1 About This Policy
This Privacy Policy describes how Monster SMS (operated by Blockstars Technology) collects, uses, stores, and discloses personal information in the course of providing our SMS marketing and communication platform, and when you visit our website.
We are committed to protecting your privacy and handling personal information in an open and transparent manner consistent with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.
By accessing our website at monstersms.ai or using the Monster SMS platform at app.monstersms.ai, you acknowledge that you have read and understood this policy and consent to the collection and use of your information as described here.
Summary: We collect only what we need to run our service, we never sell your data, and we handle all personal information in accordance with Australian law. This page explains exactly what we collect, why, who we share it with, and how you can exercise your rights.
2 Who We Are
Monster SMS is an SMS marketing and AI communication platform operated by:
We are an Australian business, and our primary operations are based in Queensland, Australia. We are subject to the Privacy Act 1988 (Cth) as an Australian Privacy Act entity.
3 Information We Collect
We collect personal information that is necessary for the provision of our services. The information we collect depends on how you use our platform.
Account & Registration Information
- Full name
- Email address
- Mobile or business phone number
- Business name and ABN (where applicable)
- Password (stored in encrypted, hashed form - we cannot read your password)
Messaging & Campaign Content
- SMS message content you create, send, or receive through the platform
- Contact lists you upload, including names and phone numbers of your SMS recipients
- Campaign names, message templates, and scheduling data
- AI auto-reply conversation logs generated by our AI agents
- Inbound SMS messages received on your Monster SMS numbers
Usage & Technical Data
- IP addresses, browser type, operating system, and device identifiers
- Pages visited, features used, session duration, and timestamps
- API access logs and webhook activity
- Error logs and crash reports (used for debugging)
Billing & Payment Information
- Billing name and address
- Payment method details - processed and tokenised by our payment provider; we do not store full card numbers on our servers
- Transaction history and invoices
- Subscription plan and top-up purchases
Communications with Us
- Support tickets, live chat messages, or emails you send to our team
- Feedback, survey responses, and testimonials
- Information you provide when you sign up for our newsletter or promotional communications
Website Visitor Data (collected automatically)
- Pages visited on monstersms.ai and the time spent on each
- Referral source (e.g. Google search, social media link)
- Cookie identifiers set by Google Analytics and Meta Pixel (see Section 9)
- Conversion events such as form submissions and account registrations
Sensitive Information: We do not intentionally collect sensitive information as defined in the Privacy Act (such as health, racial origin, political opinions, or financial details beyond billing). If you or your customers include such information in SMS message content, it is processed solely to deliver your message and is not used for any other purpose.
4 How We Use Your Information
We use the personal information we collect for the following purposes. We will not use your information for purposes incompatible with those listed below without your consent (APP 6).
- Providing the service - creating and managing your account, enabling SMS sending and receiving, operating AI auto-reply agents, and managing your contact lists and campaigns
- Customer support - responding to enquiries, troubleshooting issues, and resolving billing disputes
- Billing and payments - processing subscription payments and message top-ups, issuing tax invoices, and managing account credit
- Platform improvement - analysing usage patterns to fix bugs, improve features, and develop new functionality; all analysis is conducted in aggregated or de-identified form where possible
- Security and fraud prevention - detecting, investigating, and preventing misuse of the platform, spam, and unlawful activity
- Compliance - meeting our obligations under Australian law, including the Spam Act 2003 (Cth), Privacy Act 1988 (Cth), and the Telecommunications Act 1997 (Cth)
- Marketing communications - sending you product updates, feature announcements, and promotional emails where you have opted in; you may opt out at any time via the unsubscribe link in any email or by contacting us (APP 7)
- Analytics & advertising - measuring website performance and campaign effectiveness using Google Analytics and Meta Pixel; optimising paid advertising on Google and Facebook/Instagram
- Legal obligations - responding to lawful requests by courts, government agencies, or regulators, including the Australian Information Commissioner
5 Third-Party Service Providers
To operate our platform and website, we share certain personal information with trusted third-party providers. Each provider is engaged under contractual obligations that require them to handle your information securely and only for the purposes we specify. We do not sell your data to any third party.
