GDPR-Compliant Cloud Telephony for Businesses
Our browser-based telephony is aimed exclusively at business customers. FluffyCall is registered with the German Federal Network Agency (BNetzA) as a telecommunications provider and is bound by telecommunications secrecy. The data we process is described in full in our Privacy Policy.
Data Processing & Server Locations
Our servers are hosted by Hetzner in Nuremberg, Germany. To connect calls to the telephone networks we work with Telnyx. Telnyx currently stores call detail records in the USA.
Transfers to the USA are safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) under Art. 45 and 46 GDPR.
Roles & Contracts
FluffyCall is itself the controller under GDPR for your account and call data. A data processing agreement with customers is therefore not provided.
Telnyx acts as an independent controller for connection data. With our service providers Hetzner (hosting) and Strato (email) we have data processing agreements under Art. 28 GDPR.
Technical & Organizational Measures (TOMs)
To protect your data, we use measures including the following:
🔐 Encryption
Website and dashboard are served over HTTPS only. Voice and signaling between your browser and Telnyx are encrypted (WebRTC with DTLS-SRTP).
🔑 Access Controls
Only the owner has access to customer data. Passwords are stored as hashes only (bcrypt).
📊 Backups & Logging
Daily backups, automatically verified, with an alert on failure. Server logs are deleted after 14 days.
Anti-Fraud & Abuse Protection
To protect against abuse and unexpected costs, fixed rules apply:
- Blocked numbers: Premium-rate, special-service and emergency numbers currently cannot be dialed.
- Prepaid with limits: Calls are only possible with credit. When it runs out, an ongoing call ends automatically.
- Protected sign-up: Bot protection via Cloudflare Turnstile; disposable email addresses are blocked.
- Manual review: New accounts are checked by hand if anything looks unusual and only activated afterwards.
Data Retention & Deletion Periods
Connection data (date, time, duration, phone numbers) is stored for billing and anonymized after 6 months. Only country, duration, cost and date remain. Call contents are not recorded.
Account data (name, company, email) is stored for the duration of the business relationship. Billing-relevant records are kept for the statutory periods under German law (HGB, AO). Payment data is processed by Stripe; we do not store card details.
Your Rights as a User
Under GDPR, you have the following rights regarding your personal data:
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data ("Right to be Forgotten", Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Complaint to the supervisory authority (Art. 77 GDPR)
To exercise your rights, please contact us at: service@fluffycall.com
The competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information.
Transparency & Accountability
All service providers we use, with location, role and legal basis, are listed in section 6 of our Privacy Policy.