SMS For UDeutsch

Privacy Policy

Last updated: 4 October 2026

1. Controller

L&L Synergy FlexCo, Preradovicgasse 15, 1140 Wien, FN 650676b, Commercial Court of Vienna. Contact: robin@smsforu.app. Full details in the legal notice.

No data protection officer is appointed; the conditions of Art. 37 GDPR are not met.

2. What we process, why, and for how long

Guest identifier (no account)

SMS For U has no accounts and no sign-in. We ask for neither a name nor an email address. So that we can match a number you bought to you, every browser and every device receives a random identifier:

  • Website: on your first visit your browser receives a cookie "sms_geraet" holding a random identifier (for this site only, not readable by scripts, 400 days).
  • iPhone app: on first launch the app creates a random identifier and stores it in this device's keychain; it is not transferred to other devices.
  • Android app: the app derives the identifier as a hash value from the Android ID that Android assigns separately to our app; if there is none, the app creates a random identifier.

From it we form your guest identifier. Your purchases, your support requests, your notifications, abuse prevention and your ad-measurement choice are attached to it. A purchase is therefore visible only in the browser or on the device you made it with.

Purpose: matching the number you bought to you, handling support and remembering your choices.
Legal basis: Art. 6 (1) (b) GDPR (contract); for storing and reading the identifier on your device § 165 (3) TKG 2021 (strictly necessary).
Duration: the cookie 400 days; the guest identifier for as long as the data attached to it is kept — purchase records seven years, security evidence three years.

Orders

Assigned phone number — after a free swap also the previous ones —, target service, the number's country, time, outcome (code received, swapped, cancelled, refunded), payment route (website, App Store or Google Play) and price as an amount of money with its currency. In addition, technical details of sourcing: which supplier provided the number, that supplier's order reference, the network operator and our purchase price, plus your language and your country.

Purpose: delivering the service (reserving the number, showing the code, swap and refund), calculating success rates, settling purchase and refund with the supplier, answering support requests.
Legal basis: Art. 6 (1) (b) GDPR.
Duration: as part of the purchase record, seven years from the end of the calendar year of the purchase (§ 132 BAO).

Content of received messages

The text of an incoming message, its sender and the verification code.

Purpose: show it to you. After that there is no purpose left.
Legal basis: Art. 6 (1) (b) GDPR.
Duration: about 24 hours after arrival. After that, text, code and sender are removed automatically. The order itself — number, service, time — remains; only the content disappears.

Payments

Apple handles purchases in the iPhone app (in-app purchase), Google handles purchases in the Android app (Google Play), and Revolut Bank UAB handles purchases on the website (card, Apple Pay, Google Pay or Revolut Pay). We never see payment data such as card or account numbers.

For a purchase on the website we send Revolut only the amount, the currency, a description of the service and our order reference — no name and no email address, because we do not ask for either. Revolut collects the name, card or wallet details and email address itself during payment.

From Revolut we receive back: confirmation of the payment with amount and currency, the payer's email address and the country of the card or of the billing address. We use the email address solely to send you the purchase confirmation required by law and to reply if you answer it. We need the card country as a second piece of evidence of your country, independent of the IP address, for VAT purposes.

How Revolut processes your data is set out in Revolut's privacy notice: www.revolut.com/legal/privacy.

For a purchase in an app, the app gives the store a pseudonymous purchase identifier derived from your guest identifier (not the guest identifier itself), and for Google Play also our order reference, so that the purchase can be matched to your number. From the store we receive a proof of purchase with the transaction or order number, the item bought and the store country; we verify it before we activate the number.

As proof of your consent we store, for every purchase, the time, the text version of the consent, the version of the terms of service and the IP address, and on the website also the country of the purchase.

Purpose: processing the purchase, activating the number, triggering refunds, accounting and VAT.
Legal basis: Art. 6 (1) (b) and (c) GDPR.
Duration: seven years from the end of the calendar year of the purchase (§ 132 BAO, Austrian tax law); the record is deleted automatically afterwards.

