Πολιτική Απορρήτου

1. Data controller

• Controller: Byteguard Sociedad Limitada
• Tax ID (CIF): ESB19417872
• Address: Laguna 8A, 06460 Badajoz, Spain
• Website: nocall.io
• Email: [email protected]

This policy applies to the nocall.io website, the NoCall apps for iOS and Android, and related services: number search, reports, comments, call blocking, SMS filtering, notifications, API, support, statistics, and informational pages.

2. Data we process

On the website

• Searches: phone number or company name entered to show results and prevent abuse.
• Reports and comments: reported number, category, comment, display name chosen by the user, and minimal technical metadata.
• Company directory requests: company name and country edition, plus the optional email and note you choose to provide. A one-way network identifier is used only to prevent repeated abuse.
• Technical data: IP address, user agent, language, requested path, date, request status, and security signals.
• Support: messages sent by email, together with data needed to respond.

In the NoCall mobile apps

• Device identifier: random identifier to limit duplicates and maintain service state.
• Submitted reports: numbers, categories, optional comments, and security markers you choose to send.
• Searches: number or company queries from the app to return risk information.
• Company directory requests: company name and country edition, plus the optional email and note you choose to provide.
• Purchases: Apple or Google transaction identifiers to validate Pro features. We do not receive card data.
• Push notifications: notification token if you enable them.
• Optional Pro SMS AI analysis: analysis is user-initiated; in either app or on nocall.io (signed-in Pro accounts), you choose whether to send the sender and message text or a selected screenshot. Before each upload, NoCall shows what will be sent, and the analysis starts only when you press the button. The configured recipient is Google (Gemini) or xAI (Grok). For text analysis, NoCall first pseudonymises the sender and redacts email addresses, phone numbers, account identifiers, payment-card numbers, one-time codes, and URL paths or query strings. Only that privacy-minimised text is sent to the AI provider. NoCall may retain a redacted preview and campaign-level signals for messages classified as suspicious. For image analysis, the selected screenshot is sent through NoCall to that provider for reading and analysis. Images can contain personal information that text redaction cannot remove; crop or remove it before confirming. NoCall does not store the screenshot. The provider processes submitted content under its own privacy policy.

Call blocking and automatic iOS SMS filtering run on the device. NoCall never uploads your contacts and the Android app does not read your inbox. The iOS filtering extension does not send messages to the AI provider; SMS content leaves the device only when you explicitly request the optional Pro analysis described above.

About the phone numbers in the directory

NoCall publishes a page for each phone number, including numbers whose holder does not use NoCall. A page may show:

• Approved reports and comments sent by NoCall users.
• Public comments and opinions taken from other call-report websites (for example ListaSpam, tellows or unknownphone), with their origin stated.
• A risk level and texts generated automatically, including with AI, from the above.
• The operator and line type recorded in public numbering plans, and how many times the number has been looked up.

We do not publish who holds a private line. For business numbers, the company that uses them may be shown. If you hold a number, section 8 explains how to ask for its erasure.

3. Third-party services

• Google AdSense: shows ads on the site and may use cookies or advertising identifiers depending on browser and Google settings.
• Google Mobile Ads: the free mobile app requests non-personalized ads. The SDK may process device identifiers, approximate location, advertising activity and diagnostics. On iOS, Apple tracking permission is requested after notification onboarding and before Google consent or advertising initialization. Denied, restricted or revoked permission keeps mobile ads disabled; NoCall remains usable. Android uses Google's consent controls.
• RevenueCat: processes account-linked purchase history and entitlements for the one-time NoCall Pro lifetime purchase. Automatic advertising-identifier collection is disabled.
• Facebook: initializes only when you choose Facebook sign-in. iOS uses Limited Login with a nonce-bound authentication token; automatic app events and advertising-identifier collection are disabled.
• Google Analytics: measures aggregated site usage to understand performance, pages visited, and product issues.
• Microsoft Clarity: helps analyse user experience, visual errors, and aggregated behaviour on the web.
• ByteGuard: verifies that requests come from legitimate users and helps block bots, abuse, and automated scraping.
• Cloudflare: CDN, security, caching and network protection.
• Apple: processes app downloads, purchases, and refunds on the App Store.
• Google Play: processes Android app downloads, purchases, and refunds.
• Google (Gemini) or xAI (Grok): the recipient identified before upload receives redacted text or the screenshot you select through a NoCall-controlled gateway for optional Pro SMS AI analysis.

