Privacy Policy

1. Who We Are

10DLCwizard ("we", "us", or "our") operates the A2P 10DLC registration platform available at 10dlcwizard.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

If you have questions about this policy, contact us at privacy@10dlcwizard.com.

2. Information We Collect

Account Information

When you register, we collect your name, email address, and a hashed password. We never store your password in plain text.

Twilio Credentials

If you connect a Twilio account, we store your Account SID and either your Auth Token or API Key Secret. All secrets are encrypted at rest using AES-256-GCM with a per-record IV and authentication tag before being written to our database. Your decrypted credentials are only used to make API calls on your behalf and are never logged or exposed in responses.

Business and Campaign Information

To register A2P 10DLC brands and campaigns through Twilio, we collect and process: company name, EIN (Employer Identification Number), website URL, campaign use-case descriptions, opt-in language, and messaging service identifiers.

AI-Analyzed Website Data

When you use our AI compliance check, we scrape the public pages of the URL you provide and send that content to a third-party AI provider for analysis. Signed-in full scans are processed by Anthropic's Claude API; anonymous quick scans on our homepage are processed via OpenRouter, which routes the request to one of several model providers. We store the AI's assessment (suggested campaign fields and compliance notes). We do not store raw scraped HTML beyond the current request.

Scan Report Email Addresses

If a scan is taking a while, we offer to email you the report. Providing your address is entirely optional; the scan runs and displays either way. When you do provide one, we store it alongside that scan solely to deliver that report, together with the IP address the request came from so we can prevent our scanner being abused to send unwanted mail. One scan can only ever be emailed to a single address.

Separately, and only if you tick the clearly-labelled box (which is never pre-ticked), we record your consent to receive occasional 10DLC compliance tips, along with the date and IP address of that consent. You can withdraw it at any time via the unsubscribe link in any such email. Withdrawing consent does not affect reports you explicitly request.

Usage and Technical Data

We automatically collect IP addresses, browser type, pages visited, and timestamps of actions (logins, submissions, API calls). This data is used for security, debugging, and service improvement.

Cookies and Local Storage

We use session cookies and browser local storage to maintain your authentication state. We do not use third-party advertising cookies.

3. How We Use Your Information

• Service delivery: To authenticate you, call the Twilio API on your behalf, and manage your brand and campaign registrations.
• AI compliance checks: To analyze your website against A2P 10DLC carrier requirements and pre-fill campaign fields.
• Status polling: To automatically check the status of pending submissions every 30 minutes and update your dashboard.
• Security: To detect and prevent fraud, unauthorized access, and abuse.
• Communication: To send transactional emails about your account and submission status changes.
• Scan reports you request: To email you the compliance report for a scan you ran, when you ask us to. This is transactional: we send it because you requested it, and it is not marketing.
• Compliance tips (opt-in only): If, and only if, you explicitly tick the opt-in box, to send occasional educational emails about A2P 10DLC compliance. Every one carries an unsubscribe link, and we never add you to this list by default or as a condition of receiving your report.
• Service improvement: To understand how our platform is used and fix issues.

4. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

• Twilio, Inc.: We submit your brand and campaign registration data to Twilio's A2P API directly on your behalf. Twilio's own privacy policy governs how they process this data.
• AI providers: Website content you submit for AI analysis is sent to Anthropic's Claude API (signed-in full scans) or to OpenRouter, Inc. and the model provider it routes to (anonymous quick scans). Those providers' API usage policies apply.
• Resend, Inc.: If you ask us to email you a scan report, your email address and the report are transmitted through Resend, our email delivery provider, solely to deliver that message.
• Infrastructure providers: We use cloud hosting providers (VPS/database) to operate the service. These providers act as processors under appropriate data agreements.
• Legal requirements: We may disclose information if required by law or to protect our legal rights.

5. Data Security

We implement the following security measures:

• AES-256-GCM encryption for all stored Twilio credentials, with per-record initialization vectors and authentication tags.
• Bcrypt password hashing with appropriate work factors.
• Short-lived JWT access tokens (15 minutes) with rotating refresh tokens (7 days) stored server-side for revocation.
• TLS encryption for all data in transit.
• Database access restricted to the application server; no public database endpoints.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

6. Data Retention

We retain your account data for as long as your account is active. Submission records (brand and campaign registration history, Twilio responses) are retained to give you an audit trail of all registration activity.

Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your account and associated data.
• Export your data in a portable format.
• Withdraw consent for processing where consent is the legal basis.

To exercise these rights, email privacy@10dlcwizard.com. We will respond within 30 days.

8. Children's Privacy

Our service is intended for business use by adults (18+). We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or by posting a notice in your dashboard. Your continued use of the service after changes become effective constitutes acceptance of the updated policy.

10. Contact

If you have questions or concerns about this Privacy Policy or your data, please contact us at: