Privatlivspolitik

1. Data controller

• Controller: Byteguard Sociedad Limitada
• Tax ID (CIF): ESB19417872
• Address: Laguna 8A, 06460 Badajoz, Spain
• Website: nocall.io
• Email: [email protected]

This policy applies to the nocall.io website, the NoCall apps for iOS and Android, and related services: number search, reports, comments, call blocking, SMS filtering, notifications, API, support, statistics, and informational pages.

2. Data we process

On the website

• Searches: phone number or company name entered to show results and prevent abuse.
• Reports and comments: reported number, category, comment, display name chosen by the user, and minimal technical metadata.
• Company directory requests: company name and country edition, plus the optional email and note you choose to provide. A one-way network identifier is used only to prevent repeated abuse.
• Technical data: IP address, user agent, language, requested path, date, request status, and security signals.
• Support: messages sent by email or via the support widget, together with data needed to respond.

In the NoCall mobile apps

• Device identifier: random identifier to limit duplicates and maintain service state.
• Submitted reports: numbers, categories, optional comments, and security markers you choose to send.
• Searches: number or company queries from the app to return risk information.
• Company directory requests: company name and country edition, plus the optional email and note you choose to provide.
• Purchases: Apple or Google transaction identifiers to validate Pro features. We do not receive card data.
• Push notifications: notification token if you enable them.
• Optional Pro SMS AI analysis: analysis is user-initiated; in either app or on nocall.io (signed-in Pro accounts), you choose whether to send the sender and message text or a selected screenshot. Before each upload, NoCall shows what will be sent, and the analysis starts only when you press the button. The configured recipient is Google (Gemini) or xAI (Grok). For text analysis, NoCall first pseudonymises the sender and redacts email addresses, phone numbers, account identifiers, payment-card numbers, one-time codes, and URL paths or query strings. Only that privacy-minimised text is sent to the AI provider. NoCall may retain a redacted preview and campaign-level signals for messages classified as suspicious. For image analysis, the selected screenshot is sent through NoCall to that provider for reading and analysis. Images can contain personal information that text redaction cannot remove; crop or remove it before confirming. NoCall does not store the screenshot. The provider processes submitted content under its own privacy policy.

Call blocking and automatic iOS SMS filtering run on the device. NoCall never uploads your contacts and the Android app does not read your inbox. The iOS filtering extension does not send messages to the AI provider; SMS content leaves the device only when you explicitly request the optional Pro analysis described above.

3. Third-party services

• Google AdSense: shows ads on the site and may use cookies or advertising identifiers depending on browser and Google settings.
• Google Mobile Ads: the free mobile app requests non-personalized ads. The SDK may process device identifiers, approximate location, advertising activity and diagnostics. On iOS, Apple tracking permission is requested after notification onboarding and before Google consent or advertising initialization. Denied, restricted or revoked permission keeps mobile ads disabled; NoCall remains usable. Android uses Google's consent controls.
• RevenueCat: processes account-linked purchase history and entitlements for the one-time NoCall Pro lifetime purchase. Automatic advertising-identifier collection is disabled.
• Facebook: initializes only when you choose Facebook sign-in. iOS uses Limited Login with a nonce-bound authentication token; automatic app events and advertising-identifier collection are disabled.
• Google Analytics: measures aggregated site usage to understand performance, pages visited, and product issues.
• Microsoft Clarity: helps analyse user experience, visual errors, and aggregated behaviour on the web.
• Intercom: provides the support widget and messaging when available.
• ByteGuard: verifies that requests come from legitimate users and helps block bots, abuse, and automated scraping.
• Cloudflare: CDN, security, caching and network protection.
• Apple: processes app downloads, purchases, and refunds on the App Store.
• Google Play: processes Android app downloads, purchases, and refunds.
• Google (Gemini) or xAI (Grok): the recipient identified before upload receives redacted text or the screenshot you select through a NoCall-controlled gateway for optional Pro SMS AI analysis.

These providers act under their own privacy policies and may process technical data outside the European Economic Area with applicable contractual safeguards.

You can review categories and change your choices in the Cookie Policy or from the footer preferences link.

4. Purposes of processing

• Show search results for numbers, companies, prefixes, and operators in Spain.
• Maintain a community database of numbers reported as spam, scam, telemarketing, or other categories.
• Block calls and filter suspicious SMS from the app.
• Moderate reports and comments, including manual or AI-assisted review.
• Prevent abuse, bots, scraping, spam, fraud, and malicious use of the service.
• Measure performance, fix errors, improve design, and publish aggregated statistics.
• Show ads and keep the free plan available to users.
• Validate Pro purchases, send notifications if you enable them, and respond to support requests.

5. Legal basis

• Consent: comments, reports, push notifications, and certain cookies or similar technologies where applicable.
• Contract performance: providing the service, validating purchases, and app features.
• Legitimate interests: security, abuse prevention, basic metrics, service improvement, and maintaining the community database.
• Legal obligation: retaining information required for tax, accounting, or legal requirements.

6. Publication of community content

Reports and comments sent to NoCall may appear publicly on number pages, statistics, listings, or related results. Do not post sensitive data, third parties’ private information, or accusations you cannot substantiate.

7. Retention

• Reports and comments: kept while useful for the community database or until removal is appropriate.
• Company directory requests: optional email and note are kept only while the request is pending and are erased when it is fulfilled or rejected. The one-way anti-abuse network identifier is cleared after the 24-hour rate-limit window.
• Technical data and logs: kept as long as needed for security, debugging, and abuse prevention.
• Anti-bot data: processed to verify requests and may generate temporary security tokens or events.
• Purchases: for the period needed to validate Pro and meet legal obligations.
• Optional Pro SMS AI analysis: requests are processed transiently; only redacted suspicious-message campaign records are retained while useful for fraud protection.
• Support: as long as needed to respond and maintain a reasonable incident history.
• Advertising and analytics: according to applied settings and Google, Microsoft, and Intercom policies.

8. Your rights

You can delete your account in NoCall for iOS or Android: Settings → Account → Delete account. Deletion removes your account profile, linked login credentials, sessions, developer API access, submitted comments, reports, feedback and family-sharing records. It also unlinks devices and push tokens and revokes linked Sign in with Apple authorization; Apple may ask you to sign in again to complete this. Store purchase records remain with Apple or Google, and deleting your account does not request a refund. Pro is a lifetime purchase with no recurring subscription. For a deletion request without the app, use the account-deletion page.

You can exercise access, rectification, erasure, objection, restriction, and portability by writing to [email protected]. To help us locate data, include the number, comment, email, or identifier related to your request.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Security

• HTTPS/TLS for communications.
• Anti-bot measures, rate limiting, and abuse controls.
• Restricted access to internal systems.
• Content moderation and report review to reduce false positives.

10. Minors

NoCall is not directed at children under 16. If you believe a child has sent us personal data, contact us so we can review it.

11. Changes

We may update this policy to reflect changes to the site, app, providers, ads, features, or legal requirements. The date at the top shows the last update.

12. Contact

For privacy, data protection, or content removal, write to [email protected].