Google Play Policy Compliant GDPR • CCPA • KVKK • PDPL TLS 1.3 In-Transit Encryption

Privacy Policy

Effective Date: November 4, 2026 • Application: VeloNum: Virtual Phone Number (com.velonum.virtualnumber) • Data Controller: support@velonumber.com • Website: https://velonumber.com

Important Privacy Guarantee

Important Privacy Guarantee: VeloNum does not request, collect, read, or process SMS messages or contacts stored on your physical mobile device. Specifically, VeloNum does NOT request or use the Android READ_SMS, RECEIVE_SMS, SEND_SMS, READ_CONTACTS, READ_PHONE_STATE, RECORD_AUDIO, or ACCESS_FINE_LOCATION permissions. All incoming verification codes shown in VeloNum are received on cloud-hosted virtual numbers provisioned by licensed telecommunications aggregators solely for temporary account verification.

Table of Contents

1. Scope & Data Controller 2. Categories of Data & Matrix 3. Permissions & Device SIM Clarification 4. Upstream Provider Anonymity 5. Ephemeral SMS Isolation & Retention 6. Lawful Basis, TLS 1.3 & Transfers 7. User Rights & Dual Deletion 8. Children's Privacy (Age 18+) 9. Policy Updates & Contact

1. Scope, Data Controller & Application Overview

This Privacy Policy governs the processing of personal data by VeloNum (full product title: VeloNum: Virtual Phone Number, application package identifier: com.velonum.virtualnumber, official website: https://velonumber.com). Our mission is to provide an anonymous, high-integrity privacy buffer that shields your real personal phone number from unsolicited marketing, data brokers, spam callers, and unnecessary data harvesting when registering for online platforms or conducting software quality assurance (QA) testing.

The designated Data Controller for VeloNum operations is reachable at support@velonumber.com. We comply with all applicable data protection regulations, including Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR), the UK Data Protection Act 2018 (UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Turkish Law on Protection of Personal Data No. 6698 (KVKK), and Gulf Cooperation Council Personal Data Protection Laws (Saudi Arabia PDPL and UAE Federal Decree-Law No. 45/2021).

2. Categories of Data We Collect & Purpose Matrix

In accordance with the principle of data minimization, VeloNum processes only the data strictly necessary to deliver temporary virtual numbers, maintain your in-app Coin balance, and protect the system against fraudulent billing abuse.

Data Category	Data Elements	Operational Purpose	Legal Basis	Retention Window
Guest Device Identifier	`device_uuid` (Random UUIDv4)	Frictionless guest onboarding; preserves in-app Coin Wallet ledger without requiring initial personal registration.	Contract (Art. 6(1)(b))	Until account deletion
Optional Google Sign-In	`email`, `name`, `google_id`	Voluntary multi-device synchronization and Coin purchase restoration. We never access your Google password or profile photo.	Consent & Contract	Until account deletion
Push Notification Token	`fcm_token` (Firebase Cloud Messaging)	Real-time background alerts delivered the moment an incoming OTP verification code arrives on your leased virtual number.	Contract & Consent	Purged on token rotate or deletion
In-App Purchase & Ledger	Google Play `GPA.` order ID, SKU, purchase token, Coin debit/credit ledger	Verifying digital Coin pack fulfillment via Google Play Billing / Apple StoreKit. We never collect, see, or store raw credit/debit card numbers or CVV codes.	Contract & Legal Obligation	Up to 7 years (Statutory tax compliance)
Temporary Virtual Number Logs	Assigned number, service code, country ISO2, status (`waiting_sms`, `completed`), and inbound SMS OTP string	Displaying verification codes during the active 15–20 minute window, managing automatic escrow refunds, and resolving dispute claims.	Contract & Legitimate Interests	30–90 days ephemeral purge
Technical & Locale Telemetry	IP address, client app version, platform, UI locale preference (`en` / `ar`)	DDoS mitigation, rate-limiting, anti-fraud velocity checks, and rendering localized bilingual application interfaces.	Legitimate Interests (Art. 6(1)(f))	Rolling 30–90 days (Logs)

3. Device Permissions & Physical SIM / SMS Clarification

VeloNum adheres strictly to Google Play's Developer Program Policies regarding User Data and Sensitive Device Permissions:

Zero Device SMS Access: VeloNum does NOT request, declare, or invoke READ_SMS or RECEIVE_SMS permissions. We cannot read, scan, or upload messages from your cellular SIM card or personal device inbox.
Zero Contact Book Access: We never request READ_CONTACTS or upload your address book.
Zero Sensor or Location Tracking: We never request GPS location, camera, or microphone permissions.
Cloud-Hosted Webhook & Polling Delivery: All incoming SMS verification codes originate from server-side telecommunications gateways and are transmitted to your authenticated device strictly over encrypted HTTPS connections using TLS 1.3.