Purchase confirmation (website)

After a purchase on the website we send you a purchase confirmation with the order number, the time, the service, the price, our provider details and a note on your consent to immediate provision. We do not collect the email address needed for this from you — we receive it from Revolut out of your payment. We use it only for that confirmation and to reply if you write back; we send no advertising to it.

Purpose: the statutory duty to confirm the contract on a durable medium (§ 7 (3) FAGG, Austrian distance selling law).
Legal basis: Art. 6 (1) (c) GDPR, alongside (b).
Duration: seven years together with the purchase record (§ 132 BAO).

Refunds

If a purchase is refunded, the following applies depending on the payment route. Website: we trigger the refund with Revolut to the original payment method. Android app: we trigger the refund with Google Play; for that, Google receives the order number of the purchase from us. iPhone app: only Apple can refund, at your request.

If you ask Apple for a refund, Apple may ask us whether the service was delivered. Only then do we send, for that purchase: the delivery status (whether a code was delivered), the share consumed that follows from it, and our refund preference — refund without a code, decline with a code. The recipient is Apple Distribution International Ltd., Ireland, or the app store through which you paid. Apple decides on the refund, not us. If a refund is granted, Apple tells us and we note it on the purchase record.

Purpose: processing the purchase and preventing refund abuse.
Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (f) GDPR (legitimate interest in preventing refunds of codes already delivered), and your consent given by accepting the Terms of Service (Art. 6 (1) (a) GDPR).
Duration: as for payments, seven years (§ 132 BAO, Austrian tax law).

Security and abuse prevention

For every guest identifier: a pseudonymous device identifier (in the iPhone app derived from the app-internal random identifier, on Android from the Android ID, in the browser from the cookie "sms_geraet"), the IP address, on the web the country derived from it, platform and app or browser identifier, and the time and kind of every action — acceptance of terms, ad-measurement decision, purchase, order (with phone number, service and country), swap, cancellation, registration for notifications, support message (without its content). Also which guest identifiers use the same device or IP address, and any blocks imposed.

Purpose: preventing fraud and abuse, enforcing blocks — including against new guest identifiers of the same person —, establishing or defending legal claims, and complying with lawful orders of authorities.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in an abuse-free service and in defending legal claims) and (c) where a legal obligation applies.
Duration: three years from the event (limitation period under § 1489 ABGB), including after erasure at your request; deleted automatically afterwards. A block stays stored for as long as it applies.

The device or guest identifier is not an advertising ID and we do not enrich it with third-party data. It serves operation and abuse prevention — and, if you have consented to ad measurement, additionally as a recognition feature towards Meta and Google. It goes there only as a hash value, never in the clear. If you have not consented, or have withdrawn consent, this does not happen. Details are set out under "Ad measurement".

Support chat

Your messages to us and our replies, each with its time, and the platform (website, iPhone or Android) you write from.

Purpose: answering your request.
Legal basis: Art. 6 (1) (b) GDPR.
Duration: the history is attached to your guest identifier; we keep it only as long as it is needed to answer you and to prevent abuse, and delete it at any time on your request — in the support chat or to robin@smsforu.app.

AI assistant in the support chat

Messages in the support chat are answered first by our AI assistant "Luna", a language model from OpenAI that we use through OpenAI's application programming interface (API). Luna introduces herself as an AI assistant in her first reply. If she cannot help or you want a human, she passes your request to a member of staff, who replies in the same chat. You can ask at any time for a human to handle your request — just say so in the chat. Even after a request has been passed on and after a reply from a member of staff, Luna may answer further messages. If the AI is switched off or unavailable, your message goes directly to our team.

What OpenAI receives: the chat messages you currently see (yours and ours, at most the last 24), the platform you write from, and the status of your own purchases of the last 60 days with this guest identifier (at most eight): service, country, time of purchase, payment route, number of numbers tried, whether a code arrived and whether the money is back, and for purchases on the website also the amount paid.

What OpenAI does not receive: phone numbers, codes, your guest identifier, order or receipt numbers, your email address, payment data and your IP address — unless such details are contained in the chat messages themselves. Please do not write passwords or payment data into the chat.

The AI makes no decisions about you: it cannot refund anything, change a purchase or block anyone. For every request it records a short summary in German for our team, which is stored with the history. If it passes your request to a human, our team receives a notification with this summary.

