Terms & policies

Terms of Service

By creating an account or calling our API, you agree to these Terms. We're Eveses Inc., a Delaware corporation (1209 N Orange St, Wilmington, DE 19801, USA). The Service is the SMS infrastructure described at eveses.com.

Nature of the service — reseller

Eveses is an independent marketplace and reseller. We do not own, issue, or operate the underlying phone numbers or telecommunications infrastructure — those are supplied by independent third-party providers. Our role is limited to aggregating suppliers’ offers, processing orders, and providing support. Nothing in these Terms makes Eveses the original provider of any number. We operate lawfully and cooperate in good faith with service owners, providers and authorities. See our Reseller & Responsible-Use Statement.

1.1 Your account

You must be at least 18 and provide accurate billing information. Keep your API keys secret — anyone with your key can spend your balance. You can rotate keys anytime from Developer settings. We'll never ask for your key over email.

1.2 Billing & refunds

• Pre-paid wallet. All usage debits the balance you topped up. No invoicing surprises.
• SMS activations. If no SMS arrives within the timer (typically 5–20 min depending on service), you receive an automatic full refund to your wallet.
• Long-term rents. Rent fees are non-refundable once provisioned. SMS received during a rent period are included in the price.
• Top-up refunds. Unused wallet balance is refundable for 90 days after deposit, less payment-processor fees, by request to [email protected].
• Volume tier. Discounts apply automatically based on rolling 30-day spend. Tier downgrade is recalculated daily.

1.3 Suspension & termination

We may suspend an account that violates the Acceptable Use Policy, fails fraud screening, or enters chargeback dispute. We'll send you the reason and a path to appeal within 24 hours. You can close your account at any time from Profile; remaining wallet balance is refunded per §1.2.

1.4 Service levels & liability

• Uptime target: 99.95% on the API, measured monthly (see status).
• Service credits: below 99.9% in a calendar month → 10% wallet credit; below 99.0% → 25%.
• No warranty on third-party SMS routing — carriers occasionally drop messages. Our refund policy (§1.2) is your remedy.
• Liability cap. Aggregate liability is limited to fees paid in the prior 12 months.

Indemnification

You agree to defend, indemnify and hold harmless Eveses and its officers, employees and agents from any claims, liabilities, damages, losses and expenses (including reasonable legal fees) arising out of or related to your use of the services, your content or data, or your violation of these Terms, the Acceptable Use Policy, or any applicable law or third-party right.

Sanctions & export compliance

You represent that you are not located in, and will not use the services from or on behalf of, any country or party subject to comprehensive sanctions or trade restrictions, and that you are not a person with whom dealings are prohibited under applicable sanctions laws (including US OFAC, EU and UK regimes). We may refuse, suspend or terminate service, and freeze affected transactions, to comply with these laws.

Governing law: Delaware, USA. Disputes go to arbitration (AAA Commercial Rules) in Wilmington, except small-claims and IP matters.

Privacy Policy

We collect the minimum we need to run the service, never sell your data, and let you export or delete it on request.

2.1 What we collect

• Account: email, password hash, optional 2FA secret, IP & user-agent of last 30 sign-ins.
• Billing: payment-method metadata via our processor (Stripe / Heleket) — we never store full card numbers or wallet seeds.
• Usage: orders, SMS bodies received on your behalf (encrypted at rest, purged after 30 days), webhook delivery logs (14 days), API logs (7 days, 30 days for paid plans).
• Cookies: 1 session cookie, 1 theme cookie, 1 CSRF cookie. No third-party analytics on the cabinet.

2.2 Sharing & sub-processors

We share data only with these sub-processors, listed at §4 DPA Annex A:

• AWS (us-east-1, eu-central-1) — hosting
• Stripe — card payments
• Heleket — crypto payments
• Postmark — transactional email
• SMS routing carriers — list available on request, NDA-gated
• Google Analytics and PostHog — site and product analytics
• Self-hosted support chat and frontend telemetry — run on our own servers (US and Canada respectively)

2.3 Your rights (GDPR / CCPA)

• Access & export: request a JSON dump of everything we have on you — replied within 30 days.
• Deletion: close your account and we purge personal data within 30 days; financial records retained 7 years (US tax law).
• Rectification: edit profile any time, or email [email protected].
• Objection: opt out of any non-essential processing.

EU representative: Eveses Europe OÜ, Tartu mnt 67, 10115 Tallinn, Estonia. Lead supervisory authority: Estonian Data Protection Inspectorate.

Acceptable Use Policy

Don't break laws, hurt people, or make our routing partners block our IP space. Specifics below.

3.1 What you can do

• Verify accounts on services where SMS verification is allowed by that service's ToS
• QA / load-test your own apps with disposable numbers
• Privacy-protect your real number when signing up to non-critical services
• Run multi-region testing for marketing or SEO research
• Receive 2FA for accounts you own or are authorized to access

3.2 Prohibited

• Account takeover of accounts you don't own (CFAA / 18 USC 1030)
• Bank / payment fraud — including fake KYC, fake POS verification, money-laundering layering
• Spam, smishing, A2P traffic — Eveses delivers inbound SMS only; you cannot send
• CSAM, terrorism, weapons trafficking — automatic permanent ban + report to authorities
• Government-restricted services in your jurisdiction (e.g. unlicensed gambling)
• Resale of numbers as a wholesaler without a written reseller agreement
• Abusing refund mechanism with bot loops

3.3 Enforcement

• Tier 1 — soft-flag: we email you with the rule and ask for clarification. Service continues.
• Tier 2 — pause: new orders blocked, existing orders honored. Cleared by responding to the flag email within 7 days.
• Tier 3 — terminate: account closed, refundable balance returned, IP space blocked. Used for clear-cut prohibited use or unanswered Tier 2.

Report abuse: [email protected] · we triage within 24 h.

Data Processing Addendum

This DPA forms part of the Terms whenever your use of Eveses involves processing personal data of EU/UK/Swiss residents on behalf of your end users.

4.1 Roles

• You are the Controller — you decide whose phone numbers get verified and why.
• Eveses is the Processor — we route SMS through carriers on your instruction.
• Carriers are sub-processors — they relay messages but cannot read your account context.

4.2 Technical & organisational measures

• Encryption: TLS 1.3 in transit.
• Access control: SSO + hardware key 2FA mandatory for all employees with prod access.
• Logging: every prod access event recorded; retention 1 year.
• Backups: daily, encrypted, 30-day retention. RTO 4 h, RPO 24 h.
• Incident response: notification within 72 h of confirmed breach (GDPR Art. 33).
• Pen-tests: annual external red-team + continuous internal SAST/DAST.

4.3 International transfers

Data of EU residents is stored primarily in eu-central-1 (Frankfurt). Two self-hosted services sit outside the EU — the support chat in the United States and the Faro telemetry collector in Canada. Transfers to the US rely on the EU—US Data Privacy Framework + Standard Contractual Clauses (Module 2 / Module 3 as applicable); transfers to Canada rely on the European Commission's adequacy decision for Canadian commercial organisations. UK extension and Swiss addendum included.

Annex A · Sub-processor list

We give 30 days notice before adding new sub-processors. Subscribe for updates: [email protected].

Third-party trademarks

References to third-party products and services throughout the Eveses platform are made solely for identification and compatibility purposes. Eveses does not claim ownership of any third-party trademarks, and such references do not imply any affiliation with or endorsement by the respective trademark owners. See our Trademark Notice for details.