Privacy Policy

UnlockMyIMEI (“we”, “us”) is an online business operated from the State of Florida, United States. For the retail store and for your own account we are the controller of your personal data. For a wholesale or API client that sends us its customers’ device data, we act as that client’s processor under the Data Processing Agreement, and the client is responsible for its customers. Privacy questions and requests: support@unlockmyimei.com.

The IMEI or serial number and an email address are required for every order; without them we cannot perform the service. Model, carrier, lock and blacklist status come from manufacturer, carrier and industry databases, not from you.

• Device identifiers — the IMEI or serial number, model, carrier, country and lock or blacklist status of the phone you order a service for. An IMEI identifies a device, not a person, but together with your email it is personal data and we treat it as such.
• Contact and account details — the email you give for results and updates; for wholesale accounts also your name, business name, country, phone or WhatsApp number, a username and a password (stored only as a one-way hash).
• Verification documents — when a wholesale account is verified we may ask for a phone check and for identity and business documents. They are stored on a private volume on our server and seen only by the staff who review accounts; the review is handled through verifications@unlockmyimei.com.
• Order and payment references — what you ordered, when, the price, the result, and the reference our payment provider gives us (for example a PayPal transaction ID) or the address and transaction hash of a crypto payment; the wallet address you pay from becomes linked to your order in our records. We never see or store full card numbers. Crypto transactions are recorded on public blockchains that we do not control.
• Support and chat — what you write to us by email, in the Track order report, on the contact form or in the chat. Store chat conversations are kept in your browser and removed from our server after about 12 hours; a request to talk to a person, a report about a result or a wholesale enquiry is kept as a support record. Signed-in wholesale clients’ assistant keeps a few facts you tell it (contact name, the phones and services you work with, how you pay) so it can help you next time — ask it to forget them at any time.
• Technical data — your IP address, the approximate location derived from it (by our own server and, when the site runs behind the Cloudflare network, by Cloudflare), browser type, pages visited and the time, sign-in times and devices for account security, and the limits we apply per connection to stop abuse.
• Messaging links — if you link Telegram to your account, your Telegram chat ID, so we can send you order updates there.
• Reviews and testimonials — the name, text, rating and any video you choose to submit for public display.

• To perform your order (contract): send the IMEI and service to the supplier or carrier process that performs it, deliver the result, keep you updated, handle reports and refunds.
• To run accounts and the API (contract): sign-in, balances, statements, invoices, API keys.
• To keep the service safe (legitimate interest): blacklist and ownership checks, fraud and abuse prevention, rate limits, account verification, sign-in monitoring, security records.
• Automated checks — before, during or after an order our systems automatically compare the IMEI with blacklist and lost/stolen data, look for repeated or mismatched orders and apply payment-risk rules. An order that fails these checks is held or refused automatically, and higher-value orders may be held for a person to look at. If that happens to you, you can ask a person to review the decision by emailing support@unlockmyimei.com with the order ID; we tell you the reason as far as the law and fraud prevention allow.
• To support you (contract and legitimate interest): answer questions by email, chat, Telegram or the assistant; the assistant’s replies are generated by an AI provider that receives the conversation to produce the answer (section 4).
• To meet legal duties (legal obligation): accounting and tax records, responding to lawful requests, breach notification.
• To tell you about our services (consent or legitimate interest): order and account emails are part of the service; marketing messages are sent only if you asked for them and every one has an unsubscribe link.

We share personal data only with the parties needed to perform the service or run the site. Our hosting, network, email and AI providers act for us under written data-processing terms. Payment providers, Telegram and the crypto networks you choose act under their own terms as independent services. Unlock and IMEI-data suppliers receive the device identifier and the service name under their own service terms; we choose suppliers that keep the data confidential, and we can ask — but cannot force — them to delete it after the service.

• Unlock and IMEI-data suppliers — the IMEI or serial and the service ordered go to the supplier, carrier process or manufacturer database that performs it. We choose suppliers by reliability and they may be located outside your country. We do not pass them your name or email unless the service requires it.
• Payment providers — PayPal and the crypto networks you pay through process your payment under their own terms; manual payment rails (bank, Zelle, Cash App) use the details you send us.
• Infrastructure — the hosting provider that runs our server (United States), the Cloudflare network in front of it, the email delivery provider that sends our emails, and Telegram for the updates you opt into.
• AI assistant provider — to answer in the chat, the conversation is sent to Anthropic, PBC (United States), which generates the reply. Under its commercial terms it uses the text only to produce the answer, does not train its models on it, and keeps it for a limited period under its own retention policy. We mask IMEIs before sending where the assistant does not need them. When you give an order ID together with the matching email, the assistant looks up that order and its status and details are included in what is sent, so it can answer you about it.
• Authorities and legal claims — carriers, manufacturers, courts or law enforcement when the law requires it, to investigate a device reported lost, stolen or obtained by fraud, or to protect our rights and other customers.
• A buyer of the business — if the business or the site is sold, your data goes with it under this policy.

