Privacy Policy
Last updated: October 12, 2026
Table of Contents
1. Controller & Contact
Controller responsible for data processing under GDPR:
FluffyCall
Javed Saeed
Sole Proprietorship
Ludwig-Barnay-Platz 5
14197 Berlin
Email: service@fluffycall.com
Website: https://fluffycall.com
Privacy contact: service@fluffycall.com. We have not appointed a data protection officer, as this is not legally required.
2. Basics of Data Processing
2.1 Scope: We process personal data only to the extent necessary to provide our telephony service, for billing, to comply with legal obligations and to protect against misuse.
2.2 Transparency: This Privacy Policy informs you about what data we collect, what we use it for, to whom we disclose it and what rights you have.
2.3 Our Role: FluffyCall is a telecommunications provider for outbound international calls, registered with the German Federal Network Agency (Bundesnetzagentur). The controller under the GDPR is FluffyCall (see section 1). To route calls into the telephone networks, we work with Telnyx LLC. Telnyx processes the connection data required for this as an independent controller (see section 6.1).
3. Legal Basis
We process your personal data on the following legal bases:
| Legal Basis | Purpose |
|---|---|
| Art. 6(1)(b) GDPR (performance of contract) | Registration, provision of the telephony service, billing, service emails about your account |
| Art. 6(1)(c) GDPR (legal obligation) | Retention of invoices and accounting records (8 years, Section 147 German Fiscal Code), obligations under the German Telecommunications Act (TKG) and the TDDDG |
| Art. 6(1)(f) GDPR (legitimate interest) | Prevention of misuse and fraud, bot protection, system security, measuring advertising performance (see 8.2 and 8.4) |
| Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent) | Google Analytics, campaign source in the browser (see 8.2) and Microsoft Advertising (see 8.5), only after your consent via our consent tool |
| Section 25(2) No. 2 TDDDG | Storage of technically necessary information in your browser (login, your consent choice) |
4. Registration & Account Data
4.1 Data Collected During Registration
Registration takes two steps: first you create an account with your email address and password. Then you complete your details in a setup step. We process the following data:
| Data | Purpose | Required |
|---|---|---|
| Email address | Login, communication, sending invoices | Yes |
| Password (as bcrypt hash) | Login | Yes |
| First and last name | Contact person, invoicing | Yes |
| Company name | Invoicing | Yes |
| Country | Prices, tax classification | Yes |
| IP address at registration | Protection against misuse, traceability of the registration | Automatic |
| Source of the sign-up (e.g. Google click ID gclid, campaign ID) | Measuring advertising performance (see 8.2, 8.4 and 8.5) | Automatic |
| Result of the bot check (Cloudflare Turnstile, see 6.5) | Protection against automated registrations | Automatic |
You enter your VAT ID when paying via Stripe (see 6.2).
Legal basis: Art. 6(1)(b) GDPR (performance of contract); for IP address, source and bot check Art. 6(1)(f) GDPR (legitimate interest in preventing misuse and measuring advertising).
4.2 Password Security
Passwords are hashed with bcrypt and never stored in plain text. We cannot see your password either.
4.3 Service Emails
We send you emails about your account, e.g. to confirm your email address, to reset your password, and a reminder if you have not made a call yet after registering. You can object to the reminder at any time by email to service@fluffycall.com.
5. Telephony & Connection Data
5.1 No Recording of Call Content
5.2 Stored Connection Data (Metadata)
For every call made via FluffyCall, the following connection data is stored:
| Data | Purpose |
|---|---|
| Number called | Billing, call history |
| Date and time | Billing, traceability |
| Call duration | Per-second billing |
| Costs | Billing, transparency |
| Destination country and line type | Price calculation, call history |
| Call status (successful/failed) | Support, quality assurance |
| Displayed caller ID | Technical assignment, prevention of misuse |
| Internal customer number | Assignment to your account, billing |
| Technical identifiers of the call at Telnyx | Technical tracing, support, resolving billing questions |
After 6 months, this data is anonymized (see 5.4).
Legal basis: Art. 6(1)(b) GDPR (performance of contract, billing) in conjunction with Sections 9 and 10 TDDDG.
5.3 Telecommunications Data
As a telecommunications provider, FluffyCall is subject to the German Telecommunications Act (TKG) and the Telecommunications Digital Services Data Protection Act (TDDDG), in particular the secrecy of telecommunications (Section 3 TDDDG). We use traffic data only to establish the connection, for billing and to prevent misuse (Sections 9, 10 and 12 TDDDG).
We commit to:
- Using connection data only for the purposes stated
- Not disclosing connection data to third parties, except to our telephony partner Telnyx where necessary for the connection
- Not creating profiles of your usage behavior
- Deleting or anonymizing data after the retention period
5.4 Storage & Retention
Anonymization after 6 months: Connection data is automatically anonymized 6 months after the call. The number called is shortened to the country code, and the caller ID and Telnyx technical identifiers are deleted. Country, line type, duration, costs, status and date are kept. The person called can no longer be identified.
