Welcome to Gmnix OTP. These Terms of Service govern your access to and use of our OTP delivery platform, client portal, API endpoints, WhatsApp Cloud API bridge, message logs, account tools, and related services. By creating an account, signing in, using the platform, generating an API token, or sending OTP messages through our service, you agree to these Terms. Service Description Gmnix OTP provides a technical bridge that allows approved clients to send one-time password messages and related transactional verification messages through supported messaging providers, including WhatsApp Cloud API and approved custom providers. The service may include: Client dashboard access. API token generation and usage. OTP sending endpoints. OTP request status endpoints. Message delivery logs. Package and usage tracking. Provider routing based on country, plan, configuration, and account eligibility. Administrative account and billing controls. Account Responsibility You are responsible for maintaining the confidentiality of your account credentials, dashboard access, API tokens, and any related authentication data. Any activity performed through your account, API token, or authorized application is considered your responsibility, unless you notify us immediately of unauthorized access and we confirm that the activity was not caused by your negligence or misuse. You must provide accurate account information and keep your contact and billing details up to date. API Token and Security Your bridge token is confidential and must be stored securely. You must not expose it in public repositories, frontend code, client-side applications, screenshots, public logs, or unsecured environments. You are responsible for implementing reasonable security measures in your own application, including HTTPS usage, secure server-side token storage, access control, and protection against abuse. We may rotate, revoke, suspend, or regenerate API tokens if we detect abuse, compromise, suspicious traffic, unpaid usage, or violation of these Terms. Acceptable Use You may use the service only for lawful OTP, verification, authentication, and approved transactional messaging purposes. You must not use the service to: Send spam, promotional messages, marketing messages, or unsolicited content unless explicitly approved. Send misleading, fraudulent, abusive, illegal, or harmful content. Impersonate another person, company, or service. Attempt to bypass provider rules, country restrictions, rate limits, billing controls, or platform security. Send OTP messages to recipients who did not initiate or expect the verification flow. Use the service for phishing, credential theft, account takeover, harassment, or any unlawful activity. Reverse engineer, overload, scrape, attack, or disrupt the platform or its providers. Recipient Consent and Compliance You are responsible for ensuring that every recipient has a valid reason to receive the OTP or verification message. You must comply with all applicable laws, regulations, telecom rules, data protection requirements, and messaging provider policies in the countries where your recipients are located. You are also responsible for your application’s registration, login, password reset, verification, transaction confirmation, or authentication flow that triggers OTP delivery. Provider Rules Some messages may be delivered through third-party providers such as Meta WhatsApp Cloud API or approved custom providers. Delivery depends on provider availability, account configuration, templates, country support, recipient number validity, messaging limits, payment status, and provider policies. We do not guarantee that every message will be delivered, read, or accepted by the recipient device or provider. Provider errors, delivery delays, rate limits, template restrictions, pricing changes, number restrictions, or policy enforcement may affect service availability. Packages, Usage, and Billing Your usage may be limited by your package, approved custom plan, country access, available message balance, billing status, or administrative approval. Messages may be counted when accepted, queued, sent, delivered, failed, or processed depending on the applicable plan and provider behavior. If your package expires, balance is exhausted, billing is unpaid, payment method is missing, or custom plan is not approved, the service may reject, pause, or limit requests. Fees are non-refundable unless otherwise agreed in writing or required by applicable law. Rate Limits and Abuse Protection We may apply rate limits, duplicate request protection, recipient cooldowns, account throttling, country restrictions, or other controls to protect the platform, providers, and recipients. Requests that exceed limits may return errors such as validation errors, rate limit errors, payment required errors, access denied errors, or provider failures. Message Status and Logs The platform may display message statuses such as pending, sent, delivered, read, failed, or provider-specific states. Statuses are based on provider responses and webhook events. They may be delayed, incomplete, changed later, or unavailable due to provider behavior. Message logs are provided for operational visibility and troubleshooting. They should not be treated as a legal guarantee of delivery, reading, identity verification, or user authentication success. Client Application Responsibility You are responsible for how OTP codes are generated, stored, validated, expired, retried, and consumed inside your own application. The platform may deliver OTP messages, but it does not control your user database, login flow, fraud checks, session handling, authentication policy, or account security logic. You must implement proper OTP expiration, retry limits, lockout rules, fraud monitoring, and secure verification flows. Service Availability We aim to provide a reliable service, but we do not guarantee uninterrupted, error-free, or delay-free operation. The service may be unavailable due to maintenance, updates, provider outages, network issues, security incidents, billing issues, force majeure events, or third-party platform limitations. Suspension and Termination We may suspend or terminate your access immediately if: You violate these Terms. Your usage creates risk to the platform, providers, recipients, or other clients. Your billing is overdue or package is inactive. Your account is suspected of fraud, abuse, spam, or unauthorized activity. A provider, regulator, or legal authority requires restriction. Your traffic violates WhatsApp, Meta, telecom, or other provider policies. You may stop using the service at any time. Outstanding fees or obligations remain due. Data and Privacy Our collection and processing of personal data is described in our Privacy Policy. By using the service, you acknowledge that we may process recipient phone numbers, OTP request metadata, message status data, provider identifiers, error details, account information, and technical logs as needed to provide and secure the service. Intellectual Property The platform, dashboard, API documentation, design, source code, branding, workflows, and related materials are owned by us or our licensors. You may not copy, resell, sublicense, reproduce, or create a competing service using our platform or documentation without written permission. Limitation of Liability To the maximum extent permitted by law, we are not liable for indirect, incidental, special, consequential, punitive, or business losses, including loss of profits, revenue, data, goodwill, users, or business opportunities. Our total liability for any claim related to the service is limited to the amount you paid for the service during the one month preceding the event giving rise to the claim, unless applicable law requires otherwise. No Warranty The service is provided on an “as is” and “as available” basis. We do not guarantee that messages will always be delivered, that providers will always accept traffic, that delivery statuses will always be accurate in real time, or that the service will meet every business, compliance, or authentication requirement. Changes to the Terms We may update these Terms from time to time. Updated Terms may be published inside the platform or made available through the client portal. Continued use of the service after updates means you accept the updated Terms. Contact For questions about these Terms, your account, billing, or service usage, please contact the support team through the available support channels in your account.

