bucketmsgbucketmsg

Privacy Policy

Last updated:

This policy explains what personal data bucketmsg processes, why it does so, and what rights you have. It covers the platform and its management panel.

It is written in plain language and describes the system as it actually works today. Where something does not exist yet because the feature has not shipped, we say so rather than promise it.

1. Who operates bucketmsg

bucketmsg is operated by PJMoney Serviços em Tecnologia Ltda. (CNPJ 40.870.650/0001-02), Rua Marechal Rondon 700, sala 307, Jardim Chapadão, 13070-173 Campinas-SP, Brasil, a company established outside the European Economic Area. For anything concerning privacy, including exercising your rights, write to support@bucketmsg.com.

bucketmsg is a multi-tenant bulk messaging platform. It starts with SMS in Spain and is designed to add WhatsApp, Messenger and Instagram as sibling channels. This policy applies to each channel as it goes live.

2. Two different roles, and the distinction decides who answers

We are the controller of your account data: email address, authentication, workspace membership, credit balance, usage and billing. There, we decide the why and the how.

We are the processor of the recipient list you enter and of the text you send to it. There, you are the controller: we only carry out your instruction, which in this product is literal, every campaign you confirm.

This is not legal formality. It means the person who receives one of your messages is your contact, not our customer. If that person asks where their number came from, you are the one holding the answer: we do not know how you obtained it and cannot justify it on your behalf.

We also do nothing with your list that you did not ask for. We do not sell it, we do not cross it with another customer’s, we do not enrich it with third-party data, and we do not use it to train models.

3. What data we process

Today, with the features that are available:

  • Account identification: your email address and, if you provide it, your name. Your password never reaches us: our identity provider stores it, encrypted.
  • If you sign in with Google: the name, profile picture and email address Google sends us after you authorise it. We neither request nor receive access to Gmail, Drive, Calendar or any other service of yours.
  • Workspace data: who is a member and in what role, the credit balance, and every movement that changes it.
  • Campaign data, which is your contacts’ data: the phone number in international E.164 format, the message text, the chosen sender, the delivery status and the cost of each send.
  • Technical operating data: IP address, access date and time, browser type and error logs.

4. What we use it for

  • Authenticating you and keeping your session alive.
  • Delivering the service: analysing the list, computing segments and cost, handing the message to the carrier and recording what happened to it.
  • Charging your balance for what was delivered, and returning to your balance what was reserved for a message that never left.
  • Keeping the platform secure and available: detecting abuse, investigating failures and preventing fraud.
  • Sending essential account messages: email confirmation, password reset and operational notices.

5. On what lawful basis

Under the GDPR: *General Data Protection Regulation* (EU Regulation 2016/679), we process data on the following bases:

⚠️ The lawful basis for contacting your own contacts is yours, not ours. We have a basis to process the list, which is your instruction to us. You need a basis for that list to exist and for messaging those people at all. In Spain a commercial SMS generally requires prior consent or a pre-existing contractual relationship with the recipient, under article 21 of the LSSI: *Ley de Servicios de la Sociedad de la Información* (Law 34/2002), the Spanish information society services act, still in force. The applicable rule follows the country of the recipient, so if you send outside Spain, checking the local rule is part of your responsibility as controller. We do not verify that consent for you and are in no position to do so.

  • Performance of a contract: everything needed to provide the service you signed up for.
  • Legitimate interest: platform security, abuse prevention and service improvement, always balanced against your rights.
  • Legal obligation: retention of tax and accounting records, where applicable.
  • Consent: only where it is asked for clearly and separately. You may withdraw it at any time, without affecting processing already carried out.

6. The people who receive the messages

Whoever receives one of your messages is not a bucketmsg user. They have no account and no password, they never reach the panel, and they do not exist in the system beyond a row in a campaign.

The one right they exercise directly on the platform is the right to stop receiving. A number enters your workspace’s suppression list either through your own action or through us, by writing to support@bucketmsg.com. From that point on it is removed from every later campaign in that workspace before the first message goes out, and the panel reports it back to you as dropped.

The remaining rights, access, rectification and erasure, are exercised against you, because you are the controller of that list. If such a request reaches us instead, we pass it to the workspace concerned and help you answer it.

⚠️ We never write a full phone number or a message body into our diagnostic logs. The number is masked before it is logged, so a log keeps enough to investigate an incident and not enough to identify anyone.

7. Who we share it with

We do not sell personal data and we do not disclose it for advertising. Only the providers needed for the service to work are involved, each limited to its function. No other carrier is active today, and this list will be updated before a message is ever routed through a new one:

  • LabsMobile (Spain): the carrier that delivers the SMS. It receives the destination number, the message text and the sender, because without those three there is no delivery.
  • Stripe (United States, through its local entities): processes the card payment when you buy credit. It receives your billing details and your card data. ⚠️ Card details never pass through bucketmsg: the payment form is Stripe’s, and we never see or store a card number.
  • WorkOS (United States): authentication and identity management. It receives your email address and session data, never the lists or the messages.
  • Neon (Germany, aws-eu-central-1 region, Frankfurt): the database.
  • Fly.io (France, cdg region, Paris): the application servers.
  • Vercel (with distributed delivery): hosting for the web panel.

