Policy / last updated 16 August 2026
Privacy policy
This is the AussieSMS privacy policy required by Australian Privacy Principle 1.3. It covers the people who hold an account and, just as importantly, the people who receive the texts.
Privacy policy body
Who this policy is about
Two different groups of people appear in this service and they are in very different positions.
Account holders. Australian businesses who signed up, agreed to the terms, and buy prepaid credits. They chose to deal with AussieSMS.
Message recipients. The people an account holder texts. They did not sign up, have no account, and in most cases have never heard of AussieSMS. Their mobile number and the words sent to them are nevertheless held here. This policy applies to them too, and the sections on access, correction and complaint are open to them on the same terms.
Whether the small business exemption applies
The Privacy Act exempts most businesses with an annual turnover of $3,000,000 or less. AussieSMS does not rely on that exemption and is not asking you to assume it applies.
Section 6D(4) of the Act removes the exemption from an operator that provides a service in order to collect personal information about another individual from someone else. A business that accepts your customer list in order to text it looks exactly like that, so the honest position is that AussieSMS is bound by the Australian Privacy Principles and this policy is written on that basis.
What is collected and held
From account holders:
- Email address, account and profile details, and sign-in and verification events.
- API key records, message templates, and the operational logs that record what the account did and when.
- Credit balance and transaction records. Card numbers are typed into Stripe and are never received or stored by AussieSMS.
- Anything typed into the report-an-issue tool, which includes a screenshot of the page you were on when you filed it.
About message recipients:
- The mobile number an account holder asked us to text, in whatever form it was supplied.
- The full text of the message, which is whatever the account holder wrote and may contain a name, an address, an appointment, an amount owing or anything else they chose to put in it.
- Queue and transmission records: when it was accepted, when the handset took it, whether the carrier accepted it.
- If a recipient replies to the text, the reply is received by the handset and stored. See the section on replies below, because it does not go where you would expect.
How it is collected
Account information is collected directly from the account holder when they sign up, buy credits or use the dashboard.
Recipient information is not collected from the recipient. It is collected from the account holder, who types it in or uploads a file of it. A recipient will usually have no idea that this happened. That is why the terms and the acceptable use policy make it the account holder's responsibility to have a lawful basis for the contact and to tell their own customers how their information is handled.
Why it is used
To authenticate an account, validate and price a message, charge a credit, put the message on the queue and hand it to the handset that transmits it. To show an account holder their own history and balance, to process a prepaid purchase, to investigate a fault or a complaint, and to protect the service and its recipients from misuse.
Recipient information is used to send the message the account holder asked for and to keep the record of having done so. AussieSMS does not use a recipient list to market anything to anyone, does not build a profile from it, does not sell it, does not share it between accounts, and does not use one customer's list for another customer.
Direct marketing by SMS is governed by the Spam Act 2003 rather than by Australian Privacy Principle 7, which steps aside where that Act applies. What an account holder may and may not send, and the consent they need before sending it, is set out in the acceptable use policy.
Where in the world this information goes
This is the part most policies leave vague, so here it is plainly. The mobile network that carries the text is Australian. The systems that hold the data are not all in Australia. Measured on 16 August 2026:
- Supabase, Singapore. Account records, recipient numbers, message content and the credit ledger. Amazon Web Services region ap-southeast-1.
- Vercel, United States. The web application and its server-side routes. Function region iad1, northern Virginia. Static pages are served from Sydney.
- Stripe, United States. Card payment for a credit pack. Card details are entered on Stripe and are never held by AussieSMS.
- Australian mobile carrier and handset, Australia. The actual SMS transmission. A real Australian mobile service. This part does not leave the country.
Australian Privacy Principle 8 means AussieSMS stays accountable for what those providers do with the information. Under section 16C of the Privacy Act, an act by an overseas recipient that would breach the Privacy Principles is treated as having been done by AussieSMS. Using an overseas provider is therefore not a way of handing the problem to somebody else, and it is not being treated as one.
If your own obligations, or your customers' expectations, require Australian-only data residency, this service does not meet that today. That is a straight answer rather than a qualified one, and it is better that you know before you upload a list than after.
Replies from recipients
Messages are sent from a real Australian mobile, so a recipient can reply to it like any other text. Those replies arrive on the handset. They are not shown in the AussieSMS dashboard, are not forwarded to the account holder, and are not read on the account holder's behalf.
This matters for privacy as well as for missed messages. A recipient replying with something personal, or replying to opt out, is sending it into a place where it is stored and where no process currently acts on it. Do not tell your customers to reply to your texts, and do not treat a reply as having been received by you.
Keeping it secure
Traffic to the site and to the database is over encrypted connections. Account passwords are handled by the authentication service and are not stored by the application in a readable form. Card details are entered on Stripe and never reach AussieSMS. Access to the database is limited to the service itself and to the operator.
AussieSMS holds no security certification, has not been independently audited, and does not claim to be ISO 27001, SOC 2 or Essential Eight assessed. Nobody has verified these arrangements except the operator. If a claim about security matters to your decision, take that sentence as the answer rather than an omission.
If a data breach happens that is likely to result in serious harm, Part IIIC of the Privacy Act applies: an assessment within 30 days of becoming aware of a suspected breach, and notification to the Office of the Australian Information Commissioner and to the people affected as soon as practicable after there are reasonable grounds to believe it happened.
How long it is kept
Account, message and transaction records are kept while the account is open and afterwards for as long as they are needed to answer a billing dispute, a fault or a regulator.
There is currently no automatic deletion schedule. That is a gap rather than a policy, and stating it is more useful than publishing a retention period nothing enforces. Australian Privacy Principle 11.2 requires personal information to be destroyed or de-identified once it is no longer needed, so ask for a deletion and it will be done.
Getting a copy, fixing it, or having it deleted
Anyone may ask what personal information is held about them and ask for a copy of it. That includes a recipient who has never had an account here. Anyone may ask for information that is wrong, out of date or misleading to be corrected.
Email support@nearme-ads.com from the address or about the number concerned, and say what you want. Requests are acknowledged within 5 business days and answered within 30 days. There is no charge for making a request or for a correction. If a request has to be refused, you will be told why in writing and how to complain about it.
Some records may need to be kept after a deletion request where the law requires it, for example financial records, and where that applies you will be told which ones and why.
Complaining
If you think this service has mishandled your personal information, email support@nearme-ads.com with what happened. You will get an acknowledgement within 5 business days and a written answer within 30 days.
If you are not satisfied with that answer, you can take the complaint to the Office of the Australian Information Commissioner, which can investigate it independently.
Cookies and tracking
This site sets the cookies needed to keep you signed in. There is no advertising network, no analytics tracker, no pixel and no third party script collecting anything about your visit. Traffic figures come from the hosting provider's own request logs.
Who operates this service
AussieSMS, ABN 62 105 083 720, is an Australian service operated from South Australia within the NearMe network. Written correspondence can be arranged by emailing the address above. Do not send passwords, API keys or card details to any address that is not published on this site.
This policy is available free of charge on this page and will be provided in another form on request. It sits alongside the service terms and the acceptable use policy.