Legal

Privacy Policy

Version 2026-10-19.4

You cannot create an account or sign in unless you accept this policy and the terms. called.app takes no liability for how call information is used. Acceptance is recorded.

1.What this policy covers

This policy describes the personal information called.app handles when you visit the public site, create a workspace, sign in, attach a number, or make and receive calls. It is written for the European Union, including the General Data Protection Regulation.

Two roles sit side by side. For your account — your name, your login, your company — we decide why that information is used, so we are the controller. For the people you call and the people who call your numbers, you decide why their information is used. We handle it so the workspace can do the thing you asked. That split is set out below, and it matches the terms: the calls, the data, and the actions are yours.

This version is dated 2026-10-19.4. The copy published at called.app/privacy is the one that applies.

2.Who we are

called.app operates the workspace. The public site says the service is made and hosted in the European Union. Privacy requests and questions about the terms both go to hello@kalled.app. If we appoint a data protection officer, we will name that person here.

3.Signing in records your acceptance

Creating an account, and each later sign-in, is your acceptance of the terms and of this policy as published that day. We store a record of that acceptance because we must be able to show which version you agreed to.

The account that signed in.
The version of the terms and the version of this policy.
Whether the acceptance was a new account or a later sign-in.
The date and time.
The network address presented with the request, when one is available.
The browser description presented with the request, when one is available.

We keep each acceptance record for as long as the account exists and for six years after it closes, so that a dispute about what was agreed can still be answered. The lawful basis is the contract (the sign-in is how the contract is formed) and our legitimate interest in showing what was accepted. This record is not used to advertise to you.

4.Your account

When you create a workspace we ask for your name, work email, phone number with country code, company name, company size, tax number, and a password, unless you continue with Google. The country of the phone number is stored with the account. We use this information to open the workspace, to sign you in, to reach you about the account, and to know which company the line belongs to.

The password is stored only as a secret we cannot read back and show to you. Do not send the password to us by email. If you reset it, we use the email on the account to complete the reset. Signing in with Google does not require that password.

You can sign in with Google instead. Google then sends us the name and the email on that Google account. We use them to find your workspace or to open one. We do not receive your Google password. A short-lived cookie remembers the hand-off until sign-in finishes, and then we delete it.

The lawful basis is the contract: we cannot run the workspace without these details. Company size is used to understand the account you asked us to open, not to make an automated decision about you.

On the profile page we ask for one business document, such as a company registration certificate, so we can check that the company is real. The file stays private to the account. We use it only for that check.

5.Numbers and caller identity

If you forward a line, connect your own telephone system, verify a caller identity, or ask for a new number, we keep the number, the way it is attached, and the state of that attachment. We use it to send and receive the calls you set up and to show you the number in the workspace.

A number can identify a person. Where the number is yours or your company’s, we process it to perform the contract. Where the number belongs to someone you call, or to someone who calls you, you decided to bring it into the workspace. See the section on people on the line.

6.Calls

For each call the workspace handles we can keep the direction (inbound or outbound), the numbers on both ends, the time, the status, and the measured duration. Where the product keeps a summary or the words spoken on the call, those are kept as part of the same history, for the account that ran the call.

Outbound attempts can also leave an audit of the number you called, the number you called from, and the result of the attempt. That audit exists so the account can be answered for what it dialled.

We use call information to place and answer the call you started, to show you the history, to measure duration, and to investigate abuse of the service. Audio, if kept, is kept in the European Union. Nothing in this policy removes your duty to tell the person on the call what the law requires before a conversation is kept.

7.People you call, and people who call you

A call contains other people’s information: their number, their voice, and whatever they say. You choose to place the call or to publish the number they dial. You are responsible for having a lawful reason, for any notice or consent, and for the rights of those people — access, correction, deletion, and objection included.

We do not use their information to build our own marketing profile, and we do not sell it. We use it only to carry out the call and the workspace actions you take, to keep the history your account can read, to count duration, and to meet a legal duty. If one of those people contacts us, we will point them to the account that ran the call unless we are legally required to answer them ourselves.

You will not upload a list, or place a call, unless you can stand behind that use. If you cannot, do not put the information in the workspace. We take no liability for how you use their information, for what is said on the call, or for a claim that follows. The terms say the same.

8.Messages we send you

We email the address on the account about the workspace: a welcome when the account is created, a reset when you ask for one, and a notice when these documents change in a material way. Those messages are part of the contract. We do not send a separate marketing list from this policy. If we ever do, we will ask first, and you will be able to refuse.

