Privacy Policy

SMSFLOW.COM.AU PTY LTD
ABN: 83 687 813 798
South Australia, Australia

Last updated: 8th July 2026

PRIVACY NOTICE

This Privacy Notice for SMSFLOW.COM.AU PTY LTD ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services (the "Services"), including when you:

• Visit our website at https://smsflow.com.au
• Create an account or use our SMS messaging platform
• Upload contact lists or send SMS campaigns
• Contact us for support or marketing

Questions or concerns?
Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed (except where we act as a data processor — see below). If you do not agree with our policies and practices, please do not use our Services.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more details by using the table of contents below.

What personal information do we process?
We collect personal information that you provide to us when you register for an account (name, email, phone, business details) and automatically when you use the Services (IP address, device and usage information). When you upload contact lists for SMS campaigns, we process that information only as a data processor on your behalf and never for our own purposes. Learn more

Do we process any sensitive personal information?
We do not process sensitive personal information (such as health, racial or ethnic origin, or religious beliefs).

How do we process your information?
We process your information to provide and improve our SMS platform and Services, communicate with you, process payments, ensure security and prevent fraud, comply with legal obligations (including the Spam Act 2003 and ACMA requirements), and for analytics. We only process information when we have a valid legal reason to do so. Learn more

When and with whom do we share personal information?
We share information with service providers who help us operate the business (telco/SMS delivery partners, payment processors such as Stripe, analytics providers, and hosting providers). We do not sell your personal information. Learn more

Is your information transferred internationally?
Most of your personal information is stored and processed in Australia. Limited analytics data (including possible session replays) may be processed by providers located in the United States. Learn more

How long do we keep your information?
We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. This generally means we keep information while your account is active and for a reasonable period afterwards, unless you request deletion earlier (subject to legal requirements). Learn more

What are your rights?
Under the Australian Privacy Principles (APPs), you have rights to access, correct, and in some cases delete your personal information, as well as to make a privacy complaint. Learn more

How do you exercise your rights?
The easiest way is to contact us at [email protected]. We will respond in accordance with applicable privacy laws.

TABLE OF CONTENTS

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. When and With Whom Do We Share Your Personal Information?
4. Do We Use Cookies and Other Tracking Technologies?
5. Is Your Information Transferred Internationally?
6. How Long Do We Keep Your Information?
7. Do We Collect Information from Minors?
8. What Are Your Privacy Rights?
9. Controls for Do-Not-Track Features
10. Do We Make Updates to This Notice?
11. How Can You Contact Us About This Notice?
12. How Can You Review, Update, or Delete the Data We Collect From You?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you voluntarily provide to us when you register for an account or contact us.

We collect personal information that you provide when you:

• Create an account on our platform
• Use our SMS messaging Services
• Contact our support team or sign up for communications

Types of information we collect include:

• Account information: Full name, email address, phone number, business name, and any other details you provide during registration.
• Billing information: We use Stripe to process payments. We do not store your full credit card details on our servers.
• Uploaded contact lists and campaign data: When you upload spreadsheets or provide recipient information (phone numbers, names, custom fields, etc.) to send SMS messages, we collect and process this information solely as a data processor on your behalf and strictly in accordance with your instructions. We do not use this information for our own marketing, analytics, or any other purpose.

All personal information you provide to us must be true, complete, and accurate. You must notify us of any changes.

Information automatically collected

In Short: Some information (such as your IP address, browser and device characteristics, and usage data) is collected automatically when you visit or use our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not always reveal your specific identity but may include:

• Device and usage information (IP address, browser type and version, operating system, device type, language preferences, referring URLs)
• Information about how and when you use our Services (pages viewed, features used, campaign activity, login times)
• Technical information necessary to maintain the security and operation of the Services and for internal analytics and reporting

We also collect information through cookies and similar tracking technologies (see section 4).

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our SMS platform and Services, communicate with you, process billing, ensure security and prevent fraud, and comply with law (including the Spam Act 2003). We may also process information for other purposes with your consent.

We process your personal information for the following purposes:

• To provide and operate our Services — including delivering SMS messages on your behalf, managing your account, and enabling campaign functionality.
• To process payments and billing — via our payment processor Stripe.
• To communicate with you — account notifications, support responses, service updates, and (where you have opted in) occasional marketing communications about our own Services. We never send marketing using the contact lists you upload.
• To improve and develop our Services — usage analytics, feature development, and platform optimisation.
• For security, fraud prevention, and technical maintenance — monitoring for suspicious activity, protecting against abuse, and ensuring platform reliability.
• To comply with legal obligations — including record-keeping requirements under the Spam Act 2003, ACMA guidelines, and other applicable laws. We honour opt-out requests and maintain consent records where relevant.
• With your consent — for any other purposes you expressly agree to.

We only process personal information when we have a valid legal basis under the Australian Privacy Principles.

Important note on uploaded contact lists
When you use our platform to send SMS campaigns, any personal information in your contact lists is processed by us only as a data processor acting on your instructions. We do not determine the purposes or means of processing that data and do not use it for our own purposes. You remain responsible for ensuring you have appropriate consent or other lawful basis to contact those recipients and for complying with the Spam Act 2003 and Privacy Act.

3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations and with specific categories of third parties that help us operate our business. We do not sell your personal information.

We may need to share your personal information in the following situations:

• Service providers and processors — We share information with trusted third parties who perform services on our behalf, including:

  • SMS termination and telco partners (to deliver your messages)
  • Payment processing (Stripe)
  • Analytics and performance monitoring providers
  • Hosting and infrastructure providers (all data stored in Australia)
  • Customer support and communication tools

  These providers are contractually required to protect your information and use it only for the purposes we specify.