The key third parties we use are listed below. Where these providers are located outside Australia, please see Section 11 (Overseas Transfers).
SMS Delivery
Twilio Inc.
We use Twilio, a US-based cloud communications company, to send and receive SMS messages on behalf of our customers. When you send an SMS through Monster SMS, the message content and recipient phone numbers are transmitted to Twilio's infrastructure for delivery. Twilio also processes inbound SMS messages received on your Monster SMS numbers.
Twilio stores message logs and related metadata, which may be retained on servers located in the United States. Twilio is subject to its own privacy policy and is certified under applicable data protection frameworks.
Twilio Privacy Policy →
AI Auto-Reply
Microsoft Azure AI
Our AI auto-reply feature is powered by Microsoft Azure AI services. When you enable an AI auto-reply agent, inbound SMS message content is transmitted to Microsoft's Azure AI platform to generate intelligent responses. This processing is governed by Microsoft's enterprise data processing agreements and privacy commitments, which include data handling and residency obligations.
Message content processed by Azure AI may be temporarily stored on Microsoft's infrastructure during processing. We have configured our Azure services to minimise data retention in accordance with Microsoft's data protection terms.
Microsoft Privacy Statement →
Website Analytics
Google Analytics (GA4)
We use Google Analytics 4 (GA4) (Property ID: G-DXL17NF3KH), provided by Google LLC, to analyse website traffic and user behaviour on monstersms.ai. Google Analytics collects information about your visit including pages viewed, time on site, referral source, approximate geographic location, and device/browser type. This data is used to improve our website and marketing.
Google Analytics sets cookies in your browser (including the _ga and _ga_* cookies) to distinguish unique visitors and track sessions. The data collected is transmitted to and stored on Google's servers, which may be located outside Australia.
You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your cookie preferences.
Google Privacy Policy →
Advertising & Remarketing
Meta Pixel (Facebook Pixel)
We use the Meta Pixel (Pixel ID: 4216175185265137), provided by Meta Platforms Inc. (Facebook), on our website to measure the effectiveness of our advertising campaigns on Facebook and Instagram. The Meta Pixel tracks visitor actions such as page views, form submissions, and account registrations, and may be used to create custom and lookalike audiences for targeted advertising.
Meta Pixel sets cookies in your browser and may collect your IP address, browser information, and identifiers linked to your Facebook account (if you are logged in). This data is transmitted to Meta's servers, which may be located outside Australia.
You can manage your Meta advertising preferences via your Facebook Ad Settings or by using the Digital Advertising Alliance opt-out tool.
Meta Privacy Policy →
Tag Management
Google Tag Manager
We use Google Tag Manager (GTM-PP5H59WS) to manage and deploy tracking scripts on our website, including Google Analytics and Meta Pixel. Google Tag Manager itself does not collect personal information, but it facilitates the loading of the tracking tools described above. All scripts deployed via GTM are subject to the privacy disclosures in this policy.
Google Privacy Policy →
Payments
Payment Processor
Payment card information is securely processed by our payment gateway provider. We do not store full payment card details on our servers. Your card details are tokenised by the payment provider and we only store a reference token and last four digits for billing purposes. Details of our specific payment processor are disclosed at point of sale.
Cloud Infrastructure
Cloud Hosting & Infrastructure
Our platform is hosted on cloud infrastructure (including Microsoft Azure). Personal information stored in the Monster SMS platform (account data, message logs, contact lists) resides on servers in data centres subject to industry-standard security controls. We select providers that maintain ISO 27001 certification or equivalent.
