ENDE
// PRIVACY · LAST UPDATED: 2026-10-25

Privacy Policy

This Privacy Policy describes what personal data Callday collects, how it is processed, and what rights you have regarding your data. It applies to the callday.io website and the Callday apps for iOS and Android.

Callday is operated from Germany. Because of that, the EU General Data Protection Regulation (GDPR) is the legal framework for everything we do with your data — even if you live in the US. We've translated the legal references below for an English-speaking audience, but they refer to the same statutes cited in the German version.

1. Data Controller

Controller within the meaning of Article 4(7) GDPR:

Jan Bettermann Bensberger Marktweg 338 51069 Cologne Germany

Email: hello@callday.io

2. What Data We Collect

2.1 When You Visit This Website

When you access this website, your browser automatically transmits information to our hosting provider, which is stored temporarily in server logs:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a stable, secure website).

We also use Vercel Web Analytics to see which pages are visited. It works without cookies and without building user profiles: visitors are counted using an anonymized identifier that is discarded after 24 hours, and no data is linked to your account or used for advertising.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used).

We also store the country you use Callday from with your account, as a two-letter country code. Our hosting provider derives it from your IP address when you use the app or the website while signed in. We keep only the country code, never the IP address. We use it to understand which markets our users come from.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding where our product is used).

2.2 When You Join the Waitlist

If you sign up for the Callday waitlist or early access, we collect:

Purpose: Informing you about the launch and beta access. Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR (pre-contractual measures).

2.3 When You Use the App (iOS and Android)

The Callday app stores lead data and call outcomes locally on your device first. When you sign in, we sync the following data to our database:

Purpose: Providing app functionality, cross-device synchronization, automatic email sending for booked appointments. Legal basis: Art. 6(1)(b) GDPR (contract performance).

Error and performance diagnostics. To find and fix crashes, the app sends crash reports and sampled performance data to our error-tracking provider Sentry. These reports contain technical information (device model, operating system, app version, the error itself). Lead data — company names, phone numbers, email addresses, notes — is stripped from every report on your device before it is sent. Each report also carries a random identifier that is created when the app is installed. It is not linked to your name or email address, changes when you reinstall the app, and only tells us how many installations an error affects. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable app).

Usage events. To understand how the app is used and where people get stuck, the app records usage events: which screens you open, and when you open a list, start the demo list, start a call, log a call outcome, book a meeting, export a list, build a list, or see the subscription screen. When you are signed in on callday.io, the website records the same kind of events for your account: when you view your lists, open a lead preview, start a list, or tap a link to the app or the app store. For this the website stores nothing on your device; its session identifier only exists while the page is open. Each event carries your account ID, the app or website version, the operating system (or "web") and a random identifier for the current session. It never contains lead data, notes, or the content of your calls and emails. These events are stored on our Supabase servers in the EU and deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the app).

App updates. When the app starts, it asks the servers of our update provider Expo whether a newer version of the app's code is available. This request contains the app version, the operating system and a random identifier created when the app was installed, which Expo uses to count active installations. It contains no account or lead data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in delivering bug fixes quickly).

Your location (optional). The list generator can search for businesses around you. If you allow location access, the app reads your device's location while you use the generator — never in the background. To name the spot on the map, the coordinates are matched to a place by your device's operating system (Apple or Google) and by our server, which looks up the nearest postal code. When you generate a list, the coordinates and the search radius are sent to our server and stored with your request, so we can deliver the list and avoid sending you the same businesses twice. Our lead data provider only receives the business category and the postal codes and place names of the search area, never your coordinates or your account. If you don't allow location access, you can type a city instead; you can withdraw the permission at any time in your device settings. Legal basis: Art. 6(1)(b) GDPR (contract performance — providing the search you requested).

What stays on your device. Some features work without sending data to us:

2.4 When You Subscribe

If you subscribe to Callday through our website, payment processing runs through our payment provider Stripe. The following data is processed:

If you subscribe inside the app, the purchase is handled by Apple (In-App Purchase, iOS) or Google (Google Play Billing, Android). We never receive your payment method data. To manage subscriptions across both stores we use RevenueCat, which receives your Callday account ID, the store's transaction identifiers, the product you bought, and the subscription status. Before you sign in, RevenueCat uses a random identifier created on your device instead; it is linked to your account once you sign in. We store the resulting subscription status in your account.

On iOS, the subscription screen itself is delivered by Superwall. When you open it, Superwall receives your Callday account ID, technical device information (app version, OS version, device model, language, region) and which subscription screen you saw and what you tapped on it. RevenueCat additionally forwards the resulting purchase, renewal and cancellation events to Superwall so we can measure which screen versions work. Superwall does not receive your name, e-mail address or any lead data, and does not track you across other apps.

