Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how CalledUp Automations ("CalledUp", "we", "us", "our") collects, uses, shares and protects personal data when you visit our website, create an account or use our services (together, the "Service").

We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), the Brazilian General Data Protection Law (LGPD), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and other applicable US state privacy laws.

1. Data controller

The data controller responsible for your personal data is:

CalledUp Automations
Office 1, Izabella House, 24 Regent Place, B1 3NJ, Birmingham, England, United Kingdom
Email: calledup2@gmail.com

2. Personal data we collect

  • Account & identity data: name, email address, phone number, password (hashed), profile information.
  • Authentication data: information received from third-party sign-in providers (e.g. Google OAuth) such as your name, email and profile picture.
  • Billing data: billing name, billing address, VAT/tax ID, purchase history and payment status. Card details are collected and processed directly by our payment provider — we do not store full card numbers.
  • Service content: call activity, scripts, leads, notes, uploaded files (e.g. Excel, PDF, DOCX imports) and other content you create or upload.
  • Communications data: messages you send us via email or support.
  • Technical & usage data: IP address, device and browser information, operating system, referring URLs, pages visited, timestamps, diagnostic and error logs.
  • Cookies and similar technologies: see our Cookies Policy.

3. How we collect your data

  • Directly from you when you register, subscribe, upload content, contact us or otherwise use the Service.
  • Automatically when you interact with the Service, through cookies, log files and similar technologies.
  • From third parties such as authentication providers (Google), payment providers (Stripe) and our infrastructure providers.

4. Purposes of processing

  • Create and manage your account and provide the Service.
  • Process payments, subscriptions, invoices and prevent fraud.
  • Enable core functionality such as making and receiving calls, importing data and generating stats.
  • Provide customer support and respond to your requests.
  • Secure, monitor and improve the Service, diagnose issues and prevent abuse.
  • Comply with legal, accounting and regulatory obligations.
  • Send service communications and, where you have opted in, marketing communications about features you may find useful.

5. Legal bases (GDPR / UK GDPR)

  • Performance of a contract — to provide the Service you subscribed to.
  • Consent — for optional cookies, marketing emails and certain features. You may withdraw consent at any time.
  • Legal obligation — to comply with tax, accounting and other legal duties.
  • Legitimate interests — to secure and improve the Service, prevent fraud and run our business, provided these interests are not overridden by your rights.

6. Recipients and third-party processors

We share personal data only with trusted service providers who process it on our behalf under written agreements and appropriate safeguards:

  • Stripe — payment processing and subscription billing.
  • Twilio — voice calling, call routing and telephony infrastructure.
  • Supabase — managed database, authentication and storage.
  • Lovable Cloud — hosting and backend platform for the Service.
  • Google (OAuth) — optional third-party sign-in.

We may also disclose personal data to regulators, law enforcement or other authorities where required by law, or to advisors and potential buyers in connection with a corporate transaction, subject to appropriate confidentiality obligations.

We do not sell your personal information.

7. International data transfers

Some of our providers may process data outside the UK, EEA, Switzerland or Brazil, including in the United States. When we transfer personal data internationally, we rely on appropriate safeguards such as European Commission / UK adequacy decisions, the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the Swiss addendum to the SCCs, where applicable.

8. Retention

We keep your personal data for as long as your account is active and as needed to provide the Service. When your account is closed, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, accounting, dispute-resolution or fraud-prevention purposes.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, authentication and regular review of our providers. No system is 100% secure, but we work to protect your data using industry-standard practices.

10. Your rights (GDPR / UK GDPR)

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your personal data ("right to be forgotten").
  • Restrict or object to processing.
  • Data portability — receive your data in a structured, commonly used format.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with a supervisory authority (see section 16).

To exercise your rights, email calledup2@gmail.com. We will respond within one month.

11. Marketing

Where you have opted in, we may send you information about features and products we think you might like. You can opt out at any time by using the unsubscribe link in our emails or by emailing us.

12. Children's privacy

The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Cookies

We use strictly necessary, functional and analytics cookies. For details and to manage your preferences, see our Cookies Policy.

14. Automated decision-making

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects on you.

15. Jurisdiction-specific rights

Switzerland (FADP)

If you are located in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. You have rights of access, rectification, erasure and objection similar to those under the GDPR. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

Brazil (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. Our legal bases include consent, performance of a contract, compliance with legal obligations, and legitimate interests. You have the right to:

  • Confirm the existence of processing and access your data.
  • Correct incomplete, inaccurate or outdated data.
  • Anonymise, block or delete unnecessary or excessive data.
  • Data portability to another provider.
  • Delete personal data processed on the basis of consent.
  • Information about entities with whom we share your data.
  • Information about the possibility of not providing consent and the consequences.
  • Revoke consent.

You may lodge a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd. International transfers are made under the safeguards permitted by the LGPD.

California (CCPA / CPRA)

If you are a California resident, you have specific rights under the CCPA as amended by the CPRA.

Categories of personal information we collect: identifiers (name, email, IP address); customer records (billing information); commercial information (transactions); internet/network activity (usage data); geolocation (approximate, from IP); audio information (via call features); professional information (where provided); and inferences drawn from the above.

Sources: directly from you, automatically via the Service, and from our service providers (see section 6).

Purposes: as described in section 4.

Disclosure: we disclose the above categories to our service providers listed in section 6 for business purposes. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes that require the right to limit.

Your rights:

  • Right to know what personal information we collect, use, disclose and (if applicable) sell or share.
  • Right to delete personal information we collected from you.
  • Right to correct inaccurate personal information.
  • Right to opt out of the sale or sharing of personal information (not applicable — we do not sell or share).
  • Right to limit use and disclosure of sensitive personal information.
  • Right to non-discrimination for exercising your rights.
  • You may designate an authorised agent to submit requests on your behalf.

To exercise these rights, email calledup2@gmail.com. We will verify your request using information already associated with your account.

Other US state privacy laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware, New Hampshire, New Jersey, Tennessee and other states with comprehensive privacy laws have rights that may include:

  • Access, correction, deletion and portability of personal data.
  • Opting out of targeted advertising, "sale" of personal data and certain profiling.
  • Appealing a decision we make about a rights request.

We do not engage in targeted advertising or the sale of personal data as defined by these laws. To exercise your rights, email calledup2@gmail.com. If we decline a request, you may appeal by replying to our response.

16. How to contact us and supervisory authorities

Questions, requests or complaints? Email calledup2@gmail.com or write to us at the address in section 1.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may contact your local Data Protection Authority. See sections above for Switzerland, Brazil and US state authorities.

17. Links to other websites

Our Service may link to third-party websites. This Privacy Policy applies only to CalledUp. Please review the privacy policies of any third-party sites you visit.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date above. Material changes will be notified through the Service or by email where appropriate.