Account information: email address, first and last name, and a salted password hash. Plaintext passwords are never stored.
Verification data: email verification and password-reset tokens, stored only while pending.
Call metadata: the number you call and the number called from, destination country and type (mobile/landline), call status, start/answer/end timestamps, duration, and the billing snapshot (rates and charged amount). We do not record or store call audio or contents in V1.
Financial records: credit purchases, call charges, refunds, adjustments and automatic top-ups, plus Stripe identifiers (Customer ID, Checkout Session ID, PaymentIntent ID, PaymentMethod ID). We never store full card numbers or card verification data.
Auto Top-Up settings: whether enabled, your threshold and top-up amount, and the Stripe PaymentMethod ID you choose.
Contacts (address book): names, phone numbers, company, email, notes and tags you voluntarily save to quickly dial frequent numbers. CSV imports are parsed in-memory (max 2MB, 500 rows) and not stored as files. This data is strictly user-owned and private to your account.
Organisation data (enterprise accounts): the organisation name, your role (owner or member) and membership, the per-member monthly limits you configure, and the attribution of calls and spend to the member who made them.
Technical & security data: session and refresh tokens, approximate sign-in metadata (such as IP address and time), and audit logs of security-relevant actions.
3. How we use your data
We use your data solely to provide and bill the calling service, to authenticate you, to prevent fraud and abuse, to send service-related emails (verification, purchase confirmation, payment and balance alerts), and to comply with legal obligations. We do not sell your personal data.
4. Legal basis (GDPR)
Contract (Art. 6(1)(b)): to create your account, route and bill calls, and process payments.
Legitimate interest (Art. 6(1)(f)): fraud prevention, service security and product improvement.
Legal obligation (Art. 6(1)(c)): retaining financial records as required by tax and accounting law.
Consent (Art. 6(1)(a)): where we rely on optional communications you can withdraw at any time.
5. Who we share data with
We share the minimum data necessary with vetted processors:
Stripe — payment processing. Stripe handles your card data; we only store Stripe identifiers. See Stripe Privacy.
Twilio / Telnyx — voice connectivity and PSTN termination. The carrier receives the destination number needed to place your call. See Twilio Privacy.
Email provider — delivery of transactional emails.
Hosting & infrastructure — the servers and database that run the service.
Contacts are never shared with carriers, payment providers or third parties for marketing. They remain private to your account and are only used to pre-fill the dialer for your convenience.
We do not transfer your data for advertising, and we do not sell personal data. Where data is processed outside the EEA (for example by Stripe and Twilio/Telnyx in the United States), we rely on the recipients' adequacy status or appropriate safeguards such as Standard Contractual Clauses.
5a. Enterprise organisation accounts
For enterprise organisation accounts, the organisation owner can create and manage member accounts and view organisation-wide call records. This means:
The organisation owner can see each member's call metadata (the number called, duration, cost and spend against the shared credit pool), the members list, and the monthly limits they have set.
Where the owner adds member personal data (name, email), the owner is the controller of that data and is responsible for having the members' consent and providing them with this information. WebzPhone processes that data on the owner's behalf to provide the service.
Members can exercise their data-protection rights (access, rectification, erasure, export) directly through their own account settings, and can also contact us. Where a request concerns data controlled by the organisation, we may refer it to the organisation owner.
Member accounts are deleted or unlinked when the organisation owner removes them or when the organisation/account is deleted.
6. Data retention
Call metadata: retained for a limited period (default 90 days) and then automatically purged.
Contacts: retained until you delete them individually, in bulk, or via account deletion — then immediately purged. Imported CSV files are not retained; they are parsed in-memory and discarded.
Account & profile data: kept until you delete your account.
Organisation data: the organisation name and member associations are kept while the organisation account exists; member accounts are removed or unlinked when the owner removes them or the organisation account is deleted. Member call metadata follows the same call-metadata retention above (default 90 days).
Financial records: retained for as long as required by law (for example tax and accounting obligations), even after account deletion. On deletion we anonymise your personal identifiers while preserving these non-personal financial records.
Account deletion grace period: deletions are finalised after a 30-day grace window, after which personal data is anonymised.
7. Your rights
Export your personal data from your account settings (GDPR data portability) — includes your contacts.
Delete your contacts at any time (single, bulk, or via CSV re-import) and delete your account and request erasure of your personal data from your account settings.
Log out of all sessions and revoke tokens from your account settings.
Access, rectify, restrict or object to the processing of your personal data.
Withdraw consent where processing is based on consent.
Lodge a complaint with a supervisory authority (e.g. your local Data Protection Authority) if you believe your data is processed unlawfully.
8. Cookies & local storage
We use only essential cookies and browser local storage required to keep you signed in and maintain session security. We do not use advertising or cross-site tracking cookies. See our Cookie Policy.
9. Contact
For any privacy request, contact [email protected] or write to the address in our Legal Notice. We will respond within the timeframes required by applicable law.
Webz