Privacy Policy


SMSMaster.lk (“we”, “us”, “our”) provides a bulk SMS, OTP, and transactional messaging platform for businesses in Sri Lanka, including our website, dashboard, and developer API (together, the “Service”).

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, create an account, or use the Service. By using SMSMaster.lk, you agree to the practices described here. If you do not agree, please do not use the Service.


02. Information We Collect

We collect information in a few different ways, depending on how you interact with us:

  • Account information — Name, business name, email address, phone number, billing address, and password when you register for an account.
  • Verification & KYC data — Business registration documents, NIC/ID details, and Sender ID approval information required to comply with Sri Lankan telecom regulations.
  • Payment information — Billing details and transaction history processed through our payment providers. We do not store full card numbers on our servers.
  • Usage data — Log data, IP address, browser type, device information, and pages visited on our website and dashboard.
  • API & platform activity — API keys, request logs, delivery reports, and campaign configuration data created through the dashboard or API.
  • Communications — Messages you send us via support channels, email, or WhatsApp.


03. How We Use Information

We use the information we collect to:

  • Create and manage your account, and authenticate access to the dashboard and API.
  • Deliver SMS, OTP, and transactional messages on your behalf through our gateway and upstream telecom partners.
  • Process payments, generate invoices, and manage billing.
  • Verify Sender ID requests and comply with telecom regulatory requirements in Sri Lanka.
  • Monitor platform performance, detect fraud or abuse, and maintain the security of the Service.
  • Respond to support requests and send important service notices.
  • With your consent, send product updates or marketing communications, which you can opt out of at any time.


04. SMS & Recipient Data

When you use SMSMaster.lk to send messages, you upload or provide recipient phone numbers and message content (“Campaign Data”). This data belongs to you as the sending business, and you are responsible for having the appropriate consent to message your recipients.

We process Campaign Data solely to route and deliver your messages, generate delivery reports, and provide the analytics shown in your dashboard.

We do not sell Campaign Data or recipient phone numbers to third parties, and we do not use recipient data to send our own marketing messages.



05. Sharing & Disclosure

We share information only in the following circumstances:

  • Telecom operators & SMS aggregators — Routing and delivering messages to recipients.
  • Payment processors — Processing subscription and top-up payments.
  • Cloud & infrastructure providers — Hosting our platform, databases, and backups.
  • Regulators & telecom authorities — Sender ID approval and compliance obligations.
  • Legal & law enforcement — Where required to comply with applicable law.

We require these partners to protect your information and use it only for the purposes we specify. We do not sell personal information.



06. Data Retention

We retain account information for as long as your account remains active, and for a reasonable period afterward to meet legal, accounting, and regulatory obligations.

Message logs and delivery reports are retained for the period required by telecom regulations and for your reporting needs, after which they are anonymized or securely deleted.



07. Security

We use industry-standard safeguards to protect your information, including encryption in transit, access controls on our infrastructure, and regular monitoring for suspicious activity.

API keys should be kept confidential. Never expose your API keys in client-side code or public repositories.

No method of transmission or storage is 100% secure. If you believe your account or API key has been compromised, please contact us immediately.



08. Your Rights & Choices

Depending on your location, you may have the right to:

  • Access, correct, or update the personal information in your account.
  • Request deletion of your account and associated data, subject to regulatory retention requirements.
  • Opt out of marketing communications from us at any time via the unsubscribe link or by contacting support.
  • Request a copy of your data in a portable format.

To exercise any of these rights, contact us using the details below.



09. Cookies

Our website and dashboard use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used.

You can control cookies through your browser settings, though disabling them may affect some features of the dashboard.



10. International Transfers

Our infrastructure and service providers may process data outside Sri Lanka. Where this occurs, we take steps to ensure appropriate safeguards are in place to protect your information in accordance with this policy.



11. Children’s Privacy

SMSMaster.lk is a business-to-business platform and is not directed at children. We do not knowingly collect personal information from individuals under 18 years of age.



12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

We will post the updated policy on this page and revise the “Last Updated” date above. Material changes will be communicated via email or a notice on the dashboard.


13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please reach out to us:


SMSMaster.lk Privacy Team

We typically respond within 1–2 business days.