Privacy policy

BBNSMS.com is operated by Browser Based Nigeria Limited (BBN), RC 803010, a company based in Lagos, Nigeria. This policy describes the information we collect when you use the site and the API, why we collect it, and how long we keep it. It is written for the product as it ships today: accounts, a prepaid wallet, OTP activations and dedicated US and Canada numbers.

Who is responsible

Browser Based Nigeria Limited (RC 803010) is the controller of personal data processed through bbnsms.com. The registered office is Plot 12 Road 6, Lekki County Homes, Ikota Villa Estate, Lekki, Lagos, Nigeria. The US office and mailing address is 10000 North Central Freeway, Suite 400, Dallas, TX 75231. Questions about this policy, a copy of your data, or a deletion request go to [email protected].

What we collect

• Account. Email address and a password. The password is stored as an Argon2id hash; we cannot read it back.
• Wallet and payments. Top-up amounts, method, status, and the Stripe payment reference. Card numbers are entered on Stripe’s hosted Checkout page and are not sent to our servers.
• Orders. OTP activations (country, service, number assigned, SMS code when delivered, settlement) and dedicated numbers (E.164, country, type, inbound SMS bodies).
• Session and security. Access and refresh tokens, cookies required to keep you signed in, IP address used for rate limiting, and standard request logs.

We do not ask for a government ID, a billing address, or a phone number of your own in order to open an account.

Why we use it

To create and secure your account, to quote and fulfil orders, to credit and debit the wallet, to detect abuse, and to answer support mail. We do not sell personal data and we do not run advertising trackers on this site.

Processors

Four third parties can touch data connected to your account. Each one is named, with the region it processes in and the data it receives, on the Trust Center — that page is the current list, and we give 30 days’ notice before adding to it.

• Stripe (United States, European Union) — card top-ups. Their processing is governed by Stripe’s own terms and privacy policy.
• Platfone (supplier infrastructure) — OTP activations. We send the country, the service and the activation identifier, and nothing else.
• Telnyx (United States, Canada) — dedicated US and CA numbers. They receive the search filters needed to provision a line and carry the inbound messages sent to it.
• Hetzner (HEL1, Helsinki, Finland) — infrastructure. The application, PostgreSQL and Redis run on servers we operate in that region, and the logs stay there.

No supplier receives your email address or your wallet balance except Stripe, which needs the email to issue a receipt for a top-up.

International transfers

Your account data, the wallet ledger and the messages we store for you live on infrastructure in the EU/EEA — Hetzner’s HEL1 region in Helsinki, Finland. There is no second copy of the database elsewhere.

Two flows necessarily leave that region: card payments handled by Stripe, and the provisioning of US and Canada numbers by Telnyx, which happens in those countries. Where personal data is transferred out of the EEA or the United Kingdom to a country without an adequacy decision, the transfer is made under the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, with the UK International Data Transfer Addendum applied for UK transfers. The modules, options and annexes we rely on are set out in our data processing agreement, which also carries the Article 28 terms and applies to every account.

Retention

The wallet ledger is append-only by design: rows are not updated or deleted, because the balance is the sum of that history. Account records and order history are kept for as long as the account exists and for a reasonable period afterwards where we must retain them for billing disputes or legal obligation. You can ask us to close an account and we will stop using the email for anything other than that residual record.

Your rights

You can request a copy of the personal data we hold, ask us to correct it, or ask us to close the account. Write to [email protected]. We will need to verify that the request comes from the account holder.

If the GDPR or the UK GDPR applies to you, the same mailbox is the way to exercise every right you have under it — access, rectification, erasure, restriction, portability and objection. We acknowledge within two business days and answer substantively within one month, as Article 12(3) requires. Nigerian residents have the equivalent rights under the Nigeria Data Protection Act 2023, through the same address. You may also write to us at Plot 12 Road 6, Lekki County Homes, Ikota Villa Estate, Lekki, Lagos, Nigeria.

We have not appointed a representative in the European Union or the United Kingdom under Article 27, and we would rather say so than name one that does not exist — correspondence comes directly to the company. You retain the right to complain to your local supervisory authority.

Changes

If this policy changes in a material way we will update the date at the top of this page. Continuing to use the service after that date is acceptance of the revised policy.