Privacy Policy

Last updated 2 October 2026

1. Who this policy covers

SMSuni (smsuni.com.au) is an Australian business SMS service operated by RPEQ Trading Pty Ltd, ABN 31 651 657 519. This policy explains what personal information the service collects, why it is collected, who it is shared with and how it is protected. SMSuni handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Two kinds of people are covered: customers, who hold an SMSuni account, and recipients, whose numbers a customer uploads and messages. SMSuni processes recipient information on the customer's instructions.

2. What is collected

  • Account details — email address, name, company name, phone number, ABN if you verify one, a hashed password and, if you enable it, a two-factor authentication secret.
  • Contacts — the names, mobile numbers, email addresses and custom fields you upload or create for the people you message.
  • Messages — the content of every message you send and receive, the numbers involved, server-side timestamps, delivery states and carrier identifiers, and any opt-out or re-subscription keyword a recipient replies with.
  • Billing — your subscription and purchase history. Card details are entered on Stripe's hosted pages and never reach SMSuni's servers; SMSuni stores a Stripe customer reference, invoice amounts and subscription state.
  • Support — the tickets, messages and email addresses used when you contact support.
  • Technical records — IP addresses, login attempts, security events and API usage, kept to protect accounts and the service. Site analytics are collected by a self-hosted tool that does not use cookies or track visitors across other sites.

3. Why it is used

  • to provide the service: send your messages, receive replies, keep your contact lists and message records;
  • to bill you and to issue tax invoices;
  • to answer support requests and to tell you about changes that affect your account;
  • to keep accounts and the service secure and to detect misuse;
  • to meet legal obligations, including keeping records of consent and opt-outs under the Spam Act 2003 (Cth).

SMSuni does not sell personal information and does not use message content for advertising.

4. Who it is shared with

  • The SMS carrier (Mobile Message, Australia) receives the recipient numbers and message content needed to deliver your messages and to return replies and delivery receipts.
  • Stripe processes payments and holds your billing details under its own privacy policy.
  • Resend delivers transactional email such as verification, password reset and support messages.
  • Hosting — the service and its database run on servers located in Sydney, Australia. Database backups are kept on the same host for 14 days.
  • Where the law requires it — for example to a regulator or under a court order.

No other third party receives personal information from SMSuni.

5. Recipients: consent, opting out and re-subscribing

Customers are responsible for having each recipient's consent before messaging them. A recipient can stop messages from a sender at any time by replying STOP (or UNSUBSCRIBE, CANCEL, END, QUIT, OPT OUT or REMOVE); SMSuni records the opt-out and refuses later messages to that number from that sender. A recipient who wants messages again can reply START, and SMSuni records that consent in the same way. If you received a message through SMSuni and want to know who sent it, or want an opt-out applied, write to the address in section 10 and SMSuni will act on it and refer your request to the sender.

6. How long it is kept

  • Account and contact information is kept while the account exists.
  • Message records are kept as evidence for as long as the account exists; a sent message cannot be edited or deleted, because customers rely on the record.
  • Opt-out and re-subscription records are kept for as long as they are needed to honour the recipient's choice and to show that it was honoured.
  • Backups are kept for 14 days and then deleted.
  • When an account is closed, its information is deleted or de-identified unless a legal obligation requires it to be kept longer.

7. How it is protected

All traffic to and from SMSuni is encrypted in transit. Passwords are stored only as salted hashes. Two-factor authentication is available on every account. API keys and webhook secrets are stored hashed or encrypted and shown only once. Access to production systems is limited to the service's administrators, and the database is backed up daily.

8. Access, correction and deletion

You can view and change your account details, contacts and settings in the dashboard at any time. To ask for a copy of the personal information SMSuni holds about you, to correct it, or to close your account and have it deleted, write to the address in section 10. SMSuni answers these requests within a reasonable time and explains any information it must keep.

9. Complaints

If you believe SMSuni has mishandled your personal information, write to the address in section 10. SMSuni will investigate and reply in writing. If you are not satisfied with the response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Contact and changes

Privacy questions and requests: admin@smsuni.com. This policy may change; the current version is always published at this address with the date it was last updated. The Terms of Service set out the rest of the agreement between SMSuni and its customers.