UltraCaller Privacy Policy

Last updated: May 11, 2026

This Privacy Policy explains how UltraCaller collects, uses, shares, and protects information about you when you use the UltraCaller mobile application or visit ultra-caller.com (together, the "Service"). It is an integral part of our Terms of Service and should be read together with them. A Hebrew translation may be made available for convenience; in the event of any inconsistency, the English version prevails.

1. Who We Are

The "controller" of your personal data, in the sense of the GDPR and equivalent Israeli law, is:

Za Marketing Ltd.
Email: ultracallerapp@gmail.com
Opt-out form (no registration required): https://ultra-caller.com/opt-out.html

For purposes of Israeli law we are the operator of the database underlying the Service and the entity responsible for it.

2. Scope of this Policy

This policy applies to information processed by UltraCaller through the Service. It does not apply to:

• Third-party services we link to but do not control (Section 8 lists the third parties whose services are embedded in the Service).
• Data processed by the operating system or device manufacturer of your device.
• Data processed by Google Play, Google Account, or other platform providers when you interact with them outside the Service.

3. Categories of Information We Collect

3.1 Information You Provide Directly

• Phone number for verification of your account and as your account identifier.
• Email address if you register or sign in with email or with a Google account.
• Google account identifier if you sign in using Google Sign-In.
• Telegram user identifier if you use Telegram-based one-time-password verification as a fallback when SMS is unavailable.
• Profile information such as a display name and a profile photo (where you choose to provide them).
• Business profile information if you register a business profile, including business name, address, hours, category, logo, and other details you choose to publish.
• Communications with us, such as support messages and opt-out requests.
• Subscription and payment information processed by Google Play Billing and RevenueCat. We do not receive or store full payment-card details.

3.2 Information We Collect with Your Permission From the Device

The following items are collected only after you grant the corresponding Android permission. You can revoke any permission at any time in your device settings.

• Contacts (READ_CONTACTS): the names, phone numbers, email addresses, and labels stored in your device address book. This is the primary input to the Caller ID Directory described in Section 4. You may also use the Service without uploading your contacts; in that case the Service identifies callers using only the directory built from other users' contributions and from third-party sources.
• Modifications to your contacts (WRITE_CONTACTS) when you choose features that update or save contacts on your device.
• Call log (READ_CALL_LOG, WRITE_CALL_LOG): the list of calls made and received on your device, including phone numbers, timestamps, and call duration. This is used to display your call history within the Service and, where supported, to update call entries with caller-identification information.
• Phone state and number (READ_PHONE_STATE, READ_PHONE_NUMBERS): the state of phone calls (incoming, outgoing, idle) and your device phone numbers, used to show caller identification at the right moment and to manage in-call user interface.
• Notifications (POST_NOTIFICATIONS): permission to display notifications such as caller-identification alerts and reminders.
• Display over other apps (SYSTEM_ALERT_WINDOW): permission to draw the caller-identification overlay above other apps and the lock screen.
• Default phone app role (when granted): if you choose to set UltraCaller as your default phone app, we receive in-call events from the operating system in order to render the dialer and in-call interface.
• Call screening role (when granted): if you choose to enable spam screening, the operating system passes incoming-call metadata (such as the caller number) to our screening service so we can suggest blocking suspected spam calls.

3.3 Information We Collect Automatically

• Device information: model, operating-system version, language, time zone, and locale.
• Network information: IP address (truncated where appropriate), connection type, and approximate region inferred from IP.
• App usage information: the features you use, the screens you view, the events you trigger, the duration of sessions, install events, and crash data.
• Advertising identifier (Android Advertising ID, AAID), used by our advertising partner for ad delivery and measurement, where you have not opted out at the device level.
• Session recordings and heatmaps from Microsoft Clarity, including taps, scrolls, gestures, and rendered screens. We use Clarity to understand how users interact with the Service so we can improve it. Clarity does not record screen content from outside our application, and we configure it to mask sensitive fields where supported.
• Push-notification tokens issued by the operating system or by Firebase Cloud Messaging.

3.4 Information We Receive from Third Parties

• Contributions from other users. When other users of the Service share their contact lists with us, those lists may include your name and phone number. This is the same mechanism described in Section 4 below; the legal framing for this is set out there.
• Authentication providers (Google, Telegram) provide us a verification result and basic identifiers when you authenticate through them.
• Subscription provider (Google Play Billing through RevenueCat) provides us your subscription status and product information.
• Advertising partners may provide us aggregated measurement information about ads displayed within the Service.
• Publicly available business information from official directories or business owners themselves, used to enrich business profiles.

3.5 What We Do Not Collect

We do not collect your geographic location through device location services, your microphone audio, the contents of your text messages, or recordings of your phone calls. We do not request the corresponding Android permissions.