6 Disclosure of Information
We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may disclose your information in the following limited circumstances:
- With your consent - where you have explicitly authorised a specific disclosure
- Service providers - as described in Section 5, to operate our platform and services
- Legal requirements - where required by law, court order, subpoena, or direction from a government authority or regulator (including the OAIC, ACMA, or ATO)
- Protection of rights and safety - to enforce our Terms of Service or protect the rights, property, or safety of Monster SMS, our users, or the public
- Business transfers - if Monster SMS or Blockstars Technology is acquired, merged, or its assets are sold, personal information may form part of the transferred assets. We will notify affected account holders of any material ownership or policy changes before they take effect
- De-identified data - we may share aggregated, de-identified data (which cannot reasonably identify you) with analytics partners or in public reporting
7 Data Retention
We retain personal information for as long as necessary to provide our services, meet legal obligations, and resolve disputes. Our standard retention periods are:
- Account data - retained while your account is active. Upon account closure, core account data is retained for up to 7 years for legal, tax, and regulatory compliance purposes, then securely deleted
- SMS message logs & content - retained for 24 months from the date of sending. You may export your message history at any time before deletion via the platform dashboard
- AI auto-reply conversation logs - retained for 24 months then automatically purged
- Billing records & invoices - retained for 7 years in accordance with the Corporations Act 2001 (Cth) and ATO record-keeping requirements
- Support communications - retained for 3 years from the date of last interaction
- Website analytics data - Google Analytics data is retained per your GA4 data retention settings (default 14 months); Meta Pixel event data is governed by Meta's data retention policies
- Server/usage logs - retained for 12 months, then aggregated or permanently deleted
When we no longer need personal information, we will securely destroy or permanently de-identify it in accordance with our data destruction procedures (APP 11.2).
8 Security
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure (APP 11). Our security measures include:
- TLS/HTTPS encryption for all data transmitted between your browser and our servers
- Encryption at rest for databases containing personal and sensitive information
- Role-based access controls limiting employee access to personal data on a need-to-know basis
- Password hashing using industry-standard algorithms (we cannot retrieve your plaintext password)
- Two-factor authentication (2FA) available for all platform accounts
- Regular security assessments and vulnerability testing
- Secure software development practices including dependency auditing
No method of data transmission over the internet or electronic storage is completely secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security against all threats.
In the event of a data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988).
9 Cookies & Tracking Technologies
Our website (monstersms.ai) and platform (app.monstersms.ai) use cookies and similar tracking technologies to provide core functionality, analyse website usage, and deliver relevant advertising. Below is a summary of the cookies and tracking tools we use.
Essential Cookies
These cookies are strictly necessary for the platform to operate. They manage your login session, authentication tokens, CSRF protection, and user preferences. Without these cookies, core platform features cannot function.
- Session authentication tokens
- CSRF protection cookies
- User preference cookies (e.g. language, timezone)
Analytics Cookies - Google Analytics (GA4)
We use Google Analytics 4 to measure website performance and understand how visitors interact with our site. GA4 sets the following cookies:
_ga - distinguishes unique visitors; expires after 2 years_ga_[ID] - tracks session state for a specific GA4 property; expires after 2 years
Data collected by GA4 is transmitted to Google's servers and used to generate aggregated reports about website traffic, user behaviour, and campaign performance. It does not personally identify you by name or contact details.
Advertising & Remarketing Cookies - Meta Pixel
We use the Meta Pixel on our website to measure the effectiveness of ads we run on Facebook and Instagram. Meta Pixel may set the following cookies:
_fbp - used by Facebook to deliver advertisements; expires after 3 months_fbc - stores the click identifier from Facebook ad clicks; expires after 2 years
If you have a Facebook account, Meta may link your website behaviour to your Facebook profile to serve you targeted ads and to help us build custom audiences. Meta's use of this data is governed by Meta's own privacy policy.
Tag Management - Google Tag Manager
We use Google Tag Manager (GTM) to deploy and manage analytics and tracking scripts. GTM itself does not set any cookies independently, but it enables the loading of the Google Analytics and Meta Pixel scripts described above.
Managing Your Cookie Preferences
You can control and delete cookies through your browser settings. Most browsers allow you to:
- View and delete existing cookies
- Block cookies from specific sites
- Block all third-party cookies
- Set your browser to notify you when a cookie is set
Please note that disabling essential cookies will prevent you from logging into the Monster SMS platform. Disabling analytics or advertising cookies will not affect your ability to use the platform but may affect our ability to personalise your experience.