We call OpenAI in a way that requests and replies are not stored there for later retrieval. Under OpenAI's terms, data sent through the API is not used to train models; OpenAI keeps it for up to 30 days to detect abuse, unless longer retention is required by law.

Purpose: answering your request quickly and in your language, and passing it to a human where needed.
Legal basis: Art. 6 (1) (b) GDPR (handling your request under the contract) and Art. 6 (1) (f) GDPR (legitimate interest in answering support requests quickly and efficiently).
Recipients: OpenAI Ireland Ltd., Ireland, as our processor (see section 4).
Duration: summary and history as for the support chat; at OpenAI as described above.

Notifications

If you allow notifications: in the apps your device's push token, on the website your browser's push subscription, on Android and on the website together with your language.

Purpose: telling you about received codes and replies from support. A notification contains the name of the service and the code, or the beginning of the support reply, and in a Live Activity on the iPhone also the sender and the remaining time. It is delivered through the notification service of Apple (iPhone), Google (Firebase Cloud Messaging, Android) or the maker of your browser (website; there it is encrypted so that the service cannot read the content).
Legal basis: Art. 6 (1) (b) GDPR.
Duration: until you unsubscribe from notifications or the notification service reports the registration as invalid, for example because the app was deleted; a browser subscription for at most 180 days.

Cookies and browser storage

Strictly necessary. The cookie "sms_geraet" holding your guest identifier (random value, not readable by scripts, 400 days, for this site only). Without it we cannot match a number you bought to you, cannot handle support and cannot prevent abuse. If access is blocked, the site additionally sets the cookie "sms_hinweis" for ten minutes to show this.
Legal basis: § 165 (3) TKG 2021 and Art. 6 (1) (b) and (f) GDPR.

In your browser's storage, not a cookie. After a purchase the site stores, under the key "sms-gast-kauf", your order reference and a random secret with which only your browser can retrieve that purchase, plus the service, country, price, currency and time. These details stay in your browser for up to 30 days, are transmitted to nobody and serve only to show you your purchase. If you delete them you no longer see the purchase; a refund that is due still goes through.

Only with your consent. Cookies of Google, Meta and OpenAI, and two random identifiers for our own usage analysis (see "Ad measurement").
Legal basis: your consent, § 165 (3) TKG 2021 and Art. 6 (1) (a) GDPR.

Ad measurement (tracking)

Only with your consent (exception: "Before your decision" below). With Meta Platforms Ireland Ltd., Google Ireland Ltd. and OpenAI Ireland Ltd. we measure which of our ads bring customers. In the EU, the EEA, the United Kingdom and Switzerland we ask first; elsewhere measurement is on until you switch it off.

Data: app installation, page visits and purchases. For a purchase we send the amount and currency, an identifier of the purchase, the item bought, the service the number is meant for and the number's country. We never send the phone number itself. If a purchase is refunded, we send a refund event for the same identifier to Google so that revenue that no longer exists is not counted there. In addition: device and app details, IP address and browser identifier, advertising identifiers (on the iPhone only if you allow tracking) and, in the browser, cookies of Google, Meta and OpenAI.

Identifiers. We send the same identifier to Meta and to Google: your guest identifier, only as a hash value. The purpose of that identifier is that the same person is not counted several times there. If we have an email address, we send it only as a hash value too. Google additionally receives the identifier Google itself sets, and Meta its own cookies.

Our own usage analysis (website). With the same consent we record on our own servers how the website is used: sections visited, clicks — including on disabled buttons and on spots without a function — with their position and a short label of the element clicked, scrolling, dialogs opened and error messages, including those of the payment page. In addition: language, window size, country (not the IP address), arrival from an ad or a link, the Google Analytics identifiers and, after a purchase, our order reference. For this the site stores two random identifiers in your browser's storage. Digit sequences of four or more digits are masked in the browser already; phone numbers, codes and email addresses are not recorded. We delete these recordings automatically after 30 days.

