Privacy policy

Last updated: 12 October 2026.

Who we are

OK LETS GO LTD (company 17503740) is the operator and data controller for Who’s Calling Me?. This privacy policy covers whoscallingme.co.uk and the Who’s Calling Me? iPhone and Android apps, including their lookup, reporting, support and advertising features. Contact support@whoscallingme.co.uk, our contact form, or 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Searches and reports

We process the telephone number searched and daily search totals to provide lookup results and understand usage. Security controls process connection information, including IP addresses and keyed hashes used for rate limiting, duplicate detection and report-source assessment. A keyed hash is pseudonymous information, not a guarantee of anonymity. Hosting providers may also process connection logs for service security. Searching a number sends it to our servers over HTTPS; it does not itself publish a comment or identify you publicly as the searcher. When a number already has public reports, we retain its latest search time to show up to ten recently searched reported numbers across the website and apps. This shared list shows the numbers and public report information, not who searched them or the exact search times. Unreported and hidden numbers are excluded.

Reports contain the number, classification and comment. Optional information supplied through supported interfaces can include a nickname, approximate call date and a caller’s claimed organisation. Accepted comments publish immediately and are visible to visitors and search engines. Do not submit sensitive information, private addresses, passwords, financial details or private individuals’ names. No public account or email is required to report.

Authorised imports retain their source, import date and any original publication date supplied. Public entries use the label Reported. Their original publication date is shown where supplied; otherwise the date is shown as unavailable. Contact us if source information or a comment about you is inaccurate.

Enquiries and administration

Contact, abuse, removal and data-rights forms store your email and message so staff can investigate and respond. These messages are not published. Private staff accounts use password hashes, secure sessions and encrypted authenticator secrets. Access and moderation decisions are logged. Records from any earlier account features remain restricted; contact us to request access, correction or deletion of your information.

Why we use information

We rely on legitimate interests to provide useful caller information, protect the service from abuse, investigate requests and manage publication. These interests include helping visitors assess unwanted calls while respecting the privacy and accuracy concerns of those mentioned. We use information to meet legal obligations where a particular obligation applies. Optional advertising technologies require the relevant consent before loading.

You can object to processing based on legitimate interests. Contact us with the affected number, report or request reference and your reasons. We will consider the circumstances and explain our response.

Service providers and disclosure

20i provides hosting and Stackmail email services. Cloudflare Turnstile checks public forms for automated abuse and processes connection/browser information for that purpose. See the Turnstile privacy addendum. Authorised staff access only information needed for their duties. Reporter security hashes, private enquiry emails and staff credentials are not displayed in public reports.

The hosting location is London. Providers such as Cloudflare operate internationally; their privacy and contractual information explains applicable processing locations and transfer arrangements. Contact us for information about the arrangements relevant to your data. We may disclose information where lawfully required, or where necessary and justified to protect rights or investigate abuse. We do not publish private correspondence as part of a caller report. We do not sell personal information. We require providers receiving personal information to protect it to an equivalent standard to this policy and applicable data-protection requirements, and to use it only for the disclosed purposes. Google’s advertising processing is described below and in its linked privacy information.

Keeping information secure

We use HTTPS for website and app connections, restrict administrative access, require staff authentication and protect credentials and backups using the safeguards described in this policy. No internet service can guarantee absolute security. Please report a suspected security or privacy issue to support@whoscallingme.co.uk without sending passwords or other secrets.

Retention

Scheduled maintenance clears expired sessions, authentication tokens and rate-limit records. Sent email contents are cleared on successful sending, and queue records are removed after seven days. Vote records and original report security fingerprints are retired after 90 days; an unrelated replacement identifier can retain a report-source grouping. Search aggregates and the latest search time for a reported number are kept for up to 13 months. Resolved or rejected complaints and audit records are retained for 12 months. Non-public reports expire after 90 days. Public reports remain while useful, subject to correction, restriction and removal review.

Encrypted daily server backups rotate after 30 days. Separately held recovery copies are restricted and retained for recovery needs; deletion is applied again if a backup is restored. Contact us about a specific retention or deletion request.

Your rights

Depending on the circumstances, you can ask for access, correction, erasure, restriction or portability of your personal data, or object to its use. We may ask for proportionate information to identify the record and verify your request. Exceptions can apply, including protecting other people’s rights. We will explain any limits rather than promise automatic deletion of every disputed report.

To request deletion, email support@whoscallingme.co.uk with the subject “Privacy / data deletion”, or use our contact form. Identify the relevant number, report, message or former account so we can locate it. No app account or sign-in is needed. We will respond within the applicable statutory deadline, normally one month for a UK data-rights request, and explain any permitted extension or information that must be retained. For a public comment about you, you can also use Removal requests. Removal from our service does not automatically erase copies independently held by search engines or other people.

Use Cookie settings to change optional technology choices. Withdrawing consent does not change the lawfulness of earlier processing. You can complain to the Information Commissioner’s Office.

Mobile apps

The Who’s Calling Me? apps do not offer public account creation or login. They send numbers you enter to the same lookup service. The apps do not access your contacts, call history, microphone or precise location. Up to ten recent searches and the reports you choose to hide are stored in local app preferences; you can clear recent searches or restore hidden reports in More. These local preferences remain until you clear them or remove the app’s stored data. Clearing them does not delete public reports or server security records. Uninstalling the app normally removes its local data, but device backups may retain or restore preferences; manage those copies through your device or backup provider. Report and contact forms open our website, where the processing described above applies.

The apps use Google AdMob to fund the free service through banner advertising. We request non-personalised ads and use Google's User Messaging Platform to present applicable consent choices. Ads are requested only when that platform permits them; if consent checks fail, lookup remains available without ads. Google may process IP addresses, approximate location inferred from them, device or app identifiers (including advertising identifiers where permitted by your device and consent settings), ad views, taps and other advertising interactions, and diagnostic/performance information to deliver and measure ads, analyse performance and prevent fraud. Google receives these data through its Mobile Ads SDK; its consent platform also processes information needed to determine and record applicable privacy choices. Non-personalised ads can still use storage and process personal data. We do not pass searched telephone numbers or report text to AdMob as advertising targeting data. See how Google uses information, Google’s privacy policy and Google’s retention information. Google’s own processing and retention depend on the data and purpose; our server retention periods above do not set Google’s retention periods. Google may process information outside the UK under its published transfer safeguards. You can use the privacy controls and request mechanisms described in Google’s policy or contact us for help with an advertising-data enquiry.

Use More → Advertising privacy choices in the app where available to review your choices. You may decline or withdraw optional consent through the choices presented without losing number lookup. Withdrawal affects future processing and does not automatically delete information already lawfully processed. Consent and advertising privacy settings are separate from the website’s Cookie settings. Reading this policy or accepting the terms is not consent to optional advertising technologies. The iPhone app does not request access to the Apple advertising identifier through an App Tracking Transparency permission prompt.

Children’s privacy

The service is a general caller-information tool and is not designed for or directed at children. Do not post personal information about children. If you believe a child has supplied personal information, contact us so we can investigate and remove it where appropriate.

Changes and questions

We date changes to this notice. The service provides general caller information, not an emergency reporting channel. Contact support before sending identity documents or sensitive evidence; staff can advise on a proportionate way to handle it.