SMS OTP service terms

SMS OTP processing and terms

SMS OTP sends and checks a one-time code on the customer’s instructions. The customer determines the lawful purpose, gives the recipient the required privacy notice and holds the account records. VerifyNow acts as operator for the requested processing and manages its own service security and billing obligations. OTP establishes access to the receiving phone.

Customers must request transactional codes for a recipient’s current verification journey. Promotional messages, purchased contact lists, unsolicited bulk messaging and attempts to bypass network or WASPA restrictions are prohibited. The customer must protect its credentials, implement signup abuse controls and respond to recipient complaints. Applicable POPIA duties and the WASPA Code of Conduct must be observed. VerifyNow may suspend abusive OTP use.

Urban Luxury Brands (Pty) Ltd trading as VerifyNow supplies this API service. Customers must have the bill-payer’s authority and obtain the recipient’s request and any required consent for the OTP. The recipient needs an SMS-capable mobile number and network coverage. Network or roaming charges may apply under the recipient’s plan. This service creates no recurring SMS subscription.

Report billing errors or unwanted codes through our contact page with the verification ID where available. We investigate the dispatch and billing record and process applicable refunds. Customers may also use the WASPA complaints process. These terms preserve applicable statutory rights.

Each accepted send or resend uses the configured otp_sms credits. Code verification and status polling are included. Unresolved sends are charged after ten minutes; confirmed rejection before acceptance is refunded. Delivery failure after acceptance remains charged.

Raw phone number and SMS code

Used in memory for dispatch and verification processing. VerifyNow does not write the raw number or plaintext code to its OTP database or application logs. The gateway request has a ten-second timeout.

Challenge code hash

Encrypted code hashes are stored in Cape Town with a five-minute expiry. Successful use, lockout and supersession trigger deletion; expiry remains the backstop if deletion is interrupted.

Abuse-prevention tokens

Keyed phone and reference tokens are stored in Cape Town and expire after 24 hours without further activity. IP tokens expire after one hour without further activity. These tokens are personal information.

Retry records

Encrypted request fingerprints and verification outcomes are stored in Cape Town for 72 hours to prevent duplicate sends and charges. Fingerprints are keyed and may be derived from submitted data; they remain subject to personal-information safeguards.

Billing and account records

Amounts, opaque transaction identifiers and OTP terms acceptance follow the existing billing and account retention schedule. They exclude recipient phone numbers and codes.

Temporary OTP code hashes, phone- and IP-derived abuse tokens, and retry payloads are encrypted and stored in Cape Town, South Africa. The account database keeps opaque processing references and billing controls. Customer-specific hourly counters contain aggregate counts and are retained for eight days for abuse detection. Administrative alerts are retained for 30 days.

Expiry prevents further verification. Physical cleanup runs on a schedule; database backups follow the infrastructure retention schedule and may contain earlier encrypted or hashed records until backup rotation. Restored data must undergo OTP expiry and cleanup before use.

This SMS OTP service supports South African mobile numbers only. SMS delivery partners and mobile networks apply their own retention requirements. Delivery metadata may be retained for approximately three years, and their terms permit cross-border processing. Message content may be retained for operational or lawful requirements. These delivery records have separate deletion schedules from VerifyNow’s temporary OTP data.

OTP terms acceptance is recorded with the accepting account user, version and timestamp. It applies to this service. Requests for access, correction or deletion can be sent through VerifyNow support, subject to identity verification and lawful retention obligations.

Subprocessor register · Data Processing Agreement · Privacy policy · WASPA Code of Conduct