How we handle personal information, clearly, and in line with the Australian Privacy Principles.
Effective 8 October 2026 · Last updated 8 October 2026
This Privacy Policy explains how Peritus Digital Pty Ltd (ABN 58 675 347 716), trading as SMS365 (“SMS365”, “we”, “us”, “our”), collects, uses, holds, discloses and protects personal information. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using our website at sms365.com.au or the SMS365 platform (the “Service”), you agree to the handling of personal information as described here.
SMS365 is a business messaging platform. Personal information reaches us in two different ways, and our responsibilities differ for each:
Your name, business name, email address, phone number, role, and login credentials (passwords are stored only as a secure hash, never in plain text).
Billing contact details, your prepaid credit balance and transaction history, and invoice records. Card payments are handled by our third-party payment processor; we do not store full card numbers on our systems.
Information generated as you use the Service: IP address, device and browser type, log and audit records, API request metadata, timestamps, and diagnostic data used to operate and secure the platform.
Recipient phone numbers, contact lists, sender IDs and message content that you submit for sending, together with delivery and usage records. See section 5.
Records of your correspondence with us, including support requests and their contents.
We collect personal information directly from you, when you register, configure your account, top up credit, contact support, or use the Service. We also collect it automatically as you interact with the website and platform (for example, through logs and cookies). Where practicable we collect personal information directly from the individual concerned; recipient data typically reaches us from our customer rather than from the recipient.
We use personal information to:
We only use personal information for the purposes for which it was collected, for a directly related purpose you would reasonably expect, or as permitted or required by law.
When you send through SMS365, we process the recipient numbers and message content you provide so we can deliver those messages and give you delivery and usage records. We act on your instructions as a processor for this data.
We do not sell personal information. We disclose it only as needed to run the Service, or where the law requires:
Some of our service providers may store or process data outside Australia, for example, in the United States or the European Union. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. By using the Service you acknowledge that, in some cases, we may not be able to guarantee an overseas recipient will not breach the APPs, and that Australian law may not apply to them.
Every recipient is named, with the country it processes in, on our sub-processor list. This paragraph used to promise that list “on request”, which was a worse answer than simply publishing it.
We may send you information about the Service and related offers where you would reasonably expect it or where you have consented. Every marketing message from us includes a simple way to opt out, and you can also opt out at any time by contacting us. We do not use recipient data that you process through the Service for our own marketing.
Our website and platform use cookies and similar technologies to keep you signed in, remember your preferences, and — only where you agree — understand how the Service is used so we can improve it. Analytics and advertising are switched off until you choose, and you can change that choice at any time from cookie settings or the footer of any page.
Every cookie we set, what it is for and how long it lasts is listed in our Cookie Policy. In short: the console carries no analytics or advertising tags, and neither do the pages a message recipient lands on — we do not put a tracking tag in front of someone trying to unsubscribe.
Some parts of the Service use AI, and you can connect an AI assistant of your own. The two are different, and the difference matters, so they are set out separately.
We do not use your data, or your recipients’ data, to train AI models, and the AI providers we use are contractually barred from doing so on their own account. Nothing you send, no contact you upload and no message body is used to improve a model, ours or anyone else’s.
Where you use AI drafting in the composer, or the AI assistant that drafts replies, the text being written and any knowledge-base content you have given it are sent to our AI provider to generate the suggestion. Your contact list and your message history are not. The provider is named in our sub-processor list.
You can connect an assistant such as ChatGPT or Claude to your workspace. If you do:
Data an assistant reads leaves our platform. Once it does, it is handled under that provider’s own terms and privacy policy, not ours, and we cannot control or delete it there. Please read those terms before connecting, and grant the fewest permissions that do what you need. We are not responsible for what a provider you chose does with data you authorised it to read.
We do not make decisions about you by automated means alone that have a legal or similarly significant effect. AI in the Service drafts text for a person to approve; it does not decide who gets messaged, what you are charged, or whether your account continues.
We take security seriously and design for it. Our measures include:
No system is perfectly secure, but we work to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, and to destroy or de-identify it when it is no longer needed.
We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law. Here is how long that actually is.
| What | How long we keep it |
|---|---|
| Message content the text of what you sent, and any picture |
2 years, then purged automatically. You can shorten this to 30, 90 or 180 days, or 1 year, from Settings → Data & privacy — on any plan, at no charge. Two years is the maximum; nothing can be set longer. |
| The record that a message was sent recipient number, status, segment count and cost |
7 years, because it is a billing record we are required to be able to produce. This is what survives the purge above: afterwards the record shows that you texted a number and what it cost, but not what you said. |
| Contacts you upload | Until you delete them, or close your account. You can delete any contact, or export the lot, at any time. |
| Suppressions and opt-outs | Kept indefinitely, on purpose. Forgetting that someone asked not to be contacted is how they get contacted again. Only the number and the fact of the opt-out are held. |
| Account & team records | For as long as the account is open, then 90 days after closure, so an account closed in error can be restored. |
| Billing, invoices and the usage ledger | 7 years from the end of the financial year, as Australian tax and corporate record-keeping requires. |
| Security & audit logs | 12 months. These are what let us answer “who changed this, and when” after an incident. |
| Support correspondence | 2 years from the last message in the conversation. |
You can ask us to erase an individual’s data sooner, and that applies whatever period is set — see section 5 and section 14. When information is no longer needed, we take reasonable steps to destroy or de-identify it.
We maintain procedures to detect, contain and assess data security incidents. If a data breach that is likely to result in serious harm to affected individuals occurs, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of this you can view and update yourself from your account settings. To make a request, contact our Privacy Officer using the details below. We will respond within a reasonable time, and will let you know if we cannot give access or make a correction and why.
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.
We may update this Privacy Policy from time to time. The current version is always published here, with the “last updated” date shown at the top. Where changes are material, we will take reasonable steps to notify you. Your continued use of the Service after a change takes effect means you accept the updated policy.
If you have a question, an access or correction request, or a complaint about how we have handled your personal information, please contact our Privacy Officer:
Privacy Officer, SMS365
Peritus Digital Pty Ltd (ABN 58 675 347 716)
Email: privacy@sms365.com.au
We operate online and take privacy requests by email, which reaches us fastest. If you need to correspond on paper, ask and we will give you an address.
We aim to acknowledge a privacy request or complaint within 5 business days and to resolve it within 30 days, which is the period the Australian Privacy Principles allow for responding to an access request. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or by post at GPO Box 5218, Sydney NSW 2001.