PRIVACY POLICY

================================================================================ PRIVACY POLICY FOR VERICALL: CALLER ID & SPAM ================================================================================ Last Updated: October 13, 2026 Effective Date: October 13, 2026 1. INTRODUCTION AND OVERVIEW -------------------------------------------------------------------------------- This Privacy Policy describes how VeriCall: Caller ID & Spam ("VeriCall", "we", "our", or "us") collects, uses, processes, stores, and protects your information when you download, install, access, or use the VeriCall iOS mobile application (the "App") and any related services (collectively, the "Services"). We are committed to protecting your personal privacy. We understand that your contacts, phone calls, and device data are sensitive. This Privacy Policy is designed to be transparent about what data we access, why we access it, and how it is handled in strict compliance with the Apple App Store Review Guidelines, the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other applicable global privacy regulations. PLEASE READ THIS POLICY CAREFULLY. BY DOWNLOADING, INSTALLING, OR USING THE APP, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH ANY PART OF THIS POLICY, PLEASE DO NOT USE THE APP. 2. DATA CONTROLLER AND CONTACT DETAILS -------------------------------------------------------------------------------- For users residing in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the data controller responsible for your personal data is: App Name: VeriCall: Caller ID & Spam Application Bundle ID: com.yashdhadukpersonalteam.A12ContactFinder Developer / Owner: VeriCall Team (Yash Dhaduk) Support & Privacy Email: support@vericallapp.com Privacy Portal / Website: https://truecaller-id-contacts.blogspot.com 3. INFORMATION WE ACCESS, COLLECT, AND PROCESS -------------------------------------------------------------------------------- We believe in data minimization. We only access and process information that is strictly necessary to provide the features and functionality of the App. A. On-Device Contacts (Address Book) - Permission Requested: NSContactsUsageDescription ("We need access to your contacts to help you search, identify callers, and manage your contacts.") - How It Works: If you explicitly grant access to your Contacts, VeriCall reads and indexes your contacts locally on your physical iOS device using Apple's native CNContactStore framework. - STRICT PRIVACY GUARANTEE: YOUR CONTACTS STAY ON YOUR DEVICE. We DO NOT upload, sell, rent, share, or syndicate your personal contact list, phone numbers, or address book names to our servers, third-party databases, public directories, or external advertisers. All contact searches and matching against your personal address book occur entirely offline on your device. B. Telephone Number Lookup Queries - When you use the search feature to look up an unknown phone number, the specific phone number digits and selected country code are transmitted via secure HTTPS encryption to our search directory API providers (including Appsquad and Callswho search services). - Purpose: To retrieve publicly available caller identity, carrier name, telecom line type, geographical location, and community spam reputation score. - Search queries are processed in real-time to return the query result and are not attached to your identity or personal contacts. C. Spam Reporting and Community Shield Contributions - If you voluntarily report or tag a phone number as spam, telemarketing, scam, debt collector, or nuisance caller, the reported telephone number, the spam category tag, and any optional comment you provide are submitted to the community reputation database. - These reports are aggregated anonymously to protect community members from fraudulent and unwanted incoming calls. D. Call Directory and CallKit Data - VeriCall integrates with Apple CallKit (CXCallDirectoryManager) to enable caller identification and call blocking directly within the iOS native phone interface. - Your custom blocked numbers list is stored locally on your device within an encrypted App Group container (group.com.truecallerid.app) and synced directly with the iOS Call Directory Extension. We do not transmit your blocked numbers to external servers. E. Location Information (Approximate / When In Use) - Permission Requested: NSLocationWhenInUseUsageDescription ("We use your location to identify callers and provide localized search results.") - How It Works: The App may check your general geographical location or ISO country code to set default international dialing codes and provide relevant regional caller lookup data. - We do not track your precise GPS background location or continuous location. F. Device, Technical, and Diagnostic Data - Device model, hardware architecture, operating system version (e.g., iOS 17/18), system language preference, and time zone. - App launch counts, session duration, and feature usage analytics. - Network status (monitored via Apple Network framework / NWPathMonitor) to determine whether an active Wi-Fi or cellular connection is present. G. Push Notification Data - If you grant notification permissions, we receive an Apple Push Notification service (APNs) token and Firebase Cloud Messaging (FCM) registration token. - Purpose: To send periodic daily spam safety reminders, security alerts, and important service announcements. You can disable notifications anytime in iOS Settings. H. Advertising Identifier and Tracking (ATT Consent) - Permission Requested: NSUserTrackingUsageDescription ("This app uses your data to deliver better relevant ads.") via Apple App Tracking Transparency (ATT). - If you grant permission, the IDFA (Identifier for Advertisers) may be used by Google Mobile Ads (AdMob) to deliver personalized, relevant advertising. - If you decline permission, non-personalized advertising is served, and your IDFA is not tracked across third-party apps or websites. 4. LEGAL BASES FOR PROCESSING (GDPR / UK GDPR) -------------------------------------------------------------------------------- If you are located in the EEA or UK, we process your personal data under the following lawful bases: 1. Consent (Article 6(1)(a) GDPR): When you grant permissions for Contacts, Push Notifications, or personalized advertising tracking via the Apple ATT prompt or Google UMP consent banner. 2. Performance of a Contract (Article 6(1)(b) GDPR): To deliver the caller identification, phone search, and premium subscription features you request. 3. Legitimate Interests (Article 6(1)(f) GDPR): To detect fraudulent activities, maintain application stability, improve database lookup quality, and secure our systems. 