• Business transfers — We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

• Legal and safety reasons — We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of SMSFLOW.COM.AU PTY LTD, our users, or the public.

• With your consent — We may share information in other situations where you have given us explicit consent.

We require all third parties to whom we disclose personal information to respect the security of your data and to treat it in accordance with applicable privacy laws.

4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We use cookies and similar tracking technologies to collect and store information for analytics, performance monitoring, and to improve your experience.

We (and our service providers) use cookies, web beacons, pixels, and similar technologies when you interact with our Services. These technologies help us:

• Maintain the security of the Services and prevent crashes or bugs
• Remember your preferences and provide core functionality
• Analyse how users interact with our platform (via tools such as Google Analytics, PostHog, and Sentry)
• Measure and improve the performance of our Services

Analytics and error monitoring
We use third-party analytics services (including Google Analytics, PostHog, and Sentry) to understand usage patterns, diagnose technical issues, and improve the platform. These tools may collect information about your device, browser, and how you use the site.

You can manage or disable cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

We do not use tracking technologies to serve targeted advertising on our own behalf using data from your uploaded contact lists.

For more information about the specific cookies we use, please contact us at [email protected].

5. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: Most of your personal information is stored and processed in Australia. Limited analytics data may be processed overseas.

We are an Australian company and primarily store and process personal information on servers located in Australia (including our hosting infrastructure in Sydney).

However, some of our analytics and monitoring providers (such as PostHog and others) are based in the United States. These providers may process limited information, including device and usage data and, in the case of session replays, information that could include personal information.

Where personal information is transferred outside Australia, we take reasonable steps to ensure that the overseas recipient handles the information in a manner consistent with the Australian Privacy Principles (for example, through contractual safeguards or because the recipient is subject to a substantially similar privacy regime).

By using our Services, you consent to the transfer of your information to these overseas providers as described in this Notice.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your personal information for as long as it is necessary to provide the Services and meet our legal obligations.

We retain personal information for the period necessary to:

• Provide and maintain your account and the Services
• Comply with legal, regulatory, and tax obligations (including Spam Act record-keeping requirements)
• Resolve disputes and enforce our agreements
• Detect and prevent fraud or abuse

This generally means we retain information while your account remains active. After account closure or upon your request, we will delete or de-identify your personal information, except where we are required or permitted by law to retain it for longer (for example, for audit, legal, or safety reasons).

Uploaded contact lists
You can delete individual contacts or entire lists through your account dashboard at any time. We will process deletion requests promptly. We do not retain uploaded contact data after it is no longer needed to deliver your campaigns, except where required for legal compliance or dispute resolution.

If you would like us to delete specific information earlier, please contact us at [email protected]. We will consider and action requests in accordance with the Australian Privacy Principles.

7. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect personal information from children under 18 years of age.

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect, use, or disclose personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] so we can take appropriate action.

8. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Under the Australian Privacy Principles (APPs), you have certain rights regarding your personal information. We will honour these rights in accordance with the law.

Depending on your location and applicable law, you may have the following rights:

• Right to access — You can request a copy of the personal information we hold about you.
• Right to correction — You can request that we correct any inaccurate or incomplete personal information.
• Right to deletion — In some circumstances, you can request that we delete your personal information (subject to our legal obligations to retain certain records).
• Right to object or restrict processing — You can object to certain types of processing or ask us to restrict how we use your information.
• Right to make a complaint — You can lodge a complaint about how we have handled your personal information.

These rights are not absolute and may be subject to exceptions (for example, where we need to retain information for legal reasons or where deletion would affect another person’s rights).

Exercising your rights
To exercise any of these rights, please contact us using the details in the “How Can You Contact Us” section below. We will respond to your request within a reasonable time and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

You also have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our response.

9. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As a result, we do not currently respond to DNT browser signals or other similar mechanisms. If a standard is adopted in the future, we will update this Privacy Notice accordingly.

10. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes in our practices.

We may update this Privacy Notice from time to time. The “Last updated” date at the top of this page indicates when the latest changes were made.

When we make material changes, we will notify you by updating the date on this page and/or by posting a prominent notice on our website or within the platform. We encourage you to review this Privacy Notice periodically to stay informed about how we protect your information.

11. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions, comments, or concerns about this Privacy Notice or our privacy practices, or if you wish to exercise your privacy rights, please contact us at:

SMSFLOW.COM.AU PTY LTD
Email: [email protected]
ABN: 83 687 813 798
South Australia, Australia

We will respond to all legitimate requests in accordance with applicable privacy laws.

12. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to, correction of, or deletion of the personal information we hold about you.

For account information
You can review and update most of your account details directly in your SMSFlow dashboard.

For uploaded contact lists
You can manage, edit, and delete contacts and lists at any time through the platform.

For formal requests
To make a formal request to access, correct, or delete personal information (including data we hold as a processor), or to withdraw consent, please email us at [email protected] with sufficient information to identify you and the information you are requesting.

We will respond to your request within 30 days (or such longer period as permitted by law) and will advise you if we are unable to fulfil the request and the reasons why.

If you are not satisfied with our handling of your request, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Thank you for trusting SMSFlow with your communications.

This Privacy Notice is provided for transparency and to help you understand how we handle personal information. We are committed to protecting your privacy and complying with the Australian Privacy Principles and the Spam Act 2003.

This document was prepared as a draft for SMSFLOW.COM.AU PTY LTD. We recommend obtaining independent legal advice before publishing to ensure it fully reflects your current practices and complies with all applicable laws.