Privacy Policy
Effective October 23, 2026. This policy explains what personal information Adhoc Support, LLC, doing business as IoT Message ("IoT Message", "we", "us"), collects, why, who processes it for us, how long we keep it, and how to reach us about it.
1. What we collect
| Information | Where it comes from | Why we use it |
|---|---|---|
| Name, email address, password (stored only as a hash), and Google account ID if you sign in with Google | You | Your account and signing in |
| Your mobile number | You | Verifying it, and sending Free plan alerts to it |
| Your Hologram API key (stored encrypted), and your devices' names, IDs, and tags | You, and Hologram | Reading your device events and associating recipients with devices. The key is used only for the requests listed under Settings, Device platform, each counted and shown to you there: reading, and, once you turn it on, pausing a SIM when one of your triggers says to and resuming a SIM we paused, and sending your devices the texts that numbers on your Relay list send |
| The numbers on your Relay list, and the texts they send to your devices | You, and the people who text from those numbers | Sending each text on to the device it names and replying to the sender. A text's words are deleted 30 days after it arrived; the record of who texted which device, and what happened, stays. A text from a number on no list is not kept |
| Recipients' names, email addresses, mobile numbers, WhatsApp numbers, and the language for WhatsApp messages | You, or the recipient through your opt-in link or our public signup page (where the mobile number is optional) | Sending your alerts |
| Consent records: the time, IP address, and the consent text agreed to | The recipient, or you when you add a recipient | Showing that a recipient opted in |
| Device event data, data session times and data use, which may include location and sensor readings | Your device platform: Hologram, or another platform that sends webhooks to your account | Evaluating your triggers and showing your Activity; for webhooks from another platform, also checking each against the rules for your account, and keeping it, accepted or refused, for our review |
| A request for WhatsApp: expected alerts a month, the countries recipients are in, and what the alerts are for | You | Deciding whether to approve WhatsApp for your account, and its price |
| The name of another device platform you tell us about | You | Weighing an integration with it, and turning on a webhook address for your account |
| Message text and delivery status | Our service, and Twilio | Sending messages, delivery statistics, and support |
| Payment information. We store only Stripe's reference IDs, never card numbers | Stripe | Billing |
| Contact form and support messages, and files attached to them: name, email address, company, and message | Anyone who writes to us, and us | Replying to inquiries and support requests |
| Referral records: who referred an account, the IP address it signed up from, and Stripe's card fingerprint (not the card number) | Sign-up, and Stripe | Crediting referral rewards and preventing self-referral |
| Marketing contacts: the email address, name and company of people who are not customers that we add to a mailing list, and whether they unsubscribed | Us, from people who gave us their address or asked to hear from us | Sending them email about IoT Message |
| Whether a marketing email was opened, and which of its links were followed | Resend | Knowing which emails are read. Opens are an estimate, since many email programs hide them |
| IP addresses, browser user agents, and the pages requested | Every request to our website | Security, preventing abuse, and understanding traffic |
Our account, alert and billing emails carry no tracking pixels. Marketing email counts opens with an image Resend loads, and clicks by sending each link through Resend first. Our website runs one tool from another company, Google's tag for Google Ads (section 2), and no other analytics or advertising trackers.
2. Cookies
We use four cookies of our own: one that keeps you signed in, one that remembers the plan you picked on Pricing for a day, one that remembers a referral link you opened, for as long as the referral program says (now 30 days), and one that remembers your answer about Google's cookies, for a year. Your light or dark choice is kept in your browser.
When we run ads, we ask before Google's tag for Google Ads runs on our public pages and on the page a new account opens after signing up. If you allow it, it sets Google's cookies, which record that you came from one of our ads and whether you then created an account, so Google can count what our ads led to. Google handles that information under its own privacy policy. The tag does not run on the rest of the dashboard. To change your answer, use Ad cookies at the foot of a public page.
3. Who processes information for us
- Twilio sends text messages, WhatsApp messages, and phone verification codes.
- Meta delivers WhatsApp messages, as the operator of WhatsApp, and handles them under its own privacy policy.
- Stripe processes payments.
- Resend sends our emails, and keeps the addresses on our mailing lists and counts opens and clicks of marketing email.
- Google hosts the service and its data (Google Cloud, in the United States), provides sign-in for customers who choose it, stores our encrypted backups, and measures our Google Ads campaigns through its tag.
- Your device platform provides your device data, at your direction: Hologram, or another platform that sends webhooks to your account. When we add an integration with another platform, this policy names it before we use credentials you give us for it.
- Webhook addresses you enter receive your alerts and the events they came from, at your direction. Whoever runs that address handles them under their own terms; we do not.
We do not sell personal information. The one use for advertising is Google's tag, which tells Google when a visit from our ad leads to a sign-up.
4. How long we keep it
- Device event data: 30 days. A summary of each event (its type, device, and time) is kept for the life of your account.
- Webhooks from another platform: each, with its headers and body, 30 days, whether or not it reached your account.
- Message records: for the life of your account.
- Files on a support request: with the request; deleted with your account.
- Your Hologram API key: deleted when you disconnect Hologram or delete your account. Encrypted backups that contain it are gone within 30 days.
- Signups from our public signup page: 30 days, whether or not a customer approved them.
- Opt-out records: kept indefinitely. If someone replies STOP we have to remember it, so that they are not messaged again, even if the customer who messaged them closes their account.
- Website request logs: 30 days.
- Backups: 30 days.
- After you delete your account: personal information is removed 30 days after your request.
- Billing records: as long as required for tax and accounting.
- Marketing contacts: until they unsubscribe or ask us to delete their address. An unsubscribe is kept, so they are not added again. Deleting an account removes it from every list.
5. If you receive alerts
If you receive text or WhatsApp alerts sent through IoT Message, you are receiving them on behalf of one of our customers, who added you or whose opt-in form you completed. Your name and number pass through our service so we can deliver those alerts.
- To stop receiving alerts, reply STOP to any message. To start again, reply START.
- We never use your number or information to message you for any purpose other than that customer's alerts.
- For questions about your information, email privacy@iotmessage.com.
6. Your choices and how to reach us
- Marketing email: customers receive email about IoT Message, which they turn off in Settings or with the unsubscribe link in each one. Anyone on a mailing list leaves it with that link. Account, alert and billing email is not marketing, and keeps coming while you have an account.
- Access, correction, and deletion: email privacy@iotmessage.com. We answer within 30 days.
- Security: information is encrypted in transit; API keys and backups are encrypted at rest; passwords and access tokens are stored only as hashes; and access is limited to named administrators.
- Children: IoT Message is not directed to anyone under 18.
- Changes: we will tell customers about material changes to this policy by email.
Adhoc Support, LLC, doing business as IoT Message. privacy@iotmessage.com. A postal address is available on request.