This policy explains what we collect, why we collect it, and what we never do with it. Two different sets of data matter here: information about you as a BurstReach customer, and information about the subscribers you text. We treat them differently, and this page covers both.
When you sign up we collect your name, work email, business name, phone number, and billing address. Payments run through Stripe, so card numbers go straight to them and never touch our servers. We also log your IP address, browser, and the actions you take in the dashboard so we can troubleshoot problems and spot suspicious logins.
We store the phone numbers, names, tags, and custom fields you upload, plus the full history of messages sent and received. We also keep consent records showing when and how each subscriber opted in, because you need that paper trail if a complaint ever comes up.
Your subscriber list is yours. We process it only to deliver your messages and give you reporting. We do not sell it, rent it, share it with other customers, or use it to build our own marketing lists.
We use a short list of vendors to run the service: Twilio and Bandwidth for message delivery, Stripe for payments, Amazon Web Services for hosting in US regions, and Postmark for transactional email. Each one is contractually limited to processing data on our instructions.
Carriers receive the phone number and message body for every text you send, because that is how SMS works. We may also disclose data if a court order or subpoena requires it, and we will tell you when we are legally allowed to.
Message and contact data stays available while your account is open. After you close your account we delete it within 30 days, except consent records and billing history, which we keep for seven years because regulators can ask for them.
You can delete individual contacts or your whole list from the dashboard at any time, and deletions propagate to our backups within 30 days.
Data is encrypted in transit with TLS and at rest with AES-256. Access to production systems requires two-factor authentication and is limited to engineers who need it. We run automated backups daily and log every administrative action.
You can request a copy of your data, correct it, or have it deleted by emailing us. If you are in California, Colorado, Connecticut, Virginia, or a state with similar law, you also have the right to know what we collect and to opt out of any sale of personal information. We do not sell personal information, so there is nothing to opt out of, but the right stands.
Subscribers who want their data removed should contact the business that texted them first, since that business controls the list. If they reach us directly we will forward the request to you and follow up.
Our marketing site uses cookies for analytics and to remember whether you are logged in. The dashboard uses a session cookie that is required for the app to function. We do not run advertising trackers or sell audience data to ad networks.
If we change how we handle your data we will email you 30 days before it takes effect and update the date at the top of this page.
Privacy questions and data requests go to hello@burstreach.com. We respond within five business days.
Back to home
