Privacy Policy

The data controller is:

Callmama Limited
A company incorporated in Hong Kong (Company Registration No. 77766807)
Registered office: 8/F., China Hong Kong Tower, 8-12 Hennessy Road, Wan Chai, Hong Kong
Privacy contact: privacy@callmama.com
Data protection contact: dpo@callmama.com

Representatives in the EU and the UK

As a company established outside the European Economic Area and the United Kingdom, CallMama has appointed representatives for users in those regions. You may reach our representatives by writing to privacy@callmama.com and asking to be directed to the EU or UK representative.

Data you give us

• Account data — name, email address, a contact phone number, account password (stored hashed), and the country you register from.
• Virtual phone numbers — the numbers we assign to you and the country/type of each.
• Payment data — handled by our payment processor, Stripe. We do not store full card numbers; we receive a payment token and limited details (such as card brand, last four digits, and billing country) needed to manage your subscription and charges.
• Identity / verification data — where a number type or a regulator requires it, address or identity documents needed to issue a number.
• Support communications — the content of messages you send to our support team.

Data generated by your use of the Service

• Call detail records — the numbers called or received, date, time, and duration of calls, and routing information. We need this to connect calls and bill correctly, and we are legally required to keep some of it.
• Messaging data — the sender and recipient numbers, time, and delivery status of SMS, and message content as needed to transmit and deliver your messages.
• Voicemail — voicemail messages left for you.
• Call recordings — recordings are a web-portal feature only. The CallMama mobile app does not record calls. If you enable recording in the web portal, we store the recordings you create. See our Call Recording Notice.
• Device and technical data — device identifiers, device model, operating system and app version, IP address, network/carrier, language, and crash/diagnostic logs.
• Approximate location — derived from your IP address and network, used for call routing, fraud prevention, regulatory requirements, and security. We do not collect precise GPS location unless you grant a specific permission for a feature that needs it.
• Usage data — how you interact with the app and website (features used, pages viewed).

Data from your device, with your permission

• Contacts — if you grant the app permission, CallMama accesses your device contacts so you can call and message them easily. You can decline or revoke this permission in your device settings.
• Microphone — required to place and receive calls.
• Notifications — to alert you to incoming calls and messages.

Website cookies

The CallMama website uses cookies and similar technologies. These are described in our Cookie Policy and are governed by the cookie-consent banner on the site.

Call recording is available only in the CallMama web portal. The mobile app does not record calls. If you enable recording, you are responsible for obtaining any consent the law of your jurisdiction and the other party's jurisdiction requires. Many places require that all parties to a call consent to being recorded. CallMama provides tools — including a recording announcement — to help you comply. Full detail is in our Call Recording Notice.

We do not sell your personal data. We share it only as described here.

• Service providers (sub-processors) who host and run the Service on our behalf — for example our cloud hosting provider, our website host, our payment processor, and the carriers who carry your calls and messages. The current list is in our Sub-processor List.
• Other carriers and recipients — to connect a call or deliver a message, the destination number and related routing data are passed to other telecommunications carriers, which is inherent to how a phone call or text works.
• Law enforcement and regulators — where we are legally required to respond to a valid legal request, or to comply with telecom regulation.
• Professional advisers, and parties to a corporate transaction such as a merger or acquisition, subject to confidentiality.

Where a business customer uses the web portal to route or record its own callers, CallMama acts as a processor for that customer's data under a Data Processing Agreement.

CallMama is based in Hong Kong. Our application is hosted by Hetzner in data centres in Germany, the United Kingdom, and the United States; payment processing (Stripe) and our marketing website (Vercel) are in the United States. Personal data is therefore processed both inside and outside the EEA and the UK. Where personal data is transferred to a country without an adequacy decision — for example to the United States — we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses (2021) and the UK International Data Transfer Agreement / Addendum, together with additional measures where needed. Data held in Hetzner's German data centres remains within the EEA.

• Account data — for as long as your account is active, and for a limited period afterwards to handle disputes and meet legal duties.
• Call and message records — for the periods required by billing, tax, and telecom law. Some of this data cannot be deleted on request until that period ends.
• Call recordings — for as long as you keep them in the web portal, subject to any retention setting you choose; you can delete recordings you control.
• Support communications — for a limited period after the issue is resolved.

If you are in the EEA or the UK (GDPR / UK GDPR)

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

If you are in the United States

Depending on your state, you may have the right to know what personal data we hold, to access and delete it, to correct it, and to opt out of any "sale" or "sharing" of personal data and of targeted advertising. CallMama does not sell personal data. We extend these core rights to all US residents and we honour browser opt-out preference signals such as Global Privacy Control.

How to exercise your rights

Email privacy@callmama.com. We will verify your identity using the account email or phone number on file and respond within the time limit the law allows (generally one month under GDPR/UK GDPR; 45 days under US state law, extendable once). Some records that we are legally required to retain may be exempt from deletion; we will tell you if so.

The Service is not directed to children. You must be at least 18 years old (or the age of majority where you live) to create a CallMama account. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact privacy@callmama.com and we will delete the data.

We use technical and organisational measures appropriate to the risk — including encryption in transit, access controls, and monitoring — to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects you and the law requires it, we will notify you and the relevant authorities.

We may update this Privacy Policy. When we make a material change, we will update the "Last updated" date above and, where appropriate, notify you in the app or by email. Continued use of the Service after a change means you accept the updated policy.

Questions about privacy or this policy: privacy@callmama.com
Data protection: dpo@callmama.com
Callmama Limited, 8/F., China Hong Kong Tower, 8-12 Hennessy Road, Wan Chai, Hong Kong.