Legal

Privacy Policy

Last updated: September 26, 2026

This Privacy Policy explains how SIA BMI Group (“OTPCall”, “we”, “us”) handles personal data in connection with the otpcall.com website, the app.otpcall.com dashboard and the OTPCall API (together, the “Service”).

1. Who we are

SIA BMI Group, registered in Latvia (Reg. No. 40103687008, VAT LV40103687008; Skolas 21 - 501F, Riga, LV-1001, Latvia), is the controller for personal data about website visitors and customer account users. For phone verifications performed on behalf of our customers, we act as a processor (see Section 4).

2. Data we collect

• Website visits. Our hosting and content delivery network record technical data such as IP address, browser user agent, requested page and time. We use it to deliver the website and keep it secure.
• Account data. Name, business email address, company details, billing information and account settings you provide when you register or contact us.
• Usage data. API requests, dashboard activity, IP addresses and security logs needed to operate, bill for and protect the Service.
• Communications. Messages you send us and our replies.

3. Why we use it

• To provide the Service and your account under our contract with you (GDPR Art. 6(1)(b)).
• To bill, keep accounting records and meet tax and other legal obligations (Art. 6(1)(c)).
• To secure the Service, prevent fraud and abuse, and improve our products (legitimate interests, Art. 6(1)(f)).
• To send service and account notices. We send marketing emails only where the law allows, and you can opt out at any time.

4. Verification data we process for customers

When a customer uses OTPCall to verify an end user, we process the end user’s phone number, the verification method, the code or calling number used, call metadata (time, destination country, carrier, duration, status) and the verification result. We process this data on the customer’s documented instructions as their processor, under GDPR Art. 28. The customer is the controller and is responsible for informing its end users. End users who want to exercise their rights should contact the business whose service they used; we will assist that business.

Verification codes are used only during the validity of the verification attempt. Call records are kept for as long as needed for billing, fraud prevention, carrier dispute resolution and legal obligations.

5. Who we share data with

We do not sell personal data or share it for cross-context behavioural advertising. We share it only with:

• Infrastructure providers: Amazon Web Services hosts the website and the Service.
• Telecommunications carriers that place and route verification calls. They receive the phone numbers and call data needed to connect each call.
• Professional advisers and authorities where required by law or to establish, exercise or defend legal claims.

6. International transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, for example to route a call to a US number, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), together with appropriate safeguards.

7. Retention

Account data is kept while your account is active and for a reasonable period afterwards. Billing records are kept as long as Latvian accounting law requires. Server and security logs are kept only for as long as needed to protect the Service. When data is no longer needed, we delete or anonymise it.

8. Cookies

The otpcall.com website does not use cookies, analytics or advertising trackers. The app.otpcall.com dashboard uses only strictly necessary cookies to keep you signed in and protect your session.

9. Security

We use encryption in transit, access controls and monitoring to protect personal data. No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.

10. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, restrict or object to its processing, receive it in a portable format and withdraw consent. This includes rights under the EU GDPR, the UK GDPR and US state privacy laws such as the California Consumer Privacy Act. To make a request, email info@bmi.io. We will not discriminate against you for exercising your rights.

You can also complain to a supervisory authority. In Latvia, this is the Data State Inspectorate (Datu valsts inspekcija). In the UK, it is the Information Commissioner’s Office. You can also contact the authority in your EU country of residence.

11. Children

The Service is designed for businesses and is not directed at children under 16.

12. Changes

We may update this policy. We will post the new version on this page with a new date and notify account owners by email of material changes.

13. Contact

SIA "BMI Group"
Reg. No. 40103687008 · VAT LV40103687008
Skolas 21 - 501F, Riga, LV-1001, Latvia
info@bmi.io