Privacy Policy

CALILIO PTE. LTD. runs a cloud business phone system for voice calls, text messaging and WhatsApp business messaging. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

It covers calilio.com, the Calilio web and mobile applications, our help centre at support.calilio.com, and our support channels.

This policy is for customers, users, website visitors, and people whose details are stored in a customer account.

1. Two roles, and why the difference matters to you

Calilio handles personal data in two different roles. The role depends on the purpose, not on the type of data, so the same call record can sit in both roles for different reasons.

Why that second list matters. Some of it looks like customer data but is not held on the customer's instructions. We keep call detail records because telecom rules require it of us, not because a customer asked. We investigate fraud to protect the network. In those cases we are answerable for the decision, and you can come to us directly.

A practical example. If your employer gave you a Calilio account and you want a call recording deleted, ask your employer. They own the workspace and the decision is theirs. But if you want to know what call records Calilio itself holds for regulatory reasons, ask us, because that is our decision.

Our Data Processing Agreement sets out what we commit to when we act as a processor.

2. What personal data we collect

Information you give us

• Account details. Name, username, email address, phone number, country, language preference, and profile or cover images.
• Verification status. Whether your email address and phone number have been confirmed, and your multi-factor authentication settings.
• Identity documents. Where a plan or a telecom regulator requires an identity check, the documents you upload and the result of the check. Our verification partner processes these for us.
• Billing details. Plan, invoices, wallet ledger entries and payment records. Card numbers are entered directly into our payment providers and never reach Calilio's own systems.
• Support conversations. Whatever you tell us in chat, by email, or on a call with our support team.

Information your use of the service creates

• Call and message records. Numbers called, timestamps, duration and outcome.
• Recordings, messages and attachments, where you have turned those features on.
• Transcripts and call analysis. Where you use transcription, call summaries or sentiment analysis, the audio is processed to produce text and analysis.
• Contacts you store. Name, phone number, email address, postal address, company, website, time zone, tags and notes.
• Campaign records. Bulk messaging and campaign history.

Information we collect automatically

• Session and device data. Session identifier, access and refresh tokens, issue and expiry times, browser and device details, operating system, device model, platform, and a device identifier used to recognise a device you chose to remember.
• IP address. Recorded on every request. We use it to check a request comes from a person rather than a script, to apply security rules, and to block abusive traffic.
• Device fingerprint. At sign-up we build a technical fingerprint from browser and hardware characteristics. This is how we detect one person opening many accounts to abuse free credit or commit call fraud.
• Website and product analytics. How pages and features are used. Our Cookie Policy names every cookie and tracking tool.
• Marketing attribution. Which campaign, advert or partner link brought you to us. Kept for 90 days and stored against your account.
• Error reports. When something breaks, a technical error report is sent to our monitoring provider. It includes your IP address.

3. Why we use it, and on what legal basis

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms. You can object at any time using the contact details at the end of this policy.

4. Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing.

We share it with the suppliers who make the service work. Our Sub-processor List names every one of them, what they do, and where they are. In summary:

• Carriers, including Twilio, to connect calls and deliver messages.
• Amazon Web Services, for hosting, storage and transcription.
• Meta, for WhatsApp business messaging, if you use that channel.
• Chargebee and Stripe, for subscriptions and payments.
• Crisp, for support chat. Crisp receives your name, email address, phone number, plan and workspace identifier so our team can help you.
• Our identity verification partner, where an identity check is required.
• Our analytics and error-monitoring providers, to measure usage and diagnose faults.

We also share personal data where the law requires it, where we need to establish or defend a legal claim, and if Calilio is ever sold or merged, in which case we will tell you before your data moves.

Law enforcement requests. We disclose customer data to a law enforcement or government body only where we are legally required to. We check that each request is valid and properly served, we give only what the request covers, and we tell the affected customer unless we are legally barred from doing so.

5. If you are not a Calilio customer

You may be reading this because a Calilio customer called you, messaged you, or stored your details as a contact. You did not choose Calilio, and that matters.

• The Calilio customer decides what to hold about you, and why. They are the controller. We hold it for them.
• Ask them first. To see, correct or delete your details, contact the business that called or messaged you. They can do it themselves in the product.
• If you cannot identify them, ask us. Email privacy@calilio.com with the number that contacted you and the date and time. We will identify the customer and pass your request to them, and we will tell you we have done so.
• To stop being contacted, reply STOP to a message, or tell the caller. Both work, and our Messaging Policy requires our customers to act on either.
• To report misuse, such as a scam call or a message you never agreed to receive, write to abuse@calilio.com with the number, the date and time, and any message text. We investigate every report and we act on our customers.