Purpose: measuring which ads bring customers, improving our advertising and our website.
Legal basis: your consent, Art. 6 (1) (a) GDPR and § 165 (3) TKG 2021.
Recipients: Meta Platforms Ireland Ltd., Google Ireland Ltd. and OpenAI Ireland Ltd. (ads in ChatGPT). All of them may process data in the USA too: for Meta and Google the transfer relies on the EU-U.S. Data Privacy Framework (adequacy decision), for OpenAI on the standard contractual clauses.
Duration: Meta, Google and OpenAI keep the data under their own terms. Your choice stays with your guest identifier until you change it or delete the cookie "sms_geraet". We keep the evidence of your decision — time, IP address, browser identifier, country, device and the text version shown to you — for three years, in order to be able to demonstrate consent under Art. 7 (1) GDPR.
Withdrawal: at any time with the "Tracking" switch under the "Account" tab — in the apps and on the website — as easily as you gave consent, with effect for the future.

Before your decision (website). Where we ask first, the website loads Google's script even if you have not decided yet or have declined — in the "denied" state (Google Consent Mode). It then sets and reads no cookies. For technical reasons Google receives your IP address and details of the page visit, but no identifier from cookies; if you arrived through a Google ad, the address of the page may also contain that ad's click identifier. From this Google estimates the success of our ads. Meta and OpenAI receive nothing before your consent. None of this happens on the pages with the legal texts. The legal basis for this is Art. 6 (1) (f) GDPR (legitimate interest in measuring the success of our advertising without cookies).

Arrival from Apple ads (iPhone app)

On first launch the iPhone app obtains an attribution token through Apple's AdServices interface and sends it to our server; we redeem it with Apple. If the installation came through an ad in Apple Ads, Apple tells us the campaign, ad group, search keyword, country, time of the click and type of attribution; otherwise we receive nothing. We store these details with your guest identifier. This happens independently of your ad-measurement choice and without an advertising ID.

Purpose: measuring whether our ads in Apple Ads pay off.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring the success of our advertising).
Duration: seven years from the end of the calendar year of the installation.

Logs

Technical server logs: time, path called, error messages, and when excessive requests are fended off also the IP address.

Purpose: operation, debugging, abuse prevention.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working, abuse-free service).
Duration: 30 days.

Advertising and analytics tools run only as described in "Ad measurement" and "Arrival from Apple ads".

3. Transfer to a third country — please read carefully

To obtain a phone number for you we send your request to a supplier outside the European Economic Area. What is transferred is the target service and the country you chose, and for some suppliers also a pseudonymous customer key (see below); the phone number and incoming messages come back from there.

There is no adequacy decision by the European Commission for that third country. In practical terms:

  • The level of protection there may not match the GDPR.
  • There may be no independent supervisory authority.
  • Your data subject rights may not be enforceable there, or only with difficulty.
  • Authorities of that state may be able to access the data without us knowing or being able to prevent it.

The legal basis is Art. 49 (1) (b) GDPR: the transfer is necessary for the performance of the contract you conclude with us. Without it we cannot obtain a phone number for you — the service consists precisely in that arrangement. What is transferred is only the target service and the country you chose, and for some suppliers also a pseudonymous customer key. That key is a hash value of your guest identifier formed with a secret key, a different one for each supplier, from which your guest identifier cannot be calculated; it lets the supplier link purchases by the same customer to each other, for example to restrict abuse. No name, no email address, no IP address, and nothing by which the supplier could recognise you outside our service.

4. Processors and other recipients

Amazon Web Services EMEA SARL, Luxembourg — running our servers and databases. Server location Frankfurt am Main, Germany. The website is also delivered through the worldwide Amazon CloudFront delivery network. Amazon Web Services also sends the purchase confirmation for us (Amazon SES). A processing agreement under Art. 28 GDPR is in place; where data is processed outside the EEA in the course of this, the European Commission's standard contractual clauses agreed in it apply.

OpenAI Ireland Ltd., Ireland — running the AI assistant in the support chat (see section 2). OpenAI acts as our processor under Art. 28 GDPR (OpenAI's Data Processing Addendum). Where OpenAI transfers data to affiliates or sub-processors outside the EEA, for example in the USA, it does so on the basis of standard contractual clauses or an adequacy decision of the European Commission.

