Privacy policy

Last updated: 12 November 2026

What we collect

• Account data: name, email address and a PBKDF2 hash of your password.
• Integration data: site names, public site keys, allowed origins and verification logs.
• Verification data: the phone number being verified, the code's status and timestamps.
• Technical data: IP address, user agent and rate-limit counters.

Why we collect it

To deliver verification codes, match inbound WhatsApp messages to the correct pending verification, enforce quotas and rate limits, prevent abuse, and show you usage in the dashboard. We do not use verification data for marketing, and we do not sell it.

Where it lives

The service runs on Cloudflare (Workers, D1, KV and Durable Objects). Pending codes expire from KV within 100 seconds. Verification records are retained for up to 90 days so you can debug delivery. Account records remain until you delete them, after which they are soft-deleted and hidden from the product.

WhatsApp

End users send messages to our WhatsApp Business number through Meta's platform. Meta processes those messages under its own terms. We only use the sender number and message text needed to match a verification.

Processors

• Cloudflare — hosting, storage and networking.
• Meta — WhatsApp Business messaging.
• Resend — transactional email.
• Stripe — subscriptions and payment processing.

Your rights

You can request access, correction or deletion of your account data by emailing hello@flipotp.com. Deleting your account removes it from the active product; some records may be retained briefly for backups and audit.