These providers act under their own privacy policies and may process technical data outside the European Economic Area with applicable contractual safeguards.

You can review categories and change your choices in the Cookie Policy or from the footer preferences link.

4. Purposes of processing

• Show search results for numbers, companies, prefixes, and operators in Spain.
• Maintain a community database of numbers reported as spam, scam, telemarketing, or other categories.
• Block calls and filter suspicious SMS from the app.
• Moderate reports and comments, including manual or AI-assisted review.
• Prevent abuse, bots, scraping, spam, fraud, and malicious use of the service.
• Measure performance, fix errors, improve design, and publish aggregated statistics.
• Show ads and keep the free plan available to users.
• Validate Pro purchases, send notifications if you enable them, and respond to support requests.

5. Legal basis

• Consent: comments, reports, push notifications, and certain cookies or similar technologies where applicable.
• Contract performance: providing the service, validating purchases, and app features.
• Legitimate interests: security, abuse prevention, basic metrics, service improvement, and maintaining the community database.
• Legal obligation: retaining information required for tax, accounting, or legal requirements.

6. Publication of community content

Reports and comments sent to NoCall may appear publicly on number pages, statistics, listings, or related results. Do not post sensitive data, third parties’ private information, or accusations you cannot substantiate.

7. Retention

• Reports and comments: kept while useful for the community database or until removal is appropriate.
• Company directory requests: optional email and note are kept only while the request is pending and are erased when it is fulfilled or rejected. The one-way anti-abuse network identifier is cleared after the 24-hour rate-limit window.
• Technical data and logs: kept as long as needed for security, debugging, and abuse prevention.
• Anti-bot data: processed to verify requests and may generate temporary security tokens or events.
• Purchases: for the period needed to validate Pro and meet legal obligations.
• Optional Pro SMS AI analysis: requests are processed transiently; only redacted suspicious-message campaign records are retained while useful for fraud protection.
• Support: as long as needed to respond and maintain a reasonable incident history.
• Advertising and analytics: according to applied settings and Google and Microsoft policies.
• Lookup log: lookups made with the search and the tools are kept for 30 days, with the number looked up encrypted, the IP address and the device identifier, to detect abuse.
• Erased numbers: when a request for erasure or objection about a number is granted, what is stored about it is deleted and only the number is kept, on an internal exclusion list, so that it is not published or stored again.

8. Your rights

You can delete your account in NoCall for iOS or Android: Settings → Account → Delete account. Deletion removes your account profile, linked login credentials, sessions, developer API access, submitted comments, reports, feedback and family-sharing records. It also unlinks devices and push tokens and revokes linked Sign in with Apple authorization; Apple may ask you to sign in again to complete this. Store purchase records remain with Apple or Google, and deleting your account does not request a refund. Pro is a lifetime purchase with no recurring subscription. For a deletion request without the app, use the account-deletion page.

You can exercise access, rectification, erasure, objection, restriction, and portability by writing to [email protected]. To help us locate data, include the number, comment, email, or identifier related to your request.

If you hold a number that appears on NoCall, you can ask for its erasure or object to our processing of it by writing to [email protected] with the number. We review each request and reply within one month at most. We may ask you to show that the line is yours, with as little documentation as possible. When erasure applies, the number's page stops existing on the website, the number can no longer be looked up in the apps or the API, what is stored about it is deleted and it is not published again. If you only think the rating is wrong, you can ask for a review from the My number shows as spam page.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

9. Security

• HTTPS/TLS for communications.
• Anti-bot measures, rate limiting, and abuse controls.
• Restricted access to internal systems.
• Content moderation and report review to reduce false positives.

10. Minors

NoCall is not directed at children under 16. If you believe a child has sent us personal data, contact us so we can review it.

11. Changes

We may update this policy to reflect changes to the site, app, providers, ads, features, or legal requirements. The date at the top shows the last update.

12. Contact

For privacy, data protection, or content removal, write to [email protected].