Privacy Policy

This Privacy Policy explains how CalledUp Automations ("CalledUp", "we", "us", "our") collects, uses, shares and protects personal data when you visit our website, create an account or use our services (together, the "Service").

We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), the Brazilian General Data Protection Law (LGPD), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and other applicable US state privacy laws.

1. Data controller

The data controller responsible for your personal data is:

CalledUp Automations
Office 1, Izabella House, 24 Regent Place, B1 3NJ, Birmingham, England, United Kingdom
Email: calledup2@gmail.com

2. Personal data we collect

• Account & identity data: name, email address, phone number, password (hashed), profile information.
• Authentication data: information received from third-party sign-in providers (e.g. Google OAuth) such as your name, email and profile picture.
• Billing data: billing name, billing address, VAT/tax ID, purchase history and payment status. Card details are collected and processed directly by our payment provider — we do not store full card numbers.
• Service content: call activity, scripts, leads, notes, uploaded files (e.g. Excel, PDF, DOCX imports) and other content you create or upload.
• Communications data: messages you send us via email or support.
• Technical & usage data: IP address, device and browser information, operating system, referring URLs, pages visited, timestamps, diagnostic and error logs.
• Advertising data: when our Meta advertising tools are active and you consent, information may include pages visited, links or buttons used, form or booking events, referring URLs, timestamps, IP address, browser and device information, and advertising identifiers such as Meta cookie or click identifiers. The exact information depends on the advertising features enabled.
• Cookies and similar technologies: see our Cookies Policy.

3. How we collect your data

• Directly from you when you register, subscribe, upload content, contact us or otherwise use the Service.
• Automatically when you interact with the Service, through cookies, log files and similar technologies.
• From third parties such as authentication providers (Google), payment providers (Stripe) and our infrastructure providers.

4. Purposes of processing

• Create and manage your account and provide the Service.
• Process payments, subscriptions, invoices and prevent fraud.
• Enable core functionality such as making and receiving calls, importing data and generating stats.
• Provide customer support and respond to your requests.
• Secure, monitor and improve the Service, diagnose issues and prevent abuse.
• Comply with legal, accounting and regulatory obligations.
• Send service communications and, where you have opted in, marketing communications about features you may find useful.
• Run, measure and improve advertising on Facebook, Instagram and other Meta services, including attributing visits or enquiries to an advert, limiting repeated adverts and, where enabled, creating or reaching relevant audiences.

5. Legal bases (GDPR / UK GDPR)

• Performance of a contract — to provide the Service you subscribed to.
• Consent — for optional cookies, Meta Pixel and related advertising technologies, marketing emails and certain features. You may withdraw consent at any time through our cookie settings or the relevant unsubscribe method.
• Legal obligation — to comply with tax, accounting and other legal duties.
• Legitimate interests — to secure and improve the Service, prevent fraud and run our business, provided these interests are not overridden by your rights.

6. Recipients and third parties

We share personal data only where necessary with trusted service providers and advertising partners under appropriate terms and safeguards:

• Stripe — payment processing and subscription billing.
• Twilio — voice calling, call routing and telephony infrastructure.
• Supabase — managed database, authentication and storage.
• Lovable Cloud — hosting and backend platform for the Service.
• Google (OAuth) — optional third-party sign-in.
• Meta Platforms, Inc. — advertising delivery and measurement through Meta Ads and, when enabled with your consent, Meta Pixel and related Meta Business Tools. Information sent to Meta may be linked by Meta with Facebook, Instagram or other Meta account and device information under Meta's own policies. See the Meta Privacy Policy and Meta Cookies Policy.

We may also disclose personal data to regulators, law enforcement or other authorities where required by law, or to advisors and potential buyers in connection with a corporate transaction, subject to appropriate confidentiality obligations.

We do not sell your personal information.

7. International data transfers

Some of our providers may process data outside the UK, EEA, Switzerland or Brazil, including in the United States. When we transfer personal data internationally, we rely on appropriate safeguards such as European Commission / UK adequacy decisions, the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the Swiss addendum to the SCCs, where applicable.

8. Retention

We keep your personal data for as long as your account is active and as needed to provide the Service. When your account is closed, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, tax, accounting, dispute-resolution or fraud-prevention purposes.

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, authentication and regular review of our providers. No system is 100% secure, but we work to protect your data using industry-standard practices.

10. Your rights (GDPR / UK GDPR)

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict or object to processing.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority (see section 17).

To exercise your rights, email calledup2@gmail.com. We will respond within one month.

