Home / Privacy Policy

Privacy Policy

Last updated: 31 October 2026 · Operated by KwikCall AI LLC

This Privacy Policy explains how KwikCall AI LLC, doing business as OTP Route (1209 Mountain Road Pl NE, #4948, Albuquerque, NM 87110, USA) ("OTP Route", "we", "us"), collects, uses, shares, retains and protects information when you visit our website, create an account, or use our dashboard, API, webhooks, temporary verification numbers and dedicated virtual numbers (the "Service"). It should be read together with our Terms of Service.

1. Information we collect

Information you provide

Account information — your email address, password (stored only as a secure hash), account name and, where you provide them, organisation and billing details.
Google sign-in (optional) — if you choose to sign in with Google, we receive your basic profile from Google (your Google account identifier, email address, name and, where available, profile picture). We do not receive your Google password.
Two-factor authentication (optional) — if you turn on two-factor authentication, we store the secret used to check the time-based codes (TOTP) from your authenticator app.
Support communications — the content of emails you send us and any attachments.
Configuration — webhook endpoint URLs, API key names and other settings you create in the dashboard.

Information generated by your use of the Service

Activation and number records — services and countries requested, numbers assigned, statuses, timestamps and prices.
Wallet and payment records — top-ups, charges, refunds, invoices and coupon use. Card payments are handled by our payment processor; we do not receive or store your full card number. For stablecoin payments we record the network, amount and transaction reference.
API and webhook logs — request metadata such as endpoint, status code, timestamp and the key used, and webhook delivery attempts with status codes and short response excerpts.
Technical information — IP address, browser type, device information and security events such as sign-ins and two-factor challenges, used to operate and protect the Service. Sign-in and sign-up forms are protected by Cloudflare Turnstile, which processes browser and device signals to distinguish people from automated traffic.

2. SMS content and call records

Delivering the Service requires us to process the content of SMS messages received on numbers you use. For temporary activations, we receive the message, extract the one-time password and make both available to you through the dashboard, API and webhooks. For dedicated numbers, we store inbound and outbound messages so they appear in your message history. For browser calls we record call metadata, such as the number called, duration and cost; we do not record the audio of calls.

Messages may contain personal data of third parties, such as the sender's phone number or information within the message. You are responsible for handling this data lawfully once it reaches your systems. SMS content is retained for up to 90 days and then purged, as described in section 6.

3. How we use information

To provide, operate and maintain the Service, including routing requests, delivering codes and messages, and sending webhooks.
To process payments, maintain your wallet ledger, apply refunds and coupons and issue invoices.
To authenticate you, secure accounts and keys, enforce rate limits and detect, prevent and investigate fraud, abuse and violations of our Acceptable Use Policy.
To send service emails, such as verification, receipts, invoices, renewal reminders and security notices.
To provide support and respond to your requests.
To measure and improve the reliability and performance of the Service, using aggregated usage data.
To comply with legal obligations and respond to lawful requests from authorities.

We do not sell personal data, and we do not use SMS content for advertising.

4. Legal bases

Where data protection law requires a legal basis, we rely on: performance of our contract with you (to provide the Service); our legitimate interests (to secure the Service, prevent fraud and improve our products, balanced against your rights); compliance with legal obligations (for example, tax and accounting records); and your consent where we ask for it, which you may withdraw at any time.

We share information only as needed to run the Service, with service providers bound by appropriate confidentiality and data protection obligations:

Hetzner (Finland and Germany) — hosting of our servers, databases and backups.
Cloudflare — content delivery network, DNS and Turnstile bot protection on sign-in forms.
Stripe — processing of card payments, including 3-D Secure authentication.
Zoho ZeptoMail — delivery of transactional emails such as verification, receipts, invoices, renewal reminders and security notices.
Google — optional Google sign-in, only if you choose to use it.
Our carrier and verification-number partners — to provision numbers, receive and send SMS and connect calls.

Stablecoin payments are verified against public blockchain records.

We also deliver data to destinations you configure, such as your webhook endpoints. We may disclose information if required by law, to protect the rights, property or safety of OTP Route, our customers or others, or in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred data.

6. Retention

SMS content — retained for up to 90 days, then purged. Activation and message metadata may be kept longer for billing and audit purposes.
API usage logs — retained for up to 90 days for analytics, rate limiting and troubleshooting.
Account information — kept for as long as your account is active and for a reasonable period afterwards to handle questions, disputes and legal obligations.
Financial records — wallet ledgers, payments and invoices are kept for the period required by applicable tax and accounting laws.
Abuse investigations — information related to suspected fraud or abuse may be retained for as long as necessary to protect the Service and comply with law.

7. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords and API keys, optional two-factor authentication, bot protection on sign-in forms, HMAC-signed webhooks, access controls, rate limiting and monitoring for suspicious activity. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and authorities as required by law. You can help by using a strong, unique password, turning on two-factor authentication, protecting your API keys and verifying webhook signatures.

8. International transfers

Our service providers and carriers may process information in countries other than your own, including countries whose data protection laws differ from yours. Where required, we use appropriate safeguards for such transfers, such as contractual protections.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. You can update most account information in the dashboard. To exercise other rights, email [email protected] from the address registered on your account. We may need to verify your identity, and some data may be retained where we have a legal obligation or legitimate need, such as financial records. You may also have the right to complain to your local data protection authority.

10. Cookies and local storage

We use strictly necessary cookies to keep you signed in, to complete optional Google sign-in and to protect sessions, and your browser's local storage to remember preferences such as light or dark mode. We do not use third-party advertising cookies. Cloudflare Turnstile, which protects our sign-in forms, and third-party pages that you visit during sign-in or checkout, such as Google sign-in or our card payment processor's 3-D Secure flow, may set or read their own cookies or similar technologies under their own policies.

11. Children

The Service is intended for businesses and adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes and contact

We may update this Privacy Policy from time to time. We will post the new version here and update the "Last updated" date, and we will notify you of material changes by email or in the dashboard. For questions or requests about privacy, contact [email protected].