Additional opt-out options:
10 Your Rights Under the APPs
As an individual whose personal information we hold, you have the following rights under the Australian Privacy Principles:
-
Right of Access (APP 12) - You may request access to the personal information we hold about you. We will provide access within 30 days unless an exception applies (e.g. the information relates to legal proceedings or providing access would be unlawful). We may charge a reasonable fee to cover administrative costs.
-
Right of Correction (APP 13) - If you believe personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant, or misleading, you may request that we correct it. We will take reasonable steps to correct the information within 30 days.
-
Right to Deletion - You may request that we delete personal information we hold about you. We will comply with deletion requests where we are not required to retain the information by law or for legitimate business purposes (such as outstanding invoices or active disputes). To request account deletion, contact us at [email protected].
-
Anonymity and Pseudonymity (APP 2) - Where lawful and practicable, you may interact with us anonymously or use a pseudonym. Note that anonymity is not possible when you have an active Monster SMS account.
-
Opt-out of Direct Marketing (APP 7) - You may opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any marketing email, or by contacting us at [email protected]. Note that transactional communications (such as invoices or security alerts) are not marketing and cannot be opted out of while your account is active.
-
Right to Complain (APP 1) - You have the right to complain if you believe we have breached your privacy rights. See Section 12 for the full complaints process.
To exercise any of the above rights, contact us at [email protected] with the subject line "Privacy Request - [Your Request Type]". We will acknowledge your request within 5 business days and endeavour to resolve it within 30 days.
11 Overseas Transfers
Some of our third-party service providers are located outside of Australia. When we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients are bound by data handling standards that are substantially similar to the APPs, or are subject to a comparable privacy or data protection regime (APP 8).
The overseas recipients and their locations include:
- Twilio Inc. - United States (SMS delivery and message processing)
- Microsoft Corporation - United States and other regions (Azure AI, cloud infrastructure)
- Google LLC - United States (Google Analytics, Google Tag Manager)
- Meta Platforms Inc. - United States (Meta Pixel, Facebook/Instagram advertising)
By using Monster SMS, you acknowledge that your personal information may be processed and stored by these overseas recipients, and you consent to this cross-border disclosure in accordance with APP 8.2(a). Where possible, we contractually require overseas recipients to comply with the APPs in their handling of your personal information.
12 Privacy Complaints & OAIC
If you have a complaint about how we have handled your personal information, or believe we have breached the Privacy Act 1988 or the APPs, please follow this process:
-
Step 1 - Contact us directly. Email [email protected] with the subject line "Privacy Complaint". Please provide:
- Your name and contact details
- A clear description of your complaint
- Any relevant dates or transaction information
- Your preferred resolution
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If we cannot resolve it within 30 days, we will notify you of the reason for the delay and an expected resolution date.
-
Step 2 - Office of the Australian Information Commissioner (OAIC). If you are not satisfied with our response, or if we fail to respond within 30 days, you may lodge a complaint with the OAIC:
The OAIC can investigate complaints, make determinations, and order remedies under the Privacy Act 1988.
Note: The OAIC generally requires you to first contact the organisation before it will investigate a complaint. We encourage you to contact us first so we have the opportunity to resolve your concern directly.
13 Children's Privacy
Monster SMS is a business-to-business platform and is not directed to, or intended for use by, children under the age of 18. We do not knowingly collect personal information from minors.
If you are a parent or guardian and believe that a minor has provided us with personal information without your consent, please contact us immediately at [email protected]. We will take prompt steps to identify and delete such information from our systems.
14 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or business practices. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Post the updated policy at monstersms.ai/privacy-policy
- Send an in-app notification or email to registered account holders for significant changes
Your continued use of Monster SMS after any update constitutes your acceptance of the revised policy. We encourage you to review this page periodically, particularly before providing additional personal information.