6. What we do not do

Stating the negatives plainly, because they are the questions people actually ask.

7. Marketing, and how to stop it

• We send product and marketing emails to customers and to people who asked to hear from us.
• Every marketing email has an unsubscribe link, and it works immediately.
• You can also email privacy@calilio.com and ask to be removed.
• Unsubscribing from marketing does not stop service messages such as invoices, security alerts and outage notices. Those are part of the service and cannot be switched off while your account is open.
• We do not send marketing by text message to customers without separate consent.

8. Where your data is stored

• Our primary hosting region is Singapore. Some platform services, such as error monitoring and analytics, run elsewhere.
• Call and message traffic is routed through carriers in the country of the number being used, which is how telephony works everywhere.
• Our Sub-processor List states the primary location of every supplier, and our Data Processing Agreement records the processing details for business customers.

9. Where your data goes

Calilio is a Singapore company and our systems run in more than one country. Some suppliers are outside Singapore, the United Kingdom and the European Economic Area, mainly in the United States.

Where personal data leaves the United Kingdom or the European Economic Area, we rely on recognised safeguards, in this order: the United Kingdom International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or the supplier's certification under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that cover a particular supplier.

10. How long we keep it

When a retention period ends we delete the data, or remove whatever links it to you.

11. Your rights

Depending on where you live, you can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct it if it is wrong or incomplete.
• Delete it. Our Data Deletion Request page explains that route in full.
• Restrict or object to how we use it, including anything based on legitimate interests.
• Give it to you in a portable form, or send it to another provider.
• Withdraw consent you gave, without affecting what we did before you withdrew it.
• Opt out of marketing, using the unsubscribe link in any marketing email.

How to use a right. Email privacy@calilio.com. We acknowledge within 5 business days and reply within one calendar month, the deadline set by GDPR Article 12(3). We do not charge a fee. We may ask you to confirm who you are first, so that nobody else can request your data.

If our answer does not satisfy you, you can complain to the Personal Data Protection Commission in Singapore at pdpc.gov.sg. In the United Kingdom you can complain to the Information Commissioner's Office at ico.org.uk. In the European Economic Area you can complain to the data protection authority in your country.

12. United States state privacy rights

If you live in a United States state with a comprehensive privacy law, you also have the right to opt out of targeted advertising and of the sale or sharing of personal information.

Calilio does not sell personal data for money. However, the advertising cookies on our marketing website count as sharing under several state laws. You can opt out in three ways: turn off Advertising cookies in our cookie settings, switch on Global Privacy Control in your browser, or email privacy@calilio.com.

We honour the Global Privacy Control signal. A browser signal applies to the browser that sends it, so switch it on in each browser you use. If you would rather the opt-out was recorded against your whole account, email privacy@calilio.com from the address on the account and we will do that and confirm it.

13. Automated decisions

We score new accounts for fraud risk. The signals include the result of identity verification, how many numbers an account asks for, whether the name on the payment card matches the account name, the country of the account and the country of the card, and how the account reached us.

A high score can delay activation or limit what an account can do while we review it. A person reviews any decision that stops an account being used. If a decision affects you, write to privacy@calilio.com and ask for it to be looked at again.

14. Children

Calilio is a business product and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@calilio.com and we will delete it.

15. Security

We protect personal data with encryption in transit, access controls, multi-factor authentication, device recognition and monitoring for abuse. Our Data Security Policy describes this in more detail.

No service can promise perfect security, so please use a strong and unique password and turn on multi-factor authentication.

If a breach puts your rights at risk we will tell you. We will notify the Personal Data Protection Commission no later than 3 calendar days after we assess that a breach is notifiable, and we will tell affected individuals without undue delay.

16. Changes to this policy

We update this policy when our service, our suppliers or the law change. The date at the top always shows the current version. If a change materially affects how we use your personal data, we will tell you before it takes effect.

17. How to contact us

Questions. To use any right in this policy, or to ask a question about it, write to privacy@calilio.com. We acknowledge within 5 business days and answer within one calendar month.