We do not sell personal data and do not share it for advertising. There are no third-party advertising or analytics trackers on the site.

We are in the United States, so your data is handled here. For customers in the EU, the UK and Switzerland: our hosting, network, email and AI providers hold data under the EU Standard Contractual Clauses (with the UK Addendum) in their contracts with us where those apply, and we give you a copy of the relevant clauses on request. The supplier that performs your unlock or check may be in another country; we send it the device identifier and the service name because your order cannot be performed otherwise. This is a transfer the GDPR allows for the performance of your contract (Article 49(1)(b)); it is not covered by an adequacy decision or by Standard Contractual Clauses, and the supplier keeps the identifier under its own terms. If you link Telegram, your updates go through Telegram’s servers at your request; unlink at any time to stop this. A crypto payment is written to a public blockchain that is visible worldwide and cannot be changed or erased by anyone.

• Orders, invoices and payment references — up to 5 years after the order, for accounting, tax and dispute reasons; then deleted or anonymized.
• Account data — while the account is open and for up to 5 years after it closes where records must be kept; a client may ask for earlier deletion of what we are not obliged to keep.
• Verification documents — while the account is open, so we can show it was verified; deleted when the account is deleted, or earlier on request once the review is complete.
• Store chat — removed from our server after about 12 hours. A copy of the text sent to the AI provider is kept by it under its own retention terms. A request for a person, a report about a result or a wholesale enquiry is kept as a support record while it is useful for support and fraud prevention; you can ask us to delete it.
• Security records, sign-in history and rate-limit counters — a limited period: counters hours, sign-in and security records as long as they are needed to protect accounts.
• Reviews — until you ask us to remove them.

Every connection is encrypted (HTTPS with HSTS and a content-security policy). Passwords are stored as one-way hashes, session tokens are hashed, and staff access is limited by role; money and order changes are written to an append-only audit record. Uploaded documents sit on a private volume that is never served publicly. Rate limits, automated fraud checks and manual review protect accounts and payments; security events our systems detect are shown to our team. Records are disposed of by secure deletion when their retention period ends. No system is perfectly secure, so please use a strong, unique password and tell us at once about anything suspicious.

If a breach happens: we investigate and contain it, and we notify the people affected without undue delay and within the time the law of your state or country requires — in Florida no later than 30 days after we determine that a breach occurred — unless, after investigation and consultation with law enforcement where appropriate, we document that the breach is unlikely to cause harm, or the law otherwise does not require notice. We notify regulators where the law requires it: for EU/UK data, the competent supervisory authority within 72 hours of becoming aware of a reportable breach; in Florida, the Department of Legal Affairs when 500 or more Florida residents are affected. Wholesale and API clients whose customers’ data is affected are told under the Data Processing Agreement.

Wherever you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to a use of it, to withdraw a consent, and to stop marketing. Email support@unlockmyimei.com from the address on your account or message us in the chat; we verify it is you, then answer within 30 days, free of charge. We will not treat you differently for exercising a right. If you disagree with our answer you may ask us to review it and complain to your data-protection authority.

• EU, UK and Switzerland (GDPR / UK GDPR): all of the rights above, and the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): the right to know, delete and correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. In the past 12 months we have not sold or shared personal information. Sources of the data we hold: you, your device, our payment providers, and manufacturer, carrier and industry databases. The only sensitive personal information we collect is your account sign-in and, for wholesale accounts, identity documents used solely to verify the account and prevent fraud. Because we do not sell or share personal data, a Global Privacy Control signal has nothing to switch off; we treat it as an opt-out all the same. We answer verified requests within 45 days, extended once by a further 45 days if we tell you why. You may use an authorized agent.
• Other US states and Florida: the rights given by your state’s privacy and consumer laws; we apply the same process to every request.

Note that we cannot delete order records we must keep by law, that an IMEI sent to a supplier for a completed service may stay in that supplier’s records under its own policy, and that nothing written to a public blockchain can be erased by us.

We use only what the site needs: a sign-in cookie for your account, a cookie for your language, a cookie when you arrive through a referral link (so the referrer gets credit; it lasts the number of days shown on the referral page), and your theme, language and view preferences in your browser’s local storage. Our own visit counter stores a random ID in your browser’s local storage so we can count visits to this site; it is used only for counting on this site, is never joined with your account, your IP address or any other data, and you can remove it by clearing site data. There are no advertising cookies and no third-party trackers.

The site is for adults. We do not knowingly collect personal data from anyone under 13 (COPPA) and do not sell services to anyone under 18. If you believe a child has given us data, write to us and we will delete it.

We update this policy when the service or the law changes. The date at the top shows the current version; a material change is announced on the site or by email to account holders.

UnlockMyIMEI, Florida, United States. Privacy and data requests: support@unlockmyimei.com. Identity and business documents: verifications@unlockmyimei.com. Wholesale and API clients: see the Data Processing Agreement. Every topic is on the Contact page; all legal documents are on the Legal page.