Privacy Policy

We collect information you provide directly when creating an account, using our services, or communicating with our team. This includes:

• Account information — name, email address, phone number, company name and billing address.
• Payment information — processed securely by our PCI-DSS compliant payment partners. We do not store full card numbers.
• Message content and metadata — messages sent through our platform, including sender IDs, recipient numbers, timestamps, delivery status and IP addresses.
• Usage data — API request logs, dashboard interactions, feature usage patterns and performance metrics.
• Communication records — correspondence with our support, sales and account management teams.

We use the collected information to:

• Provide, maintain and improve our messaging platform and associated services.
• Process transactions, send invoices and manage your account.
• Route and deliver messages through operator networks as requested.
• Detect and prevent fraud, abuse, spam and security incidents.
• Comply with legal obligations under Pakistani telecom and data protection regulations.
• Send service updates, security alerts and product announcements (with opt-out).
• Generate anonymised analytics to improve platform performance and reliability.

We may share your data with the following categories of recipients:

• Operator networks — mobile network operators in Pakistan (Jazz, Zong, Telenor, Ufone) for message delivery.
• Service providers — cloud infrastructure, payment processing, analytics and customer support vendors who act as data processors under our instructions.
• Regulatory bodies — PTA and other government authorities when required by applicable law or valid legal process.
• Professional advisors — legal, accounting and auditing firms bound by confidentiality obligations.

We do not sell your personal information to third parties. All data sharing is limited to what is necessary to deliver our services or comply with legal requirements.

We retain your data only as long as necessary to fulfil the purposes described in this policy or as required by law.

• Account information — retained for the duration of your account plus 90 days after closure for legal purposes.
• Message content and delivery logs — retained for 13 months in accordance with PTA requirements, then securely deleted.
• API request logs — retained for 6 months for operational and security analysis.
• Billing records — retained for 7 years as required by Pakistani tax law.

Vertex implements industry-standard security measures to protect your data against unauthorised access, alteration, disclosure or destruction:

• Encryption in transit via TLS 1.3 for all API and dashboard traffic.
• Encryption at rest using AES-256 for stored message content.
• IP allow-listing, role-based access control (RBAC) and mandatory two-factor authentication.
• Comprehensive audit logging of all platform access and configuration changes.
• Regular penetration testing, vulnerability assessments and security audits.
• ISO 27001 aligned information security management system (ISMS).

As a data subject, you have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your data, subject to legal retention obligations.
• Restriction — request restriction of processing in certain circumstances.
• Portability — request transfer of your data in a machine-readable format.
• Objection — object to processing for direct marketing or legitimate interests.

To exercise any of these rights, contact our Data Protection Officer at dpo@vertex.pk. We will respond within 30 days.

If you have questions, concerns or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@vertex.pk
• DPO email: dpo@vertex.pk
• Phone: +92 21 111 837 392
• Address: 23-C, Main Khayaban-e-Shahbaz, Phase 6, DHA, Karachi, Pakistan

We will acknowledge receipt of your inquiry within 72 hours and respond substantively within 30 days.