Version 1.0In force from 2026-11-01
Privacy Policy
First version.
This is a translation for reference. If it differs from the Mongolian text, the Mongolian text prevails.
Version 1.0. Effective 1 November 2026.
Hi Commerce LLC (the "Company") collects only the minimum data needed to verify phone numbers through 2fa.mn and processes it under the Law on Personal Data Protection. The Company does not sell personal data or use it for advertising.
3.1. Data controller
Hi Commerce LLC, register no. 7180697. Nogoon Nuur, 7th microdistrict /14182/, 11th khoroo, Sukhbaatar District, Ulaanbaatar, Mongolia. Privacy contact: ceo@hihi.mn, 80085517.
3.2. Data we collect
| From | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| End users | Phone number, operator, message text, code, SESSION ID, date and time, verification result | Verify the number and send the result to the Customer | The user's consent by sending the message; contract with the Customer | Message text 90 days |
| End users | Message billing records (CDRs) | Reconcile with operators, handle complaints | Legal obligation | As required by law |
| Customers | Name, phone, email, company name, register no., bank account | Registration, contract, payouts, technical support | Contract | 5 years after the contract ends |
| Customers | Name and register no. checked through ДАН (DAN), only when needed | Identify the customer, prevent fraud | Consent, legitimate interest | 5 years after the contract ends |
| Everyone | IP address, browser, API access logs, webhook URL, response codes | Security, fraud prevention | Legitimate interest | 12 months |
The Company does not collect End users' names, passwords, location or contact lists.
3.3. Who receives data
- Customers: the owner of the app or website where the End user is verifying. Only the result, the phone number and the operator for that verification are shared.
- Mobile operators: to deliver messages and reconcile billing.
- Domestic cloud provider: data is stored on servers in Mongolia.
- Banks: to pay Customers.
- Public authorities: only where the law requires.
The Company does not transfer data outside Mongolia.
3.4. Security
Operator links use IPsec VPN; other connections use TLS 1.2 or higher. Data and backups are encrypted at rest. API keys are stored hashed, and passwords and sensitive data are never stored in plain text. Admin access is limited by VPN and two-factor authentication, and every access is logged. If a data breach occurs, the Company notifies the people affected and the competent authority within the time set by law.
3.5. Your rights
Under the law you may:
- Know what data about you is processed, get a copy and export it.
- Have wrong data corrected.
- Have your account and data deleted. We delete it within 30 days of the request, except billing records the law requires us to keep.
- Withdraw consent. This does not affect processing already done.
- Complain. Send requests to ceo@hihi.mn and we reply within 10 business days. We may confirm your identity by asking you to send a message to 150073.
Your account data in a Customer's app is the responsibility of that Customer; please contact them.
3.6. Cookies
https://2fa.mn and the console use only strictly necessary cookies for login and security. No advertising or tracking cookies are used.
3.7. Minors
Children under 16 need a parent's or guardian's permission before sending a message. Customers using 2fa.mn in services for children must ensure this.
3.8. Changes
Changes to this policy are published on https://2fa.mn 30 days in advance.