This Privacy Policy explains how Gmnix OTP collects, uses, stores, protects, and shares data when you use our OTP delivery platform, client portal, API endpoints, WhatsApp Cloud API bridge, message logs, and related services. By using the service, you acknowledge this Privacy Policy. Data We Collect We may collect and process the following categories of data: Account data: Name, company name, email address, phone number, login details, account role, billing status, package information, and account settings. API and technical data: API token metadata, request timestamps, IP addresses, user agent data, API endpoint usage, request method, response status, error logs, rate limit events, and security logs. OTP request data: Recipient phone number. OTP code or message content submitted through the API, where applicable. Template type, language, purpose, country, provider route, request status, and timestamps. Provider message ID, such as WhatsApp wamid or equivalent provider identifiers. Provider status updates such as pending, sent, delivered, read, failed, or similar states. Provider error codes, error titles, and error details. Usage and billing data: Package type, message balance, used messages, remaining messages, approved countries, custom plan details, payment status, and related operational records. Support and communication data: Messages, tickets, emails, notes, or other information you send to support or account management. How We Use Data We use data to: Provide, operate, and maintain the OTP delivery service. Authenticate accounts and API requests. Send OTP and verification messages. Route messages through the correct provider. Display delivery statuses and message logs. Track usage, packages, balances, and billing eligibility. Detect fraud, abuse, spam, unauthorized access, and security threats. Enforce rate limits, duplicate protection, and country restrictions. Troubleshoot errors and provider failures. Improve platform reliability, performance, and documentation. Communicate with you about your account, service updates, billing, support, and security. Comply with legal, regulatory, provider, accounting, and security obligations. Recipient Phone Numbers and OTP Data Recipient phone numbers are processed to deliver OTP and verification messages requested by your application. You are responsible for ensuring that you have a lawful basis and valid reason to send OTP messages to recipients. OTP codes and message content may be processed temporarily for delivery, logging, troubleshooting, abuse prevention, and provider communication. You should avoid sending unnecessary sensitive personal data inside OTP message content. Provider Processing Some data may be sent to third-party messaging providers such as Meta WhatsApp Cloud API or approved custom providers so that messages can be delivered. Provider processing may include recipient phone number, template information, message content, language, delivery metadata, error details, and provider message identifiers. Third-party providers may process data according to their own terms, privacy policies, security rules, and compliance requirements. Webhooks and Message Status Updates We may receive webhook events and status updates from messaging providers. These updates may include provider message IDs, delivery statuses, timestamps, error codes, error messages, conversation metadata, pricing-related metadata, and other operational information required to update message logs and provide service visibility. Data Retention We retain data only as long as reasonably necessary for the purposes described in this Privacy Policy, including service operation, logs, support, billing, fraud prevention, security, accounting, dispute resolution, provider compliance, and legal obligations. Message logs and technical logs may be retained for operational and audit purposes. Retention periods may vary depending on account type, package, legal requirements, provider requirements, and security needs. Data Security We use reasonable technical and organizational measures to protect data, including access controls, authentication, secure token handling, server-side storage, monitoring, and restricted administrative access. However, no system is completely secure. You are responsible for protecting your own account, API token, application, server, and integration environment. Sharing of Data We may share data with: Messaging providers required to deliver messages. Hosting, infrastructure, database, monitoring, and security service providers. Payment, billing, accounting, or administrative service providers where applicable. Support, operations, or technical personnel who need access to provide the service. Legal, regulatory, government, or enforcement authorities when required by law or necessary to protect rights, safety, security, or prevent abuse. Business successors in the event of merger, acquisition, restructuring, or transfer of assets. We do not sell recipient phone numbers or OTP data. Client Responsibilities As a client, you are responsible for: Informing your own users about how their phone numbers and OTP verification data are processed. Obtaining any required consent or legal basis. Securing your API token and integration. Avoiding unnecessary sensitive data in OTP requests. Implementing secure OTP validation and account protection in your own application. Complying with applicable privacy, telecom, and data protection laws. International Processing Because messaging providers, hosting infrastructure, clients, and recipients may be located in different countries, data may be processed or transferred internationally. By using the service, you acknowledge that such processing may be necessary to provide OTP delivery, status tracking, support, billing, and security. Cookies and Session Data The client portal and admin tools may use cookies or similar technologies for login sessions, authentication, security, preferences, localization, and platform functionality. You can control cookies through your browser settings, but disabling required cookies may prevent the platform from working correctly. Access, Correction, and Deletion Requests Depending on applicable law, you may have the right to request access to, correction of, deletion of, or restriction of certain personal data. Requests may be subject to identity verification, legal retention obligations, provider requirements, security needs, billing records, and technical feasibility. Children’s Data The service is intended for business and application verification use. It is not intended to be used directly by children. Clients must ensure that their own application complies with any laws related to minors or children’s data. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Updated versions may be published inside the platform or made available through the client portal. Continued use of the service after updates means you acknowledge the updated Privacy Policy. Contact For privacy-related questions, data requests, or account concerns, please contact the support team through the available support channels in your account.