Privacy Policy

Effective date: January 1, 2026 · Version 1.0

This Privacy Policy explains how Dylan Pollock, a sole proprietor doing business as Elevated SMS Marketing in Ontario, Canada ("we", "us"), collects, uses, and shares information when you use our website and the Elevated SMS Marketing platform (the "Service").

1. Who we are

Elevated SMS Marketing is the Owner / Custodian (under PIPEDA) for information you provide directly to us as a customer. When our customers (businesses) use the Service to send SMS messages to their own end-user contacts, those customers are the Owner / Controller of that contact data and we act as a service provider / agent on their behalf.

2. Information we collect

Information you give us

Account information: first and last name, business name, email address, mobile phone number, password (stored hashed only).
Billing information: handled directly by Stripe. We never see or store full card numbers; we receive only a Stripe customer ID and the last four digits of the card from Stripe.
Contact lists you upload, including phone numbers, opt-in source, opt-in date, and any list/segment metadata you create.
Message content you create and send through the Service, plus any inbound replies received from your recipients.
Support correspondence with us.

Information we collect automatically

Log data: IP address, browser user-agent, pages visited, timestamps. Used for security and abuse prevention.
Cookies: a session cookie required to keep you logged in, and a "remember me" token if you check that box at login. We do not use third-party advertising cookies.
Time zone (auto-detected from your browser to display data in your local time).
Terms-of-Service acceptance log: the IP address, user-agent, and timestamp captured when you click "Agree" at signup. We retain this as evidence in case of a chargeback dispute.

Information from third parties

Stripe: payment status, subscription state, dispute notifications.
Telnyx: message delivery receipts, inbound replies, carrier opt-out events.

3. How we use information

To provide the Service (deliver messages, render dashboards, generate QR codes, run scheduled campaigns).
To bill you and prevent fraud (via Stripe).
To send you transactional emails (password reset, payment confirmations, important account notices). We do not send marketing email without your separate consent (CASL).
To investigate abuse, comply with legal obligations, and enforce our Terms.

We do not sell personal information. We do not share your contact lists with any other customer.

4. How we share information

Telnyx (United States) — to deliver SMS messages on your behalf.
Stripe (United States) — to process payments. See Stripe's privacy notice for details.
Microsoft 365 (Outlook) — for transactional email delivery.
Render (United States) — our cloud hosting provider, where the application and database live.
Law enforcement — when required by valid legal process under Canadian or U.S. law.
Successors — if the business is sold or transferred, your information may transfer subject to this Policy.

5. International transfers

The Service is hosted in the United States. By using the Service from Canada or anywhere else, you consent to your information being transferred to and processed in the United States. We use providers (Stripe, Telnyx, Render, Microsoft) that participate in industry-standard cross-border data transfer mechanisms.

6. Retention

We retain your account information for as long as the account is active. After account closure, we delete your contact lists, message history, and inbound replies within 30 days, except where law requires longer retention (typically 5 years for billing records and 3 years for CASL consent records).

7. Security

We use industry-standard practices: passwords stored with one-way hashing (Werkzeug PBKDF2), HTTPS with HSTS for all traffic, CSRF protection on every form, rate limiting on auth endpoints, and signed payloads on Telnyx and Stripe webhooks. No system is 100% secure; you accept this risk by using the Service.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information. To exercise any of these rights, email dpollock@elevatedsmsmarketing.com from the email on file. We respond within 30 days.

Canadian residents (PIPEDA / Quebec Law 25): you have the right to access and correct your personal information held by us, withdraw consent, and lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial commissioner.

California residents (CCPA/CPRA): we do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete, correct, and opt out of the (non-existent) sale of personal information. To make a verifiable consumer request, email us with the subject "California Privacy Request".

EU/UK residents (GDPR/UK GDPR): our lawful bases are contract performance (account, billing) and legitimate interest (security, fraud prevention). You may lodge a complaint with your local supervisory authority.

9. Children

The Service is not directed to children under 18. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

10. End-user contact data (when you are a recipient of one of our customers' SMS)

If you received a text message from a business that uses Elevated SMS Marketing, that business — not Elevated SMS Marketing — controls your information. To opt out, reply STOP to the text. To request deletion, contact the business directly. We act on the business's instructions and cannot grant requests on their behalf.

11. Changes

We may update this Privacy Policy. Material changes will be announced by email or in-app notice. The "Effective date" above always reflects the latest version.

12. Contact

Elevated SMS Marketing — Dylan Pollock, Sole Proprietor — Ontario, Canada — dpollock@elevatedsmsmarketing.com.