9.The public site

On the public site we measure how the site is used: pages viewed, general location derived from the network address, the type of browser and device, and how people move through the pages. We use that to understand which parts of the site are read and whether the site is failing. The lawful basis is our legitimate interest in running and improving the site.

That measurement can set its own cookies or similar storage. It is separate from the sign-in cookie described next. We do not use it to decide whether you may open an account. You can control cookies in your browser. Blocking them may stop the measurement; it should not stop you reading the site.

10.Staying signed in

When a sign-in succeeds we place a cookie so the browser stays signed in to the workspace. The cookie is limited to our site, is sent only with requests to us, and is not readable by scripts on the page. It lasts up to fourteen days unless you sign out sooner. Signing out clears it.

The cookie is necessary for the contract. We do not use it to follow you around other sites. A network address may also be kept for a short time in ordinary request logs, to keep the service reliable and to investigate abuse.

11.Why we use information

Contract. To open the account, sign you in, attach numbers, place and answer calls, keep history, and record that you accepted these documents.
Legitimate interests. To secure the workspace, prevent abuse, measure the public site, and keep a record of what was agreed. You may object, as described under your rights. We will stop unless we have a compelling reason that overrides your interests.
Legal duty. To keep records we are required to keep, and to answer a lawful request from an authority.
Consent. Where we rely on consent, we ask for it separately, and you may withdraw it without affecting a sign-in that has already happened.

We do not make a decision about you that is based solely on automated processing and that produces a legal effect, beyond the ordinary running of a call you configured. The voice on a call follows the instructions of the account. You remain responsible for those instructions and for the call.

12.How long we keep it

Account profile: for the life of the account, then deleted or detached within ninety days of closure, except what the next lines still require.
Business document: for the life of the account, then deleted with the profile, except where a law requires the verification record to be kept.
Acceptance records: for the life of the account and six years after closure.
Call history and outbound audit: for the life of the account and twelve months after closure, unless a longer period is required to answer a claim you or we already know about.
Sign-in cookie: up to fourteen days, or until you sign out.
Google hand-off cookie: up to fifteen minutes, or until sign-in finishes.
Public-site measurement: for the period set by that measurement, and no longer than fourteen months.
Messages about the account: for as long as we need them to show what was sent, and no longer than three years.

When a period ends we delete the information or keep it only in a form that no longer identifies a person. Backups fall away on their own cycle.

14.Where it is kept

The workspace and call audio are kept in the European Union. Some helpers described above may process a limited part of the information from another country — for example, to deliver an email or to measure the public site. When that happens we use a lawful transfer tool, such as a decision that the country is adequate or the standard contractual clauses, and we keep a record of it. You may ask for a summary of the tool that applies.

15.Your choices and rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may ask us to:

Confirm whether we hold information about you, and for a copy of it.
Correct information that is wrong.
Delete information, when no exception applies.
Restrict how we use it while a request is unresolved.
Receive the account information you gave us, in a portable form.
Object to use that is based on legitimate interests.
Withdraw a consent, where consent was the basis. Withdrawal does not undo a sign-in that already happened.
Lodge a complaint with a supervisory authority. In Germany you may contact the authority of your place of residence or the Berlin authority. You may also contact the authority where you live.

Email hello@kalled.app from the address on the account. We may need to confirm it is you. We answer within one month, or we tell you why we need longer. If a request concerns a person you called, we may refer the request to you, because you decided to make that call and to keep that history.

You can close the account, which starts the deletion periods above. Signing out ends the current sign-in. Acceptance records are not deleted on sign-out, because they show what was agreed.

16.Security

We limit access to account and call information to people and helpers who need it for the jobs in this policy. Sign-in secrets are not stored in a form that can be read back. The sign-in cookie cannot be read by page scripts. No method of storage or transmission is perfect. You are responsible for the password or the Google account you use to sign in, for who may use the workspace, and for the information you choose to put on a call.

17.Children

The workspace is for companies and for adults. We do not knowingly create an account for anyone under 18. If you believe a child has given us personal information, email hello@kalled.app and we will delete the account if we confirm it.

18.Changes to this policy

We will post a new version at this address and change the date. A material change is also sent to the email on the account before it applies, unless the law requires a faster change. The next time you sign in, you accept the published version, and we log that acceptance. The previous record stays.

19.Contact

Privacy requests and questions about the terms: hello@kalled.app. Please use the email on the account. We will not ask you to send a password.