Privacy Policy

EK Message is a product of Ek Ra Sunya Inc, a company registered in Kathmandu, Nepal. We operate the SMS gateway platform at ekmessage.com and publish two mobile apps. The EK Message customer app for Android and iOS (package com.ekrasunya.sms) lets customers manage their account from a phone. The EK SMS Gateway app (package com.ekrasunya.sms.gateway) is a separate Android app for gateway operators, distributed outside the app stores. This policy covers the web platform and both apps. Our services are for people aged 18 and over; we do not knowingly collect data from children.

If you have questions about this policy or want to exercise your data rights, contact us at [email protected].

When you create an account or use the web platform or the EK Message customer app, we collect and process:

• Account data - your name, email address, phone number and company name provided during registration, plus the name and email of team members you add. We use this to identify your account, communicate with you about the service, and issue invoices. Passwords are stored only as hashes.
• Contacts and recipient lists - names, phone numbers, emails and notes you type or upload into contacts and lists, so you can send to them. The customer app does not read your phone's address book.
• Message data - recipient phone numbers, message content, sender ID, and scheduled send time that you submit when queuing messages, plus delivery status, timestamps and cost. This data is processed to deliver the messages you requested and is stored as part of your message history.
• Sender IDs - the sender names you request and their approval status.
• Identity verification (KYC) - before sending opens we verify who you are. We collect the details you enter (legal or full name, ID type and number, address, phone, business registration, PAN or VAT numbers and an authorized contact) and photos of your ID and registration documents. You take these with the camera or pick them from your photo gallery only when you choose to upload a document. We use them to review and approve your account and to meet telecom and compliance obligations. Documents are stored in a private Cloudflare R2 bucket, or on a private server directory where R2 is not enabled, and are viewable only by authorised EK Message staff.
• Recipient verification codes - when you verify a recipient number with a one-time code, we store the number, a hash of the code (never the code itself), its expiry, attempt count and use time. The code expires after 10 minutes, and the record is kept for a short period afterwards to limit abuse.
• API keys and webhooks - key labels, hashed key material and webhook addresses you configure.
• Billing records - credit balance, top-up transactions, and per-message charge records. These are retained for financial and audit purposes.
• Usage logs and IP addresses - our servers log each API request (time, endpoint, response status and the IP address of the caller) for debugging, security monitoring and rate limiting. Authorization headers, API keys, device secrets and passwords are excluded from these logs. If an EK Message administrator temporarily signs in as a customer for support, we record the administrator's IP address in an audit log. Logs are not used for advertising.

Payments. Credit top-ups are made on the web platform and processed by Khalti. Our systems receive the payment reference and status and credit your balance. We do not receive or store your card or wallet details. The customer app shows your balance and ledger but has no payment screen.

No ads, no analytics. The web platform, the customer app and the gateway app contain no advertising and no third-party analytics or crash-reporting tools. The web dashboard keeps your sign-in token in your browser's local storage; the customer app keeps it in the device's secure storage.

We do not sell your account data, message content, or recipient lists to third parties. We do not use message content to train machine-learning models or for advertising.

The EK SMS Gateway app turns an Android device into a physical SMS gateway that sends messages queued by the paired EK Message account over the device SIM card. It is a separate app from the EK Message customer app and only collects the data below if you install it and pair a device. The customer app requests no phone permissions and has only internet access. Below is a plain description of every permission the gateway app uses and why.

We share data only in the following circumstances:

• Message delivery - recipient phone numbers and message content are transmitted to the recipient via the gateway device SIM or our SMS routing providers (Sparrow SMS and Aakash SMS) and the telecom networks (such as NTC and Ncell) as part of delivering the SMS you requested.
• Push notifications - for the Gateway app only, Google Firebase Cloud Messaging (FCM) is used to deliver dispatch instructions to gateway devices. Message content passed to FCM is limited to what is required to trigger delivery on the device.
• Payments - Khalti processes top-up payments on the web. We share the amount and a payment reference with Khalti to start and confirm a payment.
• Document storage - Cloudflare R2 stores KYC document images when it is enabled.
• Email - transactional email such as password resets is sent through EK Mail, our own mail service, or an SMTP provider we configure.
• Hosting and infrastructure - our platform runs on cloud infrastructure providers. These providers access server data only as needed to operate the infrastructure and are contractually bound to keep it confidential.
• Legal compliance - we may disclose data if required by Nepali law or a valid legal order. We will notify you if permitted by law.

We do not sell personal data to any third party.

Message records, delivery logs, the credit ledger and payment records are retained for operational, billing and telecom-compliance purposes. We do not delete them automatically; they stay until you delete your account, after which they are kept without your name or email (see below).

KYC details and documents are kept while your account is active and are erased when your organization is closed.

Account data is retained for the lifetime of your account. You can delete your account yourself at any time; see Deleting your account.

Gateway device credentials are removed from our servers when a device is unpaired or when you delete your account. Revocation takes effect immediately.

Sign in and open Settings on the web dashboard, or the menu on the Home screen of the EK Message app, then choose Delete account and confirm with your password. Deletion takes effect immediately and signs you out everywhere.

• Team member - your name and email are removed and your login is disabled. Your organization is not affected.
• Only owner of an organization - the organization is closed: every member's name and email are removed, API keys and paired devices stop working, queued messages are cancelled, contacts are deleted, and KYC details and documents are erased. Any remaining credit balance is forfeited and not refunded.

We keep message logs (recipient, text, status, cost), the credit ledger and payment records, because billing and telecom regulations require them. They are no longer linked to your name or email. Records of emails we sent you are kept with personal details (address and content) removed. If you cannot sign in, email [email protected] from your account address and we will delete it within 30 days.

We protect your data with the following controls:

• Encrypted transport - all communication between your browser, our apps, and our servers uses HTTPS/TLS. Plain-text connections are not accepted.
• Credentials at rest - account passwords are hashed using a cryptographic hashing algorithm with per-user salts and are never stored in plain text.
• Revocable device credentials - each gateway device has a unique secret token that can be revoked instantly from the dashboard. Revocation immediately prevents the device from receiving or sending further instructions.
• App-private storage - device credentials in the Gateway app are stored in app-private internal storage, and the customer app keeps your sign-in token in the platform secure storage, isolated from other apps on the device.
• Private document storage - KYC documents are not publicly accessible and are served only to authorised staff through access-controlled endpoints.

We may update this policy from time to time. Material changes will be communicated via email to the address on your account or via a notice in the dashboard. Continued use of the platform or the apps after the effective date constitutes acceptance of the updated policy.

This policy was last updated on 2026-10-05.