Privacy Policy

Last updated: 22 August 2026

LapSMS ("we", "us") takes all reasonable steps to protect the personal information of users of lapsms.co.za, app.lapsms.co.za and api.lapsms.co.za (the "Service"). For the purpose of this policy, "personal information" is defined as in the Protection of Personal Information Act 4 of 2013 ("POPIA"). This policy forms part of our Terms of Service.

1. Information we collect

Account information: your name or company name, email address and a hashed password when you create an account.

Usage and billing information: the messages you send through the Service (recipient number, message content, delivery status), your wallet transactions and ledger, and technical logs (IP addresses, timestamps) needed to operate and secure the platform.

Payment information: card payments are processed entirely by Payfast by Network. We never receive or store your card number; we receive only a payment confirmation and reference.

2. How we use it

We use personal information solely to provide the Service: delivering your messages via mobile network operators, maintaining your wallet and billing records, providing support, preventing fraud and abuse, and meeting our legal obligations. We do not sell personal information to anyone, and we do not use your message content or contact lists for marketing.

3. Sharing

Message data is shared with our upstream SMS carrier only to the extent required to deliver your messages to the mobile networks. Payment references are shared with Payfast to process top-ups and refunds. We may disclose information where required by law or a competent authority.

4. Your customers' data

When you upload contacts or send messages, you are the responsible party for that data under POPIA and we process it on your behalf, on your instructions, only to deliver your messages. You warrant that you have the necessary consent from your recipients.

5. Security

All traffic to the Service is encrypted with TLS. Passwords are stored hashed, API keys are stored as SHA-256 hashes, and webhook payloads are signed with HMAC-SHA256. Access to production systems is restricted and logged.

6. Retention

We retain account, message and financial records for as long as your account is active and thereafter as required by South African tax and financial legislation. You may request deletion of your account and associated personal information, subject to those legal retention requirements.

7. Your rights

Under POPIA you may request access to, correction of, or deletion of your personal information, and you may object to processing or lodge a complaint with the Information Regulator (inforegulator.org.za). To exercise any of these rights, email support@lapsms.co.za.

8. Cookies

The dashboard uses strictly necessary storage to keep you logged in. We do not use third-party advertising or tracking cookies.

9. Changes

We may update this policy from time to time; the current version is always available at this page with the date of the last update shown above.

10. Contact

Privacy questions and POPIA requests: support@lapsms.co.za.