4. Upstream Telecommunications Provider Anonymity & Third-Party Sub-Processors

Upstream Telecommunications Provider Anonymity

When you lease a virtual number in VeloNum, our backend transmits only the requested target service code (e.g. WhatsApp, Telegram) and the country code to our wholesale telecommunications aggregators (including Hero-SMS and Ozvinoo). We never transmit your name, email address, Google Account ID, IP address, or Device UUID to upstream number providers. Upstream aggregators see only an anonymous number allocation request originating from our secure cloud server infrastructure.

We work with a minimal set of enterprise sub-processors to power our application infrastructure:

Google LLC (Google Play Billing & Google Sign-In): Handles digital in-app token purchases and optional OAuth authentication.
Google LLC (Firebase Cloud Messaging): Routes encrypted push notification alerts to your device when an SMS verification code is received.
Telecommunications Routing Gateways: Wholesale mobile networks responsible for allocating temporary virtual numbers and forwarding inbound carrier SMS traffic.

Consumption Telemetry Sharing for Refund/Chargeback Verification: By using VeloNum, you provide explicit consent for VeloNum to share anonymized purchase consumption telemetry (specifically whether purchased Coins were spent and whether an OTP verification code was delivered to your screen) with Google Play and/or Apple to verify order integrity and protect against fraudulent post-consumption chargeback abuse.

Zero Data Selling: We never sell, rent, monetize, or disclose your personal data, device identifiers, or verification codes to third-party advertisers, data brokers, or marketing consortiums.

5. Ephemeral SMS Isolation & Data Retention Schedule

Incoming verification SMS payloads are routed privately to your authenticated user session and are never displayed on public web pages or shared inboxes. On dedicated single-SMS routes (such as Telegram activations via Ozvinoo), our backend automatically executes an immediate session logout (logoutSession) the moment the code is delivered, terminating the provider session so that you retain exclusive control over your verified account.

Data Record Type	Active Retention Window	Post-Window Processing
Active Account Profile (Email, Google ID, Device UUID)	Duration of active account utilization	Permanently wiped or cryptographically anonymized immediately upon account deletion.
Ephemeral SMS OTP Payloads (`sms_text`, `sms_code`)	Cached for 15–20 minute activation; accessible in order history up to 30–90 days for dispute audit	Automatically and permanently purged or decoupled from all user identifiers after 30–90 days.
Security, Fraud & Rate-Limiting Logs	Rolling 12 months	Rotated and purged continuously on a rolling basis.
Statutory Financial Ledger & Google Play `GPA.` Tokens	Up to 7 years	Retained in an isolated, anonymized accounting database strictly for tax and audit compliance as required by law.

6. Lawful Basis, Security (TLS 1.3) & International Data Transfers

Under GDPR Article 6, we process your personal data under the following legal bases:

Performance of a Contract (Art. 6(1)(b)): To allocate virtual numbers, deliver inbound verification codes, and manage your Coin wallet balance.
Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure integrity, mitigate automated abuse, enforce rate limits, and defend against friendly-fraud chargebacks.
Compliance with Legal Obligations (Art. 6(1)(c)): To maintain statutory accounting and tax records for Google Play / Apple digital purchases.

Cryptographic Security: All client-server communications are strictly encrypted in transit using modern transport security protocols (TLS 1.3 and HTTPS). We enforce strict SQLite WAL-mode concurrency and Sanctum token authorization on all backend API routes.

Cross-Border Transfers: Where data is transferred outside the European Economic Area (EEA), United Kingdom, or your local jurisdiction, we implement the European Commission's Standard Contractual Clauses (SCCs) and equivalent international transfer safeguards.

7. Your Data Rights & Dual Account Deletion Pathways

You hold comprehensive statutory data rights, including the right of access, rectification, erasure (right to be forgotten), restriction of processing, data portability, and objection. To exercise any of these rights, contact support@velonumber.com.

In full compliance with Google Play's Account Deletion Requirement, VeloNum provides two independent, self-service deletion pathways:

Option 1: Fastest

In-App Instant Deletion

Open the app, navigate to Settings → Account & Security → Delete Account (DELETE /api/v1/auth/account). All PII, tokens, and Google links are purged instantly on confirmation.

Option 2: No App Needed

Public Web Deletion Portal

If you uninstalled the application, visit our dedicated web portal at /account/delete to submit your Google email or Device UUID for immediate permanent deletion.

8. Children's Privacy & Age Threshold (18+)

VeloNum is strictly intended for individuals who are at least eighteen (18) years of age (or the age of legal majority in your jurisdiction). We do not knowingly market to or solicit personal data from children under the age of 13, 16, or 18. If you become aware that a minor has provided personal data to VeloNum without parental consent, notify us immediately at support@velonumber.com, and we will promptly purge the information.

9. Updates to This Policy & Contact Us

We may update this Privacy Policy periodically to reflect technological enhancements, operational changes, or new regulatory guidelines. Any updates will be published on this page with a revised Effective Date. Continued use of the application following the posting of modifications constitutes your acceptance of the updated terms.

For questions, privacy inquiries, or data requests, contact our Data Protection Team at: support@velonumber.com.