This privacy policy describes the processing of personal data when using the Clever Dialer iOS app. It also explains the choices you have regarding your personal data ("Your rights") and how you can contact us.

Note on the language version: This document is a translation of the German original. The German version is authoritative; in the event of any discrepancy or ambiguity in the translation, the German wording shall be used for interpretation. This does not affect your statutory rights. The German version is available at www.cleverdialer.app/datenschutzerklaerung-ios-app.

I. Controller and Data Protection Officer

1. The controller within the meaning of the GDPR is:

Sellwerk GmbH & Co. KG
Pretzfelder Straße 7–11
90425 Nuremberg
Email: support@cleverdialer.de
Commercial Register Nuremberg HRA 16002
Managing Directors: Dipl. Kff. Constanze Oschmann, Dipl. Kfm. Michael Oschmann

For questions regarding the processing of your personal data, please contact our Data Protection Officer, Dr Stefan Drewes, who can be reached at the address stated in the Legal Notice or at: privacy@cleverdialer.com

II. Your rights as a data subject

1. Every data subject has the following rights:

Right of access (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure, or a right to be "forgotten" (Art. 17 GDPR)
Right to restriction of the processing of personal data (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)

In addition, the data subject also has a general right to object (cf. Art. 21(1) GDPR). In that case, the objection must be lodged stating grounds arising from the particular situation of the data subject. Where the data processing is carried out on the basis of consent, your consent may be withdrawn at any time with effect for the future.

To exercise your data subject rights, the easiest way is to contact support@cleverdialer.de or the address stated in the Legal Notice. In addition, you have the right to lodge a complaint with the data protection supervisory authority responsible for you.

III. Processing of personal data by Sellwerk GmbH & Co. KG

1. Spam warning and spam blocking (on-device)

Clever Dialer warns of incoming spam phone calls and enables known spam numbers to be blocked. The spam number list required for this is downloaded by the app from the Clever Dialer web service at regular intervals and stored locally on your device. The detection and blocking of incoming calls takes place entirely on the device (on-device), using the Apple CallKit extension (Call Directory Extension). When a call comes in, the caller’s phone number is not transmitted to our servers. The check as to whether a number is known as spam takes place exclusively locally on your iPhone.

The identification and blocking of spam calls takes place exclusively locally on your device by means of the iOS CallKit function. Clever Dialer receives no information about incoming calls. Information on the data processing by Apple in the course of operating iOS can be found in Apple’s privacy policy.

When the spam number list is updated, the following data is transmitted to our web service:

IP address of the requesting device
Time of the request
Version of the list currently stored on the device (to determine whether an update is required)
Technical device information (operating system version, app version)

The transmitted IP address is processed exclusively for the purpose of delivering the data and within the scope of the server log files (cf. Section III.5). The update requests are not linked to the call checks taking place on the device.

Legal basis: Art. 6(1)(b) GDPR. The download and local provision of the spam number list are necessary to perform the usage contract — specifically, to provide the spam warning and blocking function. Access to the local storage of your device for the purpose of storing the spam number list is technically necessary in order to provide the service you have expressly requested (Section 25(2) no. 2 TDDDG).

2. Reverse lookup

Clever Dialer offers a reverse lookup with which you can retrieve information on a phone number. When you carry out a reverse lookup, the phone number you enter is transmitted to the Clever Dialer web service. There, the available directory databases (Das Örtliche, Das Telefonbuch, Gelbe Seiten) as well as the Clever Dialer spam database are searched for information on this number. Any information found — including any spam ratings — is returned to the app and displayed to you.

At various points in the app, the user can submit ratings on a phone number. These ratings are stored by Clever Dialer and made available to other users.

To identify phone numbers in the course of a reverse lookup, the phone number is transmitted via our web service to public telephone directories (Das Örtliche, Das Telefonbuch, Gelbe Seiten). These services receive only the queried phone number; they cannot assign it to the app user.

Legal basis: Art. 6(1)(b) GDPR. The transmission of the phone number and the comparison with directory databases are necessary to perform the usage contract — specifically, to provide the reverse lookup function.

3. Updating the spam list (silent push notifications)

In order to ensure that the app always has an up-to-date spam number list, we use Firebase Cloud Messaging (FCM), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to prompt the app in the background to update the list. So-called silent push notifications are used for this purpose; these are not visible to the user and do not carry any message content.