Apple Distribution International Ltd., Ireland — distribution of the iPhone app, payment handling, refund decisions, delivery of notifications to the iPhone app and attribution of Apple ads. Apple acts as its own controller in that respect; Apple's privacy policy applies in addition.

Google Ireland Ltd. and Google Commerce Ltd., Ireland — distribution of the Android app through Google Play, payment handling and refunds in the Android app. Google acts as its own controller in that respect; Google's privacy policy applies in addition. Google delivers notifications to the Android app through Firebase Cloud Messaging.

Revolut Bank UAB, Lithuania — payment handling on the web. Revolut acts as its own controller in that respect; Revolut's privacy notice applies in addition.

Our number suppliers. To obtain a phone number for you we work with specialised providers outside the European Economic Area. They receive from us the target service and the country you chose, some of them also a pseudonymous customer key, and return the phone number and the incoming message. Details and the risks of that transfer are set out in section 3.

5. Authorities and law enforcement

We do not retain communication content in stock. What we keep for security is set out in section 2 ("Security and abuse prevention"). We are not a telecommunications provider (see section 3 of the Terms of Service).

If we receive a lawful order from a court, a law enforcement body or a regulator, we disclose the data we actually hold at that time — such as which phone number was assigned to which guest identifier and when, and which device and IP address it was used with. We no longer hold the content of messages about 24 hours after they arrive and then cannot hand it over. Where we suspect a criminal offence, we may also pass this data to the competent authorities on our own initiative.

Legal basis: Art. 6 (1) (c) GDPR together with the order, and Art. 6 (1) (f) GDPR for reports we make. Requests from authorities: robin@smsforu.app.

6. Erasure

On your device. If you delete this site's stored data in your browser, the guest identifier and the remembered purchase are gone from it. In the apps the guest identifier is designed to survive a reinstallation, so that a paid purchase is not lost. The data listed below remains with us.

With us. You can ask us to erase your data at any time — in the support chat or at robin@smsforu.app. Please quote the order number from your purchase confirmation or write from the support chat of the app or browser you bought with, because otherwise we cannot identify you.

What is kept afterwards, and why:

  • Invoice and purchase-record data: seven years from the end of the calendar year of the purchase. Statutory retention obligation, § 132 BAO; the record is deleted afterwards. There is no way around it.
  • Security evidence: three years — which phone number was assigned to your guest identifier when, and which device and IP address it was used with (see section 2). Legal basis Art. 6 (1) (f) GDPR. The legitimate interest is preventing abuse, defending legal claims and being able to comply with a lawful order at all. This data is held separately, access is restricted, and it is excluded from any analysis.
  • Fully anonymised figures — success rates per country, for example — remain indefinitely. They allow no conclusion about a person and are therefore no longer personal data.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).

Right to object. Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object to it at any time on grounds relating to your particular situation. We will then no longer process that data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).

You can withdraw consent at any time with effect for the future. The lawfulness of processing up to that point is unaffected.

Identification. Because there are no accounts, we do not know your name. We therefore need something that lets us identify your data — usually the order number from your purchase confirmation or a request from the support chat of the device you bought with. If we cannot identify you, we may neither disclose nor erase the data (Art. 11 (2) GDPR); we do not ask for extra information solely in order to identify you.

Write to robin@smsforu.app. We answer within one month.

8. Right to complain

You can complain to a supervisory authority, in particular the

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
dsb@dsb.gv.at

Consumers outside Austria may contact the supervisory authority of their country of residence.

9. No automated decision-making

As a rule there is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR; the AI assistant in the support chat makes no such decisions either. The one exception: if a guest identifier is used on a device that is blocked for abuse, we block that guest identifier automatically to enforce the block (Art. 22 (2) (a) GDPR). You can ask for a person to review the decision, state your point of view and contest it — write to robin@smsforu.app.

10. Changes

We adapt this policy when the processing changes. We announce material changes in the app.

Governing version. Where the language versions differ, the English version governs; the exception is the legal notice and the mandatory information under Austrian law (see section 18 of the Terms of Service).