Privacy Policy

Last updated: 27 September 2026

This policy explains what DapatOTP ("we") collects when you use dapatotp.com, why, and what we do with it. It is written to comply with Malaysia's Personal Data Protection Act 2010.

1. Who we are

DapatOTP provides temporary phone numbers for receiving SMS verification codes. For any privacy question, contact support@dapatotp.com.

2. What we collect

• Account data: email address, display name, a hashed password (or your Google account ID if you sign in with Google), and the time you registered.
• Balance and transactions: top-ups (including USDT transaction hashes and on-chain sender addresses, or payment gateway references), charges and refunds.
• Orders: the country, app and route you chose, the number issued, the time, and the full text of any SMS received on that number during your order. The SMS is stored so you can look up the code later and so we can resolve disputes.
• Support tickets: what you write to us.
• Technical data: IP address and user agent in server logs and for rate limiting. We do not use analytics cookies. If we run advertising, a Meta Pixel may be enabled on public pages; it is currently off.

3. Why we collect it

• To run your account: sign you in, keep your balance, issue numbers and show you the codes.
• To credit payments and reconcile them with the payment provider or the blockchain.
• To answer support requests and resolve refund disputes.
• To prevent abuse: rate limiting, blocking fraudulent accounts, complying with lawful requests.

4. Who we share it with

• The number supplier: receives the request for a number and returns the SMS. It does not receive your email or identity.
• Payment providers: toyyibPay (for FPX / DuitNow) receives your email and the amount. USDT transfers are public on the Tron blockchain by nature.
• Infrastructure: the site runs on Cloudflare; data is stored in Cloudflare D1. Emails (password resets, alerts) are sent through Resend.
• Authorities: when required by Malaysian law or a valid legal request.

We do not sell personal data.

5. Cookies

One session cookie keeps you signed in, and one short-lived cookie is set after Google sign-in. Your language choice is kept in your browser's local storage. No third-party tracking cookies are set unless advertising is switched on.

6. How long we keep it

Account, ledger and order records (including received SMS text) are kept while your account exists and for 12 months after closure for accounting and dispute purposes. Server logs are kept for 30 days.

7. Your rights

You may ask for a copy of your data, ask us to correct it, or ask us to close your account and delete what we are not required to keep. Write to support@dapatotp.com and we will respond within 21 days.

8. Security

Passwords are hashed with PBKDF2. API keys are random 192-bit values. All traffic is over HTTPS. Access to the database is limited to the operator. Keep your API key and password private — we cannot undo a transaction made with a leaked key.

9. Children

The service is not intended for anyone under 18.

10. Changes

We will update this page when the policy changes. The date at the top shows the current version.