For this purpose, a device-bound token generated by Firebase (FCM registration token) is stored on our server. This token serves solely to deliver the update prompt to the correct device via FCM and the Apple Push Notification Service (APNs). It does not permit any conclusions to be drawn about your person.

The data processing by Google takes place on the basis of a data processing agreement (Firebase Data Processing and Security Terms). Information on data protection at Firebase can be found at https://firebase.google.com/support/privacy.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing up-to-date spam detection).

4. Information for number holders (rated phone numbers)

Clever Dialer helps users protect themselves against spam and fraud. In doing so, data of persons who are not themselves users of Clever Dialer is also processed — in particular holders of phone numbers that are stored in our database or queried in the course of a reverse lookup.

Which data do we process?

Phone number
Where applicable, name or company name, insofar as apparent from public sources
Number type (landline, mobile) and country or area code assignment
Spam rating
Category of the call (e.g. "advertising call", "suspected fraud"), which is derived automatically from the comments of our users
Where applicable, ratings and comments from our community on this number

Where does this data come from?

Publicly accessible telephone directories (Das Telefonbuch, Das Örtliche, Gelbe Seiten)
Ratings and spam reports from our user community

Why do we process this data?

We are aware that the processing affects the interests of the number holders concerned — in particular their right to informational self-determination and their protection against inaccurate negative ratings. We have weighed these interests against the protective interests of our users and have come to the conclusion that the processing is proportionate. The following considerations are decisive in this respect:

Only data from publicly accessible sources as well as aggregated ratings from our user community are used — private contact data and address books are not used.
Spam ratings are based on a large number of signals and not on individual opinions.
Only signals from the last six months are used for the current spam rating of a phone number. Older signals no longer feed into the displayed rating. This ensures that number holders are not permanently rated negatively on the basis of outdated information.
As soon as a number is no longer classified as spam, it is deleted automatically.
Number holders can assert their rights of access, rectification, erasure or objection at any time.
The processing serves to protect against fraud and unwanted calls — an interest that the European legislator also recognises as worthy of protection (cf. Recital 47 GDPR).

We do not upload our users’ address books and do not use private contact data as a data source.

Automated rating of phone numbers

The spam classification of a phone number is calculated automatically on the basis of various signals, including reports and ratings from the user community as well as blocks by users. The specific weighting and combination of these signals is protected as a trade secret (Recital 63 GDPR).

Automated decision-making within the meaning of Art. 22(1) GDPR producing legal effects concerning the number holder does not take place. The classification constitutes non-binding information for our users. Number holders can request a review of the classification at any time.

Who receives the data?

Users of the Clever Dialer app (display in the course of a reverse lookup)
Users of the Clever Dialer website (number search)
Technical service providers within the scope of processing on our behalf (hosting, infrastructure), exclusively in the EU:
Google Cloud EMEA Limited, data centre location Belgium (europe-west1-3). The Google Cloud data protection terms apply. Google LLC is certified under the EU-US Data Privacy Framework.

How long do we store the data?

Spam ratings and number entries are stored for as long as they are necessary in order to provide the service. They are deleted when the number concerned is no longer classified as spam or when a justified request for erasure has been made.

What happens if the app is uninstalled?

Upon uninstallation, all data stored locally on your device (e.g. settings, downloaded spam number list) is deleted automatically by iOS.

If you have submitted ratings on phone numbers via the reverse lookup, these remain stored server-side, as they contribute to protecting all users against spam calls. You can request their erasure at any time pursuant to Art. 17 GDPR.

Your rights as a number holder. You can at any time:

Request information on which data we have stored on your number
Request the rectification of incorrect entries
Request the erasure of your number from our database
Object to the processing

Contact: privacy@cleverdialer.com

As we process millions of phone numbers and, as a rule, have no means of contact other than the phone number itself, individually notifying each data subject would involve disproportionate effort (Art. 14(5)(b) GDPR). We therefore make this information publicly available via our privacy policy.

5. Automatically collected data when using the app (server log files)

When you use the Clever Dialer app, it communicates with our servers in order to provide you with the requested services (e.g. updating the spam number list, reverse lookup, spam ratings). In doing so, the following technical information is automatically collected and stored in server log files:

IP address of the requesting device
Date and time of the request
Type and version of the operating system (e.g. iOS version)
Device type and app version
Type and scope of the data retrieved (e.g. API endpoint)

This data is technically necessary in order to ensure the app’s functionality and to enable communication between the app and the server.

In accordance with our IT security concept, the resulting log file data is stored for a period of 90 days in order to detect and analyse any attacks on our systems. The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR. Our legitimate interest lies in ensuring system security and maintaining the service.

