Privacy policy and cookie notice

1. Controller and contact

WordFone @ Creotec operates WordFone and is the controller for personal data processed through the service. Contact hi.there@wordfone.com for privacy matters. The operator must add its legal identity, postal address, and any required representative details before public launch.

2. Information we process

We process account email, password hash, email-verification status, display name, calling alias, primary number, country selection, visibility, pronunciation hint, address-style entry data, and support correspondence. We also process security and service data, including account-activity records, limited hashed network identifiers for rate limiting, normalised device information, verification and notification records, report and appeal records, and saved contacts or recent call launches where you use those features.

If you enable an authenticator app, we store its secret encrypted. If you add a passkey, we store the credential identifier, public key, counter, and label needed to validate it; we do not receive or store your biometric information. Recovery codes are stored as one-way hashes.

3. Why we use data and our legal bases

We use account, identity, sharing, and support data to provide the service and perform our contract with you. We use verification, account security, moderation, audit, and rate-limiting data for our legitimate interests in preventing fraud, abuse, and unauthorised access and protecting users. We may also process data where necessary to meet a legal obligation or establish, exercise, or defend legal claims.

4. Directory visibility and sharing

Public identities can be resolved by anyone. Unlisted identities can be resolved by people who know the exact identity or receive a share link. Private identities are not publicly resolvable. A public WordFone profile, vCard, QR code, or call link may reveal the identity and enable access to the relevant destination number, so select visibility carefully. Address-style destinations are marked as unverified.

5. Service emails and recipients

We send operational emails, such as email verification, password recovery, sign-in alerts, account-change alerts, moderation notices, and re-verification reminders, using an authenticated SMTP delivery service. The SMTP provider processes recipient address, message metadata, and message content only to deliver the email on our instructions. We do not sell personal data or use advertising trackers in these messages.

6. Cookies

WordFone uses essential cookies only: a secure session cookie to keep you signed in and protect forms, and a language-preference cookie to remember your interface language. We do not use advertising or cross-site tracking cookies in this version.

7. Retention and sharing with providers

We retain data while your account or identity is active and afterwards only for as long as reasonably necessary for security, moderation, disputes, legal obligations, backups, or restoration. A deleted alias is held for the configured hold period. We may use hosting, database, backup, SMTP, and telephone-verification providers acting on our instructions. If data is transferred internationally, the operator must apply an appropriate GDPR transfer safeguard.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where consent applies. You may also complain to your data-protection authority. Contact hi.there@wordfone.com to make a request.

9. Security and changes

We use measures such as password hashing, encrypted authenticator secrets, passkey public-key validation, prepared database queries, CSRF protection, secure session settings, rate limiting, access controls, and audit records. No online service can guarantee absolute security, so keep your password, recovery codes, and verification codes confidential. We may update this notice when the service or law changes and will publish the current date on this page.