Legal basis:
- Art. 6(1)(b) GDPR: performance of contract (billing)
- Art. 6(1)(c) GDPR in conjunction with Section 10 TDDDG: storage of traffic data for billing
- Art. 6(1)(f) GDPR: legitimate interest (prevention of misuse, resolving billing questions)
Access: You can view your call history at any time in the dashboard.
6. Recipients, Service Providers & Third Countries
We use the following service providers. Where they act on our behalf (processors), contracts under Art. 28 GDPR are in place; this applies to Hetzner and Strato. Telnyx acts as an independent controller for the connection data, as does Stripe for certain purposes such as fraud prevention.
6.1 Telnyx LLC (Telephony)
| Aspect | Details |
|---|---|
| Purpose | Routing your calls into the telephone networks |
| Role | Independent controller for the connection data (per the Telnyx Data Processing Addendum) |
| Provider | Telnyx LLC, 600 Congress Avenue, 14th Floor, Austin, TX 78701, USA |
| Data processed | Number called, displayed caller ID, time, duration, IP address and technical connection data |
| Place of processing | Mainly USA |
| Third-country transfer | EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46 GDPR) |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract) |
| More information | https://telnyx.com/privacy-policy https://telnyx.com/legal/data-processing-addendum |
6.2 Stripe (Payment Processing)
| Aspect | Details |
|---|---|
| Purpose | Processing payments, tax calculation, receipts for top-ups |
| Provider | Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA) |
| Data processed | Payment data, billing details, VAT ID (card data is stored only by Stripe, not by FluffyCall) |
| Third-country transfer | EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46 GDPR) |
| Website | https://stripe.com/privacy |
6.3 Hetzner Online GmbH (Hosting)
| Aspect | Details |
|---|---|
| Purpose | Running the website, customer area and database, daily server backups |
| Location | Germany (data center in Nuremberg) |
| Data processed | All data stored by FluffyCall (account, call history, logs) |
| Legal basis | Data processing agreement under Art. 28 GDPR |
| Website | https://www.hetzner.com/legal/privacy-policy/ |
6.4 STRATO AG (Email Delivery)
| Aspect | Details |
|---|---|
| Purpose | Sending all emails (confirmation, password, reminders, service emails) and receiving your inquiries |
| Location | Germany (STRATO AG, Berlin) |
| Data processed | Email address, name, content of emails |
| Legal basis | Data processing agreement under Art. 28 GDPR |
6.5 Cloudflare Turnstile (Bot Protection)
| Aspect | Details |
|---|---|
| Purpose | Protecting the registration form against automated sign-ups |
| Provider | Cloudflare, Inc., San Francisco, USA |
| Data processed | IP address, browser and device characteristics |
| Third-country transfer | EU-US Data Privacy Framework (Art. 45 GDPR) |
| Legal basis | Art. 6(1)(f) GDPR (legitimate interest in preventing misuse) |
| Website | https://www.cloudflare.com/privacypolicy/ |
6.6 Google (Analytics and Ad Measurement)
We describe Google Analytics and the measurement of our Google ads in section 8.
6.7 Microsoft (Ad Measurement)
We describe the measurement of our Microsoft ads in section 8.5.
7. Retention Periods
We delete your data as soon as the purpose of storage no longer applies and no statutory retention obligations prevent deletion.
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Account data (name, company, country, email, password hash, IP address at registration, source) | Until the account is deleted | Performance of contract, legitimate interest |
| Call history (connection data) | 6 months in full, then anonymized | Billing (Section 10 TDDDG) |
| Invoices and accounting records | 8 years | Tax retention obligation (Section 147 German Fiscal Code) |
| Web server logs (IP address, time, page requested) | 14 days | Security, prevention of misuse |
| Application logs (for security events: IP address and email address) | 30 days | Security, prevention of misuse |
| Backups | 14 days (database), 7 days (server backup at Hetzner) | Security, recovery |
| Google Analytics | Event data 2 months, user data 14 months | Consent (revocable at any time) |
7.1 Deletion After Account Deletion
You can request deletion of your account by email to service@fluffycall.com. Your data is then handled as follows:
- Account data: deleted without undue delay, at the latest within one month
- Call history: deleted unless it must be kept as part of accounting records
- Invoices and accounting records: kept for 8 years (legal obligation)
- Remaining credit: expires without replacement
- Backups: your data disappears as the backups expire (at the latest after 14 days)
8. Cookies & Browser Storage
8.1 Technically Necessary Storage
FluffyCall itself does not set any tracking cookies. To operate the website, we store the following information in your browser:
| Name | Type | Purpose | Retention |
|---|---|---|---|
| klaro | Cookie | Stores your choice in the consent tool | 120 days |
| token | Browser storage | Login to the customer area | Until logout |
| lastActivity | Browser storage | Automatic logout after inactivity | Until deleted in the browser |
| lastMonthlySummary | Browser storage | Notice about the monthly summary in the dashboard | Until deleted in the browser |
Legal basis: Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR (technically necessary operation).
