1. Our commitment
SMSGo, operated by Oryn Labs, LLC, processes personal data in compliance with Brazil’s General Data Protection Law (LGPD — Law No. 13,709/2018). This notice supplements our Privacy Policy and explains roles, principles, and data-subject rights.
2. Controller and processor
When you send messages through the platform, you are responsible for recipient data: you are the controller and determine the purposes of processing. SMSGo acts as the processor, handling that data strictly according to your instructions to enable message delivery. SMSGo is the controller of your account data.
3. Principles we follow
- Purpose: processing for legitimate, specific, and disclosed purposes;
- Necessity: collection limited to what is necessary;
- Transparency: clear information about processing;
- Security: technical and administrative safeguards;
- Nondiscrimination and accountability.
4. Legal basis for sending messages
Marketing SMS requires the recipient’s consent or another valid legal basis (opt-in). Transactional and verification messages (OTP) may rely on contract performance or legitimate interest. As controller of your contacts, you are responsible for establishing an appropriate legal basis before each send and honoring opt-out requests.
5. Data-subject rights
Under Article 18 of the LGPD, a data subject may request:
| Right | Description |
|---|---|
| Confirmation and access | Confirm whether processing occurs and access the data. |
| Correction | Update incomplete, inaccurate, or outdated data. |
| Anonymization / blocking / deletion | For unnecessary data or data processed unlawfully. |
| Portability | Transfer to another provider, subject to regulation. |
| Deletion | Delete data processed based on consent. |
| Sharing information | Learn which entities received the data. |
| Withdrawal of consent | At any time, free of charge and through an easy process. |
6. How to exercise your rights
We provide self-service channels and direct contact:
- Export personal data: open
My Account > Export datain the dashboard for an immediate structured JSON download. - Delete account and data: open
My Account > Security > Delete account. Password confirmation is required. Personal data is anonymized; financial records remain anonymized for five years due to tax obligations. - Manage cookies: the consent banner appears on the first visit and lets you accept, reject, or customize optional cookies.
For other requests, data subjects may exercise their rights by emailing privacidade@SMSGo.io. We will respond within the legal deadline. For recipient data processed on behalf of a customer (controller), we will forward the request to that customer where applicable.
7. Data Protection Officer (DPO)
Our DPO is the communication channel between data subjects, Oryn Labs, LLC, and Brazil’s National Data Protection Authority (ANPD). Contact: privacidade@SMSGo.io.
8. Security and incidents
We use encryption in transit, access controls, and monitoring. If a security incident may create a material risk to data subjects, we will notify the ANPD and affected individuals under Article 48 of the LGPD.
9. Customer responsibilities (controller)
- Obtain and document a legal basis for processing recipient data;
- Ensure valid opt-in and honor opt-out requests;
- Do not send unlawful content or sensitive data without legal grounds;
- Respond to data-subject requests involving data under your control.
10. Updates
This notice may be revised to reflect legal or operational changes, with the update date indicated. Questions: privacidade@SMSGo.io.