Privacy policy

Data controller

CallReply processes personal data to provide its service: detecting your missed calls and sending follow-up texts from your number. Data controller: Kimy Technology (contact@callreply.fr).

Data we process

Account: name, e-mail, phone number (verified by SMS), language; if you sign in with Google, Google sends us your name, your verified e-mail and your Google account identifier (nothing else: neither your password nor your Google contacts). Activity: missed/rejected call events and sent SMS (caller number, date, delivery status), reported by your phone. Address book: only if you enable sync in the app (explicit, revocable consent — revoking deletes synced contacts from our servers); name, first name, numbers and, if there is one, the contact's photo from the phone's address book (a small image, stored privately, visible only in your space). Device: model, versions, permission state (for support). Subscription: handled by Stripe; we never store card data.

How long your data is kept

Following the French data protection authority's doctrine, each category of data has its own retention period, tied to its purpose. • Call and SMS history: phone numbers are erased after 12 months. The rows remain — date, delivery status — but no longer identify anyone, and your aggregate statistics are kept. • Account and profile data: for as long as your subscription lasts, then 5 years under the general limitation period (article 2224 of the French civil code), in restricted-access archiving. After that the account and everything attached to it is deleted. • Billing: 10 years, a period imposed by article L123-22 of the French commercial code. We can neither shorten it nor use it to keep anything else. • Voicemails (calls forwarded to CallReply): the audio file is deleted after 30 days; the row (date, duration) follows the history rule above. • Technical logs (task runs, device health): 6 months. • Synced contacts (photos included): only while you leave syncing on. Revoking it deletes them from our servers immediately; a contact removed from the phone is deleted at the next sync. You can obtain a copy of your data, or have it erased, at any time from "My data" in your account, without waiting for these deadlines.

Recipients and processors

Stripe (payments), Twilio (SMS verification codes), Google/Firebase (notifications), Google (« Continue with Google » sign-in, only if you choose it). No data is sold or shared for advertising.

Transfers outside the European Union

The site and the database are hosted in France. Three processors are established in the United States — Stripe, Twilio and Google/Firebase — and the data they strictly need is transferred there: e-mail address and billing details for Stripe, phone number so Twilio can send the verification code, the device's technical identifier for Firebase notifications. Those transfers are covered by the European Commission's standard contractual clauses. Your call history, your texts and your contacts are sent to none of these providers: they stay on the French hosting.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (GDPR art. 15–21). Exercise them at contact@callreply.fr. You may lodge a complaint with your supervisory authority.

Recipients of your texts

Automatic texts are sent from your number and under your responsibility. Any correspondent can be excluded via the STOP list; you undertake to add anyone who requests it.

Cookies and trackers

Here is the complete list, kept up to date automatically, of what the site stores in your browser. Services marked "with your consent" never load before you choose; your consent is kept 6 months, then asked again. You can withdraw it at any time with "Manage my cookies" at the bottom of every page. • CallReply — Essential (essential). Keeps your session open from page to page and protects forms (anti-forgery token). Cookies: callreply-session, XSRF-TOKEN. Duration: End of the visit (at most 2 hours of inactivity). Recipient: CallReply. • CallReply (choix cookies) — Essential (essential). Remembers your cookie choice so you are not asked on every page. Cookies: cr_consent. Duration: 6 months. Recipient: CallReply. • CallReply (affichage) — Essential (essential). Remembers the light or dark display of your customer area (browser local storage, never sent). Cookies: localStorage: darkMode. Duration: Until you change it. Recipient: CallReply. • Stripe — Essential (essential). Subscription payment. Stripe's cookies are only set on Stripe's payment page (checkout.stripe.com), never on callreply.fr. Cookies: none. Duration: Set by Stripe. Recipient: Stripe Payments Europe. • Google Sign-In — Essential (essential). Signing in with your Google account. Google's script is loaded only if you click « Continue with Google » on the sign-in and sign-up pages; Google then sets its cookies on its own domains (accounts.google.com), never on callreply.fr. Cookies: none. Duration: Set by Google. Recipient: Google Ireland Limited.