation Pvt. Ltd. ("Lacspace", "we", "us" or "our"), a company registered in India (CIN U46511DL2025PTC079972, RoC-Delhi) and registered in Nepal (Reg. No. 377566/82/83, PAN 622468837).

This Privacy Policy explains how we process personal data when you visit smsray.com, use the portal at app.smsray.com or send messages through the SMSRay API (the "Service"). It works alongside our Terms of Service, Cookie Policy and Data Processing Addendum.

If you received a message sent through SMSRay and have a question about it, please contact the business that sent it. We can help direct your request where appropriate.

When you use the OTP endpoints, SMSRay generates a 6-digit code and sends it to the recipient. We store only a SHA-256 hash of the code, never the code itself, so it cannot be read back from our database.

The text of OTP messages is hidden in message logs and in the dashboard, where it appears as "(OTP hidden)".

A code expires after 5 minutes and allows a limited number of verification attempts. We apply per-number and, where you supply it, per-IP limits to prevent abuse.

We rely on performance of our contract with you, our legitimate interests in running a secure and reliable service, compliance with legal obligations and, where required, consent.

We do not sell personal data, and we do not use your message content or recipient data for advertising or to build profiles of recipients.

We share personal data only as needed to provide the Service:

• with mobile network operators in Nepal, which transmit SMS messages to recipients as part of sending them;
• with service providers who host and operate parts of our infrastructure (cloud hosting, database and email delivery for sign-in codes), under contracts that require them to protect the data;
• with Lacspace affiliates that help operate the Service;
• with authorities where required by law or to protect rights, safety and the integrity of the Service;
• in connection with a merger, acquisition or sale of assets, subject to this Policy.

We protect data with measures appropriate to the risk, including encryption in transit, API keys and refresh tokens stored only as hashes, OTP codes stored only as hashes, short-lived access tokens, httpOnly session cookies in the portal, role-based access within workspaces, an audit log of portal changes and signed webhooks.

No system is perfectly secure. If you believe you have found a security issue, contact security@lacspace.com.

Lacspace operates across more than one country, and our service providers may process data in other countries. Where we transfer personal data across borders, we take steps to ensure it remains protected in line with this Policy and applicable law.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where we rely on it.

To exercise these rights for data where Lacspace is controller, write to privacy@lacspace.com. We may need to verify your identity before acting.

If you are a recipient of messages sent by one of our customers, please contact that business first, since it controls your data. If you contact us, we will forward your request to the customer where we can identify it.

You can also complain to a data protection authority in your country.

The portal and API are for businesses and are not directed to children. We do not knowingly collect personal data from children for our own purposes.

We may update this Policy. The version and effective date at the top show when it last changed. For material changes we will give notice in the portal or by email.

Privacy questions and rights requests: privacy@lacspace.com.

Complaints and grievances, including under India's data protection and IT laws: grievance@lacspace.com. We aim to acknowledge grievances promptly and resolve them within the time required by law.