Purpose: Contract performance, invoicing, recurring billing, statutory retention of accounting records. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory bookkeeping obligations under § 147 German Fiscal Code (AO) and § 257 German Commercial Code (HGB)).

2.5 When You Apply to the Partner Program

If you apply to join the Callday Partner Program at callday.io/partners, we collect:

We use these details only to review your application, and we may look at your public Instagram profile to do so. If we accept your application, the details become part of your partner account. If we decline it, we delete them. To prevent abuse, we count applications per IP address for one hour using a pseudonymized value, not the IP address itself.

Purpose: Reviewing your application to the Partner Program. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

2.6 When You Send Us a Question About the Partner Program

If you send us a question through the form at callday.io/partners, we collect your name, your email address and your message. We do not store them in our database. They reach our Microsoft 365 mailbox as an email (sent through Resend), and we answer from there. We use them only to answer you. To prevent abuse, we count messages per IP address for one hour using a pseudonymized value, not the IP address itself.

Purpose: Answering your question. Legal basis: Art. 6(1)(b) GDPR where your question is about joining the Partner Program, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries).

2.7 When You Sign Up From Outside the EU (Measuring Our Meta Ads)

We advertise Callday on Facebook and Instagram. To learn whether these ads lead to sign-ups, and so that Meta can show them to people who are likely to be interested, our server reports two events to Meta through Meta's Conversions API: when you start signing up on this website, and when you confirm your account. We do not use the Meta Pixel and do not set Meta cookies in your browser.

With each event we send:

We only send these events for visitors outside the European Union, the European Economic Area, the United Kingdom and Switzerland. We determine this from the country our hosting provider derives from your IP address. If you visit from one of these regions, or if your country can't be determined, nothing is sent to Meta.

Meta uses the data to attribute sign-ups to ads and to measure and improve the delivery of our ads, and then processes it under its own responsibility as described in its Privacy Policy. For collecting and transmitting the data, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum. Data may be transferred to Meta Platforms, Inc. in the USA; Meta relies on the EU–U.S. Data Privacy Framework and EU Standard Contractual Clauses.

Purpose: Measuring and improving our advertising on Facebook and Instagram. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring how effective our advertising is). You can object at any time (Art. 21 GDPR) by writing to hello@callday.io. You can also control which ads you see in your Facebook or Instagram account under Accounts Center → Ad preferences.

2.8 Our Pages on Facebook and Instagram

We run a page for Callday on Facebook and a profile on Instagram. When you visit them, Meta processes your data under its own Privacy Policy. Meta gives us aggregated, anonymous statistics about visits to our pages ("Page Insights"). For these statistics, we and Meta Platforms Ireland Limited are joint controllers under the Page Insights Controller Addendum, with Meta bearing primary responsibility. If you send us a message or leave a comment there, we see your public profile name and your message and use them only to answer you.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in presenting Callday and staying in touch with people who are interested in it).

3. Recipients and Third-Party Processors

We use carefully selected data processors (Art. 28 GDPR):

Apart from measuring our own ads with Meta (see 2.7), we do not share your data with third parties for advertising purposes, and we do not sell it.

4. Google API Services User Data Policy

When you connect your Google account (Gmail) with Callday, we use the OAuth scope gmail.send to send appointment confirmation and reminder emails on your behalf from your Gmail account. We do not read, store, or process any incoming emails, contacts, or other Gmail content. The OAuth refresh token is stored encrypted on the server side and is used exclusively to send the confirmation and reminder emails for appointments you book.

Callday's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In concrete terms: data received via Google APIs is used solely to provide the feature described above. It is not used for advertising, not used to train AI or machine-learning models, not transferred to third parties, and not read by humans — except with your explicit consent, for security purposes (e.g. abuse detection), for anonymized internal operations, or as required by law.

5. Data Retention

6. Your Rights

You have the right at any time to:

You can delete your account, including all data, at any time — in the app under Settings → Account → Delete account, or on the web at callday.io/account. You can also request deletion by email. All steps are described at callday.io/delete-account.

For other requests, please contact hello@callday.io.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

The authority responsible for our location in Germany is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

8. Data Security

We use technical and organizational measures to protect your data — in particular SSL/TLS encryption for every data transmission, encrypted storage of sensitive values (e.g. OAuth tokens), and access restrictions at the database level (Row-Level Security).

9. Changes to This Policy

We update this Privacy Policy when our feature set, legal requirements, or the third-party services we use change. The current version is always available at callday.io/privacy.

Last updated: 2026-11-03