6. Processing of data – your enquiries

If you send us an enquiry by email or via the contact form, we collect the data you provide in order to process and respond to your request. We store this information for evidentiary purposes for a period of three years. The legal basis for the data processing is Art. 6(1) sentence 1(f) GDPR.

Our email communication is received and stored via the infrastructure of our processor Domain Factory GmbH. Incoming enquiries are then recorded and processed as support tickets in our ticketing system Liveagent, provided by Quality Unit, s.r.o. In this context, your email address, the content of your message including any attachments, and the entire communication history are stored in the ticketing system. Further information on these processors can be found in Section III.9.

7. Data processing in connection with Clever Dialer PRO

Clever Dialer offers the paid version Clever Dialer PRO, which is purchased and managed exclusively via the Apple App Store. With PRO, extended features are unlocked.

PRO is available as a subscription with recurring payment or as a one-time payment ("Longlife") with an unlimited entitlement.

Payment processing: All payment processing as well as the management of subscriptions and one-time purchases is carried out by Apple via the Apple App Store. We do not receive any payment data (e.g. credit card numbers, bank details) and do not store any contract or purchase data in our own systems. For the data processing by Apple, we refer to Apple’s privacy policy.

Verification of the entitlement: In order to be able to provide you with the PRO features, our app queries Apple via the StoreKit interface as to whether a valid entitlement exists. Only the entitlement status (entitled/not entitled) is retrieved in this process. This information is not stored permanently in our systems; the status is only held temporarily on the device until the next check takes place.

Legal basis: Art. 6(1)(b) GDPR (performance of the purchase contract for Clever Dialer PRO — provision of the purchased features).

8. Notes on ensuring data security

We protect your data in particular through the following measures:

Encrypted transmission of all data between the app and our servers as well as between our servers and third-party providers (TLS encryption)
Encrypted storage of data on the storage media of our data centre operator (Google Cloud Platform)
Automatic deletion of log data after 90 days

Security of data transmission

Communication between the Clever Dialer app and our servers takes place exclusively via a TLS-encrypted connection. In addition, we use certificate pinning to ensure that the app communicates exclusively with our verified servers. We furthermore employ technical and organisational measures pursuant to Art. 32 GDPR in order to protect your personal data against loss, destruction, manipulation and unauthorised access. Our security measures are reviewed regularly and adapted to the state of the art.

We point out that, despite these measures, a residual risk remains with any data transmission over the internet and that complete protection cannot be fully guaranteed.

We additionally recommend that you protect your device through regular software updates, an active screen lock and the use of trustworthy networks.

9. Use of processors

To provide our services, we use external service providers that process personal data on our behalf. These service providers are processors within the meaning of Art. 28 GDPR. We have concluded data processing agreements with all processors that meet the requirements of Art. 28 GDPR. The processors process personal data exclusively on our instructions and are contractually obliged to comply with appropriate technical and organisational measures to protect the data.

9.1 Web service — Google Cloud Services

For hosting the Clever Dialer web service, we use the Google Cloud Platform of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as a processor. The web service is the central technical infrastructure of the app: it makes the spam number list available for download, carries out the comparison with directory databases and the Clever Dialer spam database for reverse lookups, and returns the results to the app. Ratings and spam reports are also processed via the web service. In this context, in particular the data described in Sections III.1, III.2 and III.4 is processed, including phone numbers, IP addresses, ratings and technical device information. The data processing takes place exclusively in the Google Cloud region europe-west1 (Brussels, Belgium).

Customer data is thus stored and processed within the European Union. Google LLC has its headquarters in the USA; access to personal data from the USA cannot be ruled out in the course of support and maintenance activities. For this case, we base the transfer on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework pursuant to Art. 45(1) GDPR; Google LLC is certified under the Data Privacy Framework (cf. https://www.dataprivacyframework.gov/list).

In addition, the standard contractual clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR are part of the data processing agreement (Google Cloud Data Processing Addendum). Google uses sub-processors to provide the cloud services; their current list can be viewed at https://cloud.google.com/terms/subprocessors. Google implements extensive technical and organisational security measures, which are documented in Annex 2 of the data processing agreement and include, among other things, physical data centre security, network security, access control, data encryption in transit and at rest, intrusion detection, and regular security audits (ISO 27001, ISO 27017, ISO 27018, SOC 2/3). The Google Cloud Platform holds a PCI-DSS compliance certification. The substantive legal bases for the data processed via the web service arise from the sections in which the respective processing is described, in particular from Sections III.1–3 for spam detection and reverse lookup as well as from Section III.5 for the server log files.