8.2 Source of the Sign-up
If you reach our website via an ad or a link with a campaign ID (e.g. the Google click ID gclid or the ID src), we pass this ID on in the address bar when you move between our pages. Nothing is stored on your device for this. If you register during the same visit, the ID is saved with your account. This lets us see how customers find us.
Only if you consent to advertising measurement ("Campaign source") in the consent tool do we also store the ID in your browser storage (_fc_gclid, _fc_src), so that it can be attributed on a later visit as well. If you withdraw your consent, these entries are deleted.
Legal basis: For storage in the browser, your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). For linking the ID to your account at registration, our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR).
8.3 Google Analytics
FluffyCall uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is only loaded after you have consented via our consent tool. Only then does Google set its own cookies (e.g. _ga).
Purpose: Analysis of website usage to improve our offering
Data collected:
- Page views and time on page
- Device information (browser, operating system)
- Approximate location (country, region); IP addresses are not stored by Google Analytics 4
Retention: Event data 2 months, user data 14 months
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent)
Third-country transfer: Google may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Withdrawal: You can withdraw your consent at any time with effect for the future, e.g. by deleting the cookies of this website in your browser. The consent tool will then appear again on your next visit.
More information: Google Privacy Policy
8.4 Server-side Measurement of Advertising Performance (Google Measurement Protocol)
After a successful registration, our server sends an event to Google. If you came via a Google ad, it contains the Google click ID (gclid). This allows Google to attribute the registration to the respective ad. Name and email address are not transmitted. This measurement takes place independently of the consent tool.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring our advertising)
8.5 Microsoft Advertising (Conversion Measurement)
We run ads via Microsoft Advertising, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"). Only if you consent to advertising measurement ("Microsoft Advertising") in the consent tool do we load the Microsoft "Universal Event Tracking" (UET) tag. It sets cookies (e.g. _uetsid, _uetvid) and reports page views and a successful registration to Microsoft. This tells us whether an ad led to a registration. Name and email address are not transmitted.
Storage period: _uetsid up to 1 day, _uetvid up to 13 months
Legal basis: Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (consent)
Third-country transfer: Microsoft may transfer data to the USA. Microsoft is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Withdrawal: You can withdraw your consent at any time with effect for the future, e.g. by deleting this website's cookies in your browser. The consent tool will then appear again on your next visit.
More information: Microsoft Privacy Statement
9. Data Security
We take technical and organizational measures to protect your data against unauthorized access, loss or misuse:
9.1 Technical Measures
- Encrypted transmission: All connections to the website use HTTPS (TLS)
- Password hashing: Passwords are hashed with bcrypt, not stored in plain text
- Access control: Access to server and database exclusively for the owner
- Firewall and rate limiting: Protection against unauthorized access and overload attacks
- Backups: Daily database backup, kept for 14 days
- Misuse protection: Block lists for expensive premium numbers, credit limits, bot protection at registration
9.2 Organizational Measures
- Only the owner has access to customer data
- Written commitment to the secrecy of telecommunications
- Regular security updates
- Notification of data breaches to the supervisory authority and, where required, to data subjects (Art. 33 and 34 GDPR)
10. Your Rights
You have the following rights regarding your personal data:
10.1 Right of Access (Art. 15 GDPR)
You can request information about the data we store about you at any time.
10.2 Right to Rectification (Art. 16 GDPR)
You can request the correction of inaccurate data.
10.3 Right to Erasure (Art. 17 GDPR)
You can request the deletion of your data unless statutory retention obligations prevent it (e.g. invoices).
10.4 Right to Data Portability (Art. 20 GDPR)
You can request your data in a common, machine-readable format.
10.5 Right to Object (Art. 21 GDPR)
You can object to the processing of your data on grounds relating to your particular situation. You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).
10.6 Right to Restriction of Processing (Art. 18 GDPR)
You can request restriction of the processing of your data.
10.7 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.
Supervisory authority responsible for FluffyCall:
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Website: https://www.datenschutz-berlin.de
10.8 Exercising Your Rights
To exercise your rights, please contact us at:
Email: service@fluffycall.com
Subject: "Privacy Request"
We will respond to your request within one month.
11. Changes to Privacy Policy
11.1 Adjustments: We reserve the right to adapt this Privacy Policy to reflect changes in law or changes to our services.
11.2 Notification: We will inform you by email about substantial changes.
11.3 Current Version: The current version is always available at https://fluffycall.com/privacy.html.