Privacy policy

Last updated 8 October 2026. VaultoSMS is operated by Ultra Cloud Services Ltd.

What we collect

Your name, email address, optional phone number, account activity (orders, deposits, wallet history), device and browser information, IP address, and the advertising source that brought you to us.

How we use it

To run your account, process payments, deliver codes, prevent fraud, provide support, and measure which of our adverts work. We never sell your personal data.

Payment processors (to credit your wallet), number and service providers (only what is needed to fulfil an order), and advertising platforms (hashed conversion events, never your codes or messages).

Codes and messages

Codes and messages received on your numbers are shown only to you and kept for support and dispute purposes for a limited time.

Vaulto VPN logs

If you use Vaulto VPN we keep, for security and to answer lawful requests, a log of the exit countries and exit IP addresses you used, the data used, and the website names and addresses you connected to, with times. We do not see page contents of encrypted (HTTPS) sites. These logs are kept for up to 90 days (or as set by us for security reasons), are only available to authorised staff, and may be shared with law enforcement where required by law. Using Vaulto VPN for anything illegal is forbidden and leads to account closure.

Data protection (Nigeria Data Protection Act 2023)

Ultra Cloud Services Ltd is the data controller for VaultoSMS and processes personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC). We process your data only for clear purposes and on these lawful bases: to perform our contract with you (your account, orders, wallet and deliveries), to meet legal obligations (payments records, lawful requests), for our legitimate interests (fraud prevention, security logs, keeping the service working), and with your consent where we ask for it (marketing messages and the Vaulto VPN policy). We collect only what we need, keep it accurate, and keep it no longer than necessary: orders and wallet records for as long as the law requires for financial records, VPN security logs for up to 90 days, and marketing data until you opt out. Our servers and some providers (payments, numbers, email, residential IPs) are outside Nigeria; where data leaves Nigeria we rely on the safeguards the NDPA allows and share only what each service needs. We protect data with encryption in transit, access controls, two-factor authentication for staff, and audit logs of staff access. If a data breach is likely to put you at risk, we will tell you and the NDPC as the law requires.

Your rights

Under the NDPA you can ask us to: confirm what personal data we hold and give you a copy; correct it; delete it (unless the law requires us to keep it); restrict or object to how we use it; move it to another service; and withdraw consent at any time (this does not affect what we did before). Contact support from your account email and we will reply within the time the law allows. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Account deletion

You can ask for a copy of your data or for your account to be deleted by contacting support. Some records, such as payments, must be kept for legal reasons.