4. Legal Obligations (Article 6(1)(c) GDPR): To comply with applicable statutory and regulatory requirements. 5. THIRD-PARTY SERVICES AND SDks -------------------------------------------------------------------------------- VeriCall incorporates trusted third-party software development kits (SDKs) and API providers that may process information subject to their own privacy policies: A. Google Mobile Ads (AdMob) & Google User Messaging Platform (UMP) - Provider: Google LLC - Purpose: Displaying banner, native, interstitial, and app open advertisements, and collecting consent for European and global privacy regulations. - Data Processed: Advertising ID (IDFA if permitted), IP address, device specs, interaction events. - Policy: https://policies.google.com/technologies/ads B. Firebase (Google Core, Cloud Messaging, Remote Config) - Provider: Google LLC - Purpose: Remote configuration of app parameters, ad capping, push notification delivery, and stability monitoring. - Policy: https://firebase.google.com/support/privacy C. RevenueCat - Provider: RevenueCat, Inc. - Purpose: Managing and validating in-app purchases, auto-renewing subscriptions, and entitlement states. - Data Processed: Anonymous App User ID, transaction receipt data, purchase timestamps. - Policy: https://www.revenuecat.com/privacy D. IQKeyboardManager - Purpose: Local user interface keyboard management. Does not transmit data. E. Caller Lookup API Providers (Appsquad / Callswho) - Purpose: Fulfilling phone number lookup and spam risk evaluation queries. - Data Processed: The specific telephone number entered by the user. 6. IN-APP PURCHASES AND SUBSCRIPTION DATA -------------------------------------------------------------------------------- If you purchase a VeriCall Premium subscription: - All financial transactions and payment processing are handled exclusively by Apple Inc. via the iOS App Store. - We never receive, process, or store your credit card, debit card, or banking details. - We receive only an anonymized transaction identifier and entitlement status via RevenueCat to unlock premium features (such as ad-free experience and unlimited caller queries). 7. DATA RETENTION AND STORAGE -------------------------------------------------------------------------------- - On-Device Data: Your local search history, cached profiles, and custom blocked numbers remain on your device. You can completely erase this data at any time by navigating to App Settings -> "Clear Cache / Data". - Lookup Logs: Server-side search API logs are kept only as long as necessary to prevent abuse and ensure query performance, typically deleted or anonymized within 30 to 90 days. - In-App Purchase Entitlements: Retained for the active duration of your subscription to verify license validity. 8. SECURITY OF YOUR DATA -------------------------------------------------------------------------------- We implement robust administrative, technical, and physical security measures to protect your information: - All external network communication uses industry-standard Transport Layer Security (TLS / HTTPS) encryption. - Sensitive access keys and bearer tokens are secured using industry best practices. - No user address books are stored on our servers, eliminating the risk of centralized contact database breaches. 9. YOUR PRIVACY RIGHTS (GDPR, CCPA/CPRA, AND GLOBAL) -------------------------------------------------------------------------------- Depending on your country or state of residence, you have significant rights regarding your personal data: A. European Union / United Kingdom (GDPR / UK GDPR) - Right of Access: You may request details of any personal data we hold about you. - Right to Rectification: You may request correction of inaccurate data. - Right to Erasure ("Right to be Forgotten"): You may request deletion of your data. - Right to Restrict or Object to Processing: You can object to specific data uses. - Right to Data Portability: You may request an export of your information. - Right to Withdraw Consent: You can revoke Contacts access, Push Notifications, or Tracking permissions at any time via your device's iOS Settings -> VeriCall. - Right to Lodge a Complaint: You have the right to lodge a complaint with your local Data Protection Authority (DPA). B. California Residents (CCPA / CPRA) - Right to Know: You may request disclosures of personal information collected, categories of sources, and third parties with whom data is shared. - Right to Delete: You may request deletion of personal information collected. - Right to Opt-Out of Sale / Sharing: WE DO NOT SELL YOUR PERSONAL INFORMATION. We do not exchange user contacts or personal information for monetary or other valuable consideration. - Right to Non-Discrimination: You will not receive discriminatory treatment or diminished service quality for exercising your CCPA rights. To exercise any of these rights, contact our Privacy Officer at support@vericallapp.com. 10. CHILDREN'S PRIVACY -------------------------------------------------------------------------------- VeriCall does not knowingly collect, solicit, or maintain personal information from children under the age of 13 (or under 16 in the European Union). If we become aware that personal information of a child under 13/16 has been collected without verified parental consent, we will promptly delete such information. If you believe that a child has provided us with personal information, please contact us immediately at support@vericallapp.com. 11. INTERNATIONAL DATA TRANSFERS -------------------------------------------------------------------------------- Information processed by our third-party infrastructure providers (such as Google Cloud, Firebase, and RevenueCat) may be transferred to and stored on servers located outside your home country, including in the United States. Where personal data is transferred internationally, standard contractual clauses (SCCs) and recognized adequacy mechanisms are utilized to ensure adequate data protection. 12. CHANGES TO THIS PRIVACY POLICY -------------------------------------------------------------------------------- We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or App updates. When changes are made, we will revise the "Last Updated" date at the top of this document. Continued use of the App following notice of any updates constitutes your acceptance of the revised Privacy Policy. 13. CONTACT US -------------------------------------------------------------------------------- If you have any questions, concerns, complaints, or inquiries regarding this Privacy Policy or our data handling practices, please contact us at: VeriCall Support Team ================================================================================