11. Marketing

Where you have opted in, we may send you information about features and products we think you might like. You can opt out at any time by using the unsubscribe link in our emails or by emailing us.

12. Children's privacy

The Service is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Meta Ads and Meta Pixel

We use Meta Ads to advertise CalledUp Automations on Facebook, Instagram and other Meta services. Meta receives information generated through interactions with those adverts under its own privacy policy. This may include advert impressions, clicks, campaign interactions and information associated with your Meta account or device.

When enabled, Meta Pixel is a tracking technology placed on our website. After you consent to marketing cookies, it may send Meta event data such as page visits, links or buttons used, form or booking events, referring URLs, timestamps, IP address, browser and device information, and Meta cookie or click identifiers. We use this information to measure whether our adverts lead to visits or enquiries, understand campaign performance, improve ad delivery and, where enabled, create or reach audiences likely to be interested in our services. The exact information depends on the events and Meta advertising features enabled at the time.

For the collection and transmission of information through Meta Business Tools, CalledUp Automations and Meta may act as joint controllers. Meta then processes information for its own purposes as described in its policies. The allocation of responsibilities is described in Meta's UK Controller Addendum. Meta may process information outside the UK, including in the United States, using safeguards described in its UK Data Transfer Addendum. Meta determines how long it keeps information under its own policies.

You can refuse or withdraw marketing consent at any time through our cookie settings. Refusing does not stop adverts from appearing, but it prevents our site from loading optional Meta tracking. You can also manage how Meta uses information for advertising in your Meta Ad Preferences.

14. Cookies

We use strictly necessary, analytics and marketing cookies and similar technologies. Marketing technologies, including Meta Pixel when enabled, are not loaded unless you consent. For details and to manage your preferences, see our Cookies Policy.

15. Automated decision-making

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects on you.

16. Jurisdiction-specific rights

Switzerland (FADP)

If you are located in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies. You have rights of access, rectification, erasure and objection similar to those under the GDPR. You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

Brazil (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. Our legal bases include consent, performance of a contract, compliance with legal obligations, and legitimate interests. You have the right to:

• Confirm the existence of processing and access your data.
• Correct incomplete, inaccurate or outdated data.
• Anonymise, block or delete unnecessary or excessive data.
• Data portability to another provider.
• Delete personal data processed on the basis of consent.
• Information about entities with whom we share your data.
• Information about the possibility of not providing consent and the consequences.
• Revoke consent.

You may lodge a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd. International transfers are made under the safeguards permitted by the LGPD.

California (CCPA / CPRA)

If you are a California resident, you have specific rights under the CCPA as amended by the CPRA.

Categories of personal information we collect: identifiers (name, email, IP address); customer records (billing information); commercial information (transactions); internet/network activity (usage data); geolocation (approximate, from IP); audio information (via call features); professional information (where provided); and inferences drawn from the above.

Sources: directly from you, automatically via the Service, and from our service providers (see section 6).

Purposes: as described in section 4.

Disclosure: we disclose the above categories to our service providers and advertising partners listed in section 6. Our use of Meta advertising technology may be treated as "sharing" for cross-context behavioural advertising under the CCPA/CPRA even though we do not sell personal information for money. We do not use or disclose sensitive personal information for purposes that require the right to limit.

Your rights:

• Right to know what personal information we collect, use, disclose and (if applicable) sell or share.
• Right to delete personal information we collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information and targeted advertising, where applicable.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising your rights.
• You may designate an authorised agent to submit requests on your behalf.

To exercise these rights, email calledup2@gmail.com. We will verify your request using information already associated with your account.

Other US state privacy laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa (ICDPA), Delaware, New Hampshire, New Jersey, Tennessee and other states with comprehensive privacy laws have rights that may include:

• Access, correction, deletion and portability of personal data.
• Opting out of targeted advertising, "sale" of personal data and certain profiling.
• Appealing a decision we make about a rights request.

We do not sell personal data for money. Our use of Meta advertising technology may constitute targeted advertising or sharing under some state laws. You may withdraw marketing consent through our cookie settings. To exercise your rights, email calledup2@gmail.com. If we decline a request, you may appeal by replying to our response.

17. How to contact us and supervisory authorities

Questions, requests or complaints? Email calledup2@gmail.com or write to us at the address in section 1.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EEA, you may contact your local Data Protection Authority. See sections above for Switzerland, Brazil and US state authorities.

18. Links to other websites

Our Service may link to third-party websites. This Privacy Policy applies only to CalledUp. Please review the privacy policies of any third-party sites you visit.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the "Last updated" date above. Material changes will be notified through the Service or by email where appropriate.