9.2 Mail hosting — Domain Factory

For hosting our business email communication, we use Domain Factory GmbH, c/o WeWork, Neuturmstrasse 5, 80331 Munich, Germany, as a processor. Domain Factory provides the email infrastructure through which all incoming and outgoing email messages are received, stored and sent. This includes in particular the receipt of support enquiries to support@cleverdialer.de and privacy@cleverdialer.com as well as communication in connection with the exercise of data subject rights. In this context, the email addresses of senders and recipients, the contents and attachments of the email messages, as well as metadata of the communication such as timestamps, IP addresses and header information are processed.

The processing takes place in data centres in the European Union, specifically in Cologne (Germany) and Strasbourg (France). Domain Factory uses sub-processors to provide the service, some of which may be located in third countries outside the EEA, in particular in the USA. Insofar as personal data is transferred to third countries in this context, this is done on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR and/or on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework pursuant to Art. 45(1) GDPR, insofar as the respective sub-processor is certified thereunder. The substantive legal bases for the communication handled via Domain Factory arise from the sections in which the relevant processing is described, in particular from Section III.6 for support enquiries as well as from Section II for the exercise of data subject rights.

9.3 Ticketing system — Liveagent

For the management and processing of incoming enquiries, we use the ticketing system Liveagent, provided by Quality Unit, s.r.o., Vajnorská 100/A, 831 04 Bratislava, Slovakia, as a processor. Incoming email enquiries — in particular support enquiries and requests to exercise data subject rights — are recorded as tickets in the Liveagent system and managed, tracked and answered there in a structured manner. In this context, the name of the enquirer, insofar as it is provided, the email address, the content and any attachments of the enquiry, the entire communication history in the form of the ticket history, the IP address of the enquirer, as well as timestamps of the enquiry and of its processing are processed.

In addition, further personal data that the enquirer provides in the course of their communication may be processed. This concerns in particular users of the app who contact us by email, number holders who exercise their data subject rights, and other persons who get in touch with us. Quality Unit, s.r.o. has its registered office in the European Union. Insofar as sub-processors are used, these are listed at www.ladesk.com/gdpr. Insofar as a transfer of personal data to countries outside the EEA takes place in this context, this is done on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular standard contractual clauses, or on the basis of an adequacy decision pursuant to Art. 45 GDPR. Tickets and the personal data contained therein are stored for the duration of processing and subsequently for a period of three years for evidentiary purposes. After this retention period expires, the data is deleted.

The substantive legal bases for the data processed in the ticketing system arise from the sections in which the relevant communication is described, in particular from Section III.6 for enquiries as well as from Section II for the exercise of data subject rights.

Information on further processors used in connection with individual functions or services of the app can be found in the respective sections of this privacy policy. This concerns in particular Google LLC for Google Analytics for Firebase and Firebase Crashlytics (Sections IV.1 and IV.2).

IV. Tracking

1. Tracking through Google Analytics for Firebase

1.1 This app uses Google Analytics for Firebase, a web analytics service of Google LLC ("Google"). Google Analytics for Firebase is able, via a so-called Software Development Kit (SDK), to enable an analysis of the use of the app. The information generated about your use of this app is generally transmitted to a Google server in the USA and stored there. On our behalf, Google will use this information to evaluate your use of the app, to compile reports on app activities, and to provide us with further services associated with app usage. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

1.2 The legal basis for the use of Google Analytics for Firebase and the associated access to information on your device (in particular the app instance ID, device identifiers) is your consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with Section 25(1) TDDDG. Consent is obtained via our consent dialog before data is first collected. You can withdraw your consent at any time with effect for the future by making the corresponding change in the app settings under "Privacy Settings". The data collected by Google Analytics for Firebase is automatically deleted after 26 months.

1.3 We use Google Analytics for Firebase in order to be able to analyse and regularly improve the use of our app. Through the statistics obtained, we can improve our offering and make it more interesting for you as a user.

1.4 Transfer of data to third countries: Insofar as personal data is transferred to the USA, this is done on the basis of the European Commission’s adequacy decision of 10 July 2023 pursuant to Art. 45(1) GDPR (EU-U.S. Data Privacy Framework). Google LLC is certified under the EU-U.S. Data Privacy Framework (cf. https://www.dataprivacyframework.gov/list). In addition, we base the transfer on the standard contractual clauses issued by the European Commission pursuant to Art. 46(2)(c) GDPR, which Google offers as part of the Data Processing Addendum. Further information can be found at https://policies.google.com/privacy and https://business.safety.google/adprocessorterms/.