4. The Caller ID Directory and Amendment 13

4.1 What the Directory Is

The Service operates a directory of phone numbers and associated names ("Caller ID Directory"). It is built primarily from contact data that users of the Service voluntarily contribute from their device address books, and is supplemented by publicly available information and lawful third-party sources. Functionally it is equivalent to a digital telephone directory.

4.2 Legal Basis (Israel, EU, UK)

Under Israeli law, we operate the Caller ID Directory in reliance on Amendment 13 to the Israeli Privacy Protection Law, 5741-1981 (תיקון 13 לחוק הגנת הפרטיות, התשמ"א-1981), effective as of August 14, 2025, and on the consent of contributing users together with our legitimate interest in operating a caller-identification service. Under Amendment 13, displaying a name next to a phone number where that pairing is sourced from third-party contact data does not, on its own, render the displayed pairing "personal information" requiring registration of a database, provided we comply with the safeguards set out in Section 4.3 below.

For users and data subjects in the European Union, the United Kingdom, and other jurisdictions where the GDPR applies, our legal bases are:

• Article 6(1)(a) GDPR (consent) where you, as a user, choose to contribute your contacts to the Service.
• Article 6(1)(b) GDPR (performance of a contract) for processing necessary to deliver the Service to you.
• Article 6(1)(f) GDPR (legitimate interests) for processing data about non-user data subjects whose information appears in the Caller ID Directory (i.e., people whose names or numbers were contributed by other users), where our interest in operating a caller-identification service, and the broader interest of users in being able to identify unknown callers and protect themselves from spam and fraud, is balanced against and not overridden by the rights of data subjects, taking into account the safeguards in Section 4.3.

4.3 Safeguards That Make This Lawful

We operate the following safeguards, which are essential to the lawful basis described above:

• No random number lookup. The Service does not allow users, partners, or anyone else to enumerate, browse, scrape, sweep, or query random or sequential phone numbers. Lookups are tied to incoming or outgoing calls or to specific numbers a user has a legitimate reason to identify.
• No direct marketing or sale. We do not use the Caller ID Directory, and we do not allow third parties to use it, for direct marketing, automated dialing, telemarketing, political messaging, or unsolicited communications. We do not sell the personal data of identified individuals.
• Free opt-out, no registration required. Anyone, whether or not a user of the Service, can ask us to remove their information from the Caller ID Directory free of charge and without creating an account. The procedure is in Section 11.
• Data minimization. We collect and retain only contact data necessary to operate the Service.
• Transparency. We publish this Privacy Policy and identify the categories of recipients and the rights you have over your data.

5. Why We Use Your Data

The table below summarizes our processing purposes and the legal bases on which we rely.

6. We Do Not Sell Your Data

We do not sell personal data to third parties for monetary or other valuable consideration. We do not share personal data with third parties for their own direct-marketing purposes. The third parties listed in Section 8 act as our service providers (processors) under written contracts that restrict their use of the data to providing the relevant service to us.

7. Sharing Within the Service

The Caller ID Directory is, by design, a service where information you contribute can be displayed to other users when they look up a phone number for which you have provided a label, and where information about you, contributed by other users, can be displayed to users searching for your number, subject to the safeguards in Section 4.3. Where you have a profile (including a business profile), the information you publish to that profile may be shown to users who view it.

8. Service Providers and Third Parties

We use the following service providers to deliver the Service. Each acts as a data processor under a written agreement that restricts their use of data to providing the relevant service to us. Their privacy policies govern their own processing.

We may also disclose information without your consent where we believe in good faith that disclosure is necessary to (a) comply with a legal obligation, court order, or lawful request from a public authority, (b) enforce our Terms of Service, (c) protect the rights, property, or safety of UltraCaller, our users, or others, or (d) in connection with a corporate transaction such as a merger, acquisition, financing, or sale of all or part of our assets, in which case we will notify you and ensure the recipient is bound by privacy commitments at least equivalent to those in this Policy.

9. International Data Transfers

The service providers listed in Section 8 are located in or operate from multiple countries, including the United States and other jurisdictions outside Israel and the European Economic Area. As a result, your data may be transferred to and stored in those countries. Where such transfers involve personal data of EEA, UK, or Swiss data subjects, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) or, where available, adequacy decisions and equivalent mechanisms under UK and Swiss law. You can request a copy of the relevant transfer mechanism by writing to ultracallerapp@gmail.com.

Israeli law permits transfer of personal data abroad subject to the conditions of the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. Our cross-border transfers are made in compliance with those conditions.

10. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purposes described in this Policy and to comply with our legal obligations. Specifically:

• Account data (phone number, profile information): for as long as your account exists, and for a reasonable period after closure to handle disputes and meet legal obligations.
• Caller ID Directory entries contributed by users: for as long as the Service operates, subject to your or the data subject's right to request removal under Section 11. Stale entries are reviewed and reduced periodically.
• Call log and contacts: processed continuously while the relevant permissions are granted; we do not retain a separate copy of your call log on our servers beyond what is needed to deliver features such as call history and identification.
• Subscription and billing records: retained for the period required by Israeli tax and accounting law (currently seven years from the end of the relevant tax year under the Income Tax Ordinance and the Israeli VAT Law) and by analogous foreign laws where they apply.
• Analytics and crash data: typically up to 26 months for aggregated event data, configurable per provider; crash logs are retained for the period needed to investigate and remediate the issue.
• Session recordings (Microsoft Clarity): retained for the default Clarity retention period (typically up to one year) and then deleted or aggregated.
• Logs for security and abuse prevention: typically up to 24 months.
• Records of opt-out and deletion requests: retained as long as needed to demonstrate compliance with the request and applicable law.

11. Your Rights

11.1 If You Are a User

Subject to applicable law, you may exercise the following rights regarding your personal data:

• Access: request confirmation of whether we hold personal data about you and a copy of that data.
• Rectification: ask us to correct inaccurate or incomplete data.
• Deletion ("right to be forgotten"): ask us to erase your data, subject to legal exceptions (for example, retention required by tax or anti-fraud law).
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to processing based on legitimate interests, including the use of your data in the Caller ID Directory.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent: where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to the withdrawal.
• Lodge a complaint: if you are unhappy with how we handle your data, you have the right to complain to a supervisory authority (Section 17).

To exercise any of these rights, write to ultracallerapp@gmail.com. We will respond within the timeframes required by applicable law and in any event without undue delay. We do not charge a fee for these requests except where they are repetitive, excessive, or manifestly unfounded.

11.2 If You Are a Non-user (Identified in the Directory)

If your name appears next to a phone number in the Service because someone else contributed that pairing from their contacts, you have the right to ask us to remove or correct that information, even if you are not a registered user of the Service. You do not need to register an account, and there is no fee. To make such a request, fill in the form at https://ultra-caller.com/opt-out.html or email ultracallerapp@gmail.com. We will verify the request reasonably (typically by confirming control of the phone number) and act on it within the timeframes required by applicable law.

12. Children

The Service is not directed to children under 18 and we do not knowingly collect personal data from children under 18. If you are a parent or guardian and you believe your child has provided personal data to us, contact ultracallerapp@gmail.com and we will take steps to delete the information.

13. Direct Marketing

From time to time we may, with your consent where required by law (including the Israeli Spam Law (סעיף 30א לחוק התקשורת (בזק ושידורים), התשמ"ב-1982)), send you product updates, promotional offers, or news about features that we believe will interest you, by email or push notification. You can opt out at any time by following the unsubscribe instructions in the message, by changing your in-app notification settings, or by writing to ultracallerapp@gmail.com. We do not use the Caller ID Directory for direct marketing and we do not enable third parties to do so.

14. Cookies and Similar Technologies

The mobile application does not use HTTP cookies in the traditional browser sense, but it uses similar technologies, including local storage on your device, mobile advertising identifiers, and SDKs from the providers listed in Section 8, to deliver and measure the Service and its advertising. The website at ultra-caller.com may use a small number of cookies for basic functionality and analytics. Where consent is required, we will request it through an in-app or in-site banner before non-essential technologies are activated.

15. Security

We apply technical and organizational security measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with the Israeli Privacy Protection (Information Security) Regulations, 5777-2017 (תקנות הגנת הפרטיות (אבטחת מידע), התשע"ז-2017) and good industry practice. These measures include encryption of data in transit, access controls, segregation of environments, periodic review of access privileges, and procedures for the management of security incidents. No system is fully secure, and we cannot guarantee absolute security; in the event of a security incident likely to result in risk to your rights, we will notify you and the competent authorities to the extent required by law.

16. Changes to this Policy

We may update this Privacy Policy from time to time. If a change is material, we will provide reasonable advance notice (for example, by in-app notice, by email to your registered address, or by updating the "Last updated" date and prominently posting the change). Your continued use of the Service after the effective date of a change constitutes acceptance of the updated Policy.

17. Complaints and Supervisory Authorities

If you believe that we have not handled your personal data in accordance with applicable law, please first contact us at ultracallerapp@gmail.com so we can try to resolve the matter directly.

You also have the right to file a complaint with the competent supervisory authority. In Israel, this is the Privacy Protection Authority (רשות הגנת הפרטיות) of the Ministry of Justice; information is available at gov.il. In the European Union, you may file a complaint with the supervisory authority of the country where you reside, work, or where the alleged infringement took place. In the United Kingdom, the Information Commissioner's Office (ICO) is the competent authority.

18. Contact

For all privacy-related questions, requests, and complaints:

• Email: ultracallerapp@gmail.com
• Opt-out form (no registration required): https://ultra-caller.com/opt-out.html