8. Where it lives and how long we keep it

Business data stays in the European Union: the database is in Frankfurt (Germany) and the application servers are in Paris (France).

Authentication is operated by WorkOS, based in the United States, and the panel is served from Vercel’s distributed network. Those international transfers rely on the European Commission’s Standard Contractual Clauses. Only your email address and session data travel for that purpose: never the recipient lists, never the message text.

⚠️ bucketmsg is operated from Brazil, and that is itself an international transfer. The European Commission has not adopted an adequacy decision for Brazil, so when you, established in the European Union, hand us your recipient list, personal data leaves the Union for a third country. That transfer is covered by the Standard Contractual Clauses of Commission Implementing Decision 2021/914, Module Two (controller to processor), which govern our processing of your lists and are incorporated in full into the Data Processing Agreement annexed to the Terms of Service. Brazil applies its own data protection law to us on top of that, the LGPD (Lei Geral de Proteção de Dados, Law 13.709/2018), which clause 10 explains.

Retention periods:

  • Account data: while the account exists, and up to 30 days after it is closed, so that closing it can be undone.
  • Campaigns, recipients and delivery states: while the workspace exists, because they are the record of what was sent and what was charged. You may ask for them to be deleted sooner.
  • Suppression list: it outlives the campaign that created it and the deletion of your lists. It is the record of who asked not to be contacted, and losing it would mean messaging them again.
  • Technical and security logs: up to 12 months.
  • Tax and accounting documents: for as long as the law requires, normally 6 years in Spain.

9. Your rights

At any time you may: confirm whether we process your data, access it, correct it, ask for its deletion, request portability in a machine-readable format, object to processing based on legitimate interest, request restriction of processing, and withdraw consent.

⚠️ Export and deletion are not self-service yet. There is no button in the panel, and saying so is more honest than offering one that does nothing. Write to support@bucketmsg.com: we answer within 15 days, at no cost. Clause 10 says why 15 and not the 30 the GDPR allows.

If you believe we are handling your data improperly, you may complain to the AEPD: *Agencia Española de Protección de Datos*, the Spanish data protection authority, or to the supervisory authority of the member state where you live.

10. Two laws apply here, and they are not one law twice

Your data is covered by two regimes at the same time, and saying so is more useful than picking one. The GDPR applies because you, and the people you message, are in the European Union. The LGPD: *Lei Geral de Proteção de Dados* (Brazil’s General Data Protection Law 13.709/2018), applies because the company that operates bucketmsg is established in Brazil.

Where the two overlap we apply whichever is stricter, so being covered twice never costs you a protection. Where they genuinely differ, this is the difference that reaches you:

  • The rights listed in clause 9 are the GDPR ones, and the authority for them is the AEPD or the supervisory authority of the member state where you live.
  • The LGPD grants an equivalent set (article 18) and names two the GDPR does not list separately: information about the public and private bodies we shared your data with, and information about what happens if you refuse consent.
  • ⚠️ The deadlines are not the same, so we apply the shorter one. The GDPR gives us one month; the LGPD gives 15 days for a request for access or confirmation of processing (article 19). We answer within 15 days.
  • The Brazilian authority is the ANPD: *Autoridade Nacional de Proteção de Dados*. You may complain to it, but it does not replace the AEPD: an authority inside the Union is closer to you and holds powers over processing in the Union that the ANPD does not.
  • The lawful bases are not translations of each other. Where we rely on legitimate interest under the GDPR, the LGPD equivalent (article 7, IX) carries its own balancing test, which we run separately rather than assume the European answer covers it.

11. Security

All traffic is encrypted in transit (TLS: *Transport Layer Security*). We do not store passwords ourselves. Access to a workspace’s data is restricted to its members, and every request re-checks that membership on the server: the workspace identifier is never taken as the browser sent it.

Our operations team does not access a customer’s lists or messages. A workspace holds personal data about third parties for which that customer answers, and owning the system is not a lawful basis. User impersonation for support purposes is disabled in the product, not merely discouraged.

No system is immune. If an incident occurs that could put the rights of the people concerned at risk, we will notify you and the competent authority within the legal deadlines.

12. Minors

bucketmsg is a work tool bought by businesses and is not directed at anyone under 18. We do not knowingly collect data about minors, and any account found to be in that situation will be removed.

We cannot know the age of the people you message. Checking that your list does not include someone who should not receive that message is part of your responsibility as the controller.

13. Changes

When this policy changes materially we will tell you by email and update the date at the top. Changes that widen the processing of your data take effect only after that notice.