2. Transfer of data for error analysis (Firebase Crashlytics)

This app uses Firebase Crashlytics, an error analysis tool of Google LLC ("Google"). Via an SDK, Crashlytics is able to transmit data on errors occurring in the app (e.g. crashes) to Crashlytics. The information generated about the error behaviour of this app is generally transmitted to a Google server in the USA and stored there. Transmitted in this context are state information of the app and the device, operating system information, hardware information, and a rough localisation based on the IP address. In addition, an ID is transmitted that identifies the device and is regenerated with each installation. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

The legal basis for the use of Firebase Crashlytics and the associated access to information on your device is your consent pursuant to Art. 6(1) sentence 1(a) GDPR in conjunction with Section 25(1) TDDDG. Consent is obtained via our consent dialog before data is first collected. You can withdraw your consent at any time with effect for the future by making the corresponding change in the app settings under "Privacy Settings". The data collected by Firebase Crashlytics is automatically deleted after 90 days.

We use Crashlytics in order to be able to analyse the error behaviour of our app and to fix occurring errors more quickly. Through the insights gained, we can improve our app and achieve a more pleasant user experience for you as a user.

Transfer of data to third countries: Insofar as personal data is transferred to the USA, this is done on the basis of the European Commission’s adequacy decision of 10 July 2023 pursuant to Art. 45(1) GDPR (EU-U.S. Data Privacy Framework). Google LLC is certified under the EU-U.S. Data Privacy Framework (cf. https://www.dataprivacyframework.gov/list). In addition, we base the transfer on the standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Further information can be found at https://policies.google.com/privacy, https://business.safety.google/adprocessorterms/ and https://firebase.google.com/terms/crashlytics-app-distribution-data-processing-terms.

3. Use by minors

Clever Dialer is aimed at adults and young people aged 16 and over. The app is not intended for children under 16. We do not knowingly collect personal data from children under 16. Should we become aware that a child under 16 has transmitted personal data to us, we will delete it without undue delay. Parents or legal guardians who suspect that their child has transmitted personal data to us can contact us at privacy@cleverdialer.com.

V. Consent management

1. Consent management platform

To manage your data protection consents, we use the consent management platform (CMP) of the following provider:

OneTrust Technology Limited
82 St John Street, London, EC1M 4JN, United Kingdom
Privacy policy: https://www.onetrust.com/privacy-notice/

When using OneTrust, the following data is processed:

Your consent decisions (consent preferences)
Device/app identifier for assigning the consent
Time at which consent was given or changed
Language setting and app version

The legal basis for the use of OneTrust is Art. 6(1)(c) GDPR (fulfilment of our legal obligations to demonstrate consent pursuant to Art. 7(1) GDPR) as well as Section 25(2) no. 2 TDDDG (technically necessary access). The consent data stored server-side at OneTrust is stored for the duration of our contractual relationship with OneTrust and deleted upon its termination. If the app is uninstalled, the consent preferences stored locally are deleted automatically by the operating system.

OneTrust processes data as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR (OneTrust Data Processing Addendum). Insofar as a transfer to the United Kingdom takes place in this context, this is done on the basis of the European Commission’s adequacy decision (Art. 45 GDPR).

OneTrust LLC has certified its participation in the EU-US Data Privacy Framework (DPF). The transfer of personal data to the USA is therefore based primarily on the European Commission’s adequacy decision pursuant to Art. 45 GDPR in conjunction with Implementing Decision (EU) 2023/1795.

In addition, the standard contractual clauses (SCCs) approved by the European Commission pursuant to Art. 46(2)(c) GDPR are part of the data processing agreement. These serve as an additional safeguard and fallback in the event that the DPF should cease to apply. OneTrust has also implemented supplementary technical and organisational measures within the meaning of the EDPB Recommendations 01/2020.

Further information on OneTrust’s security measures as well as the current list of sub-processors used by OneTrust can be found at: https://my.onetrust.com/s/list-of-subprocessors

2. Consent dialog

When the app is first started, you are shown a consent dialog in which you are informed about the intended data processing operations (Firebase Analytics, Firebase Crashlytics). You can accept or reject all processing.

You can change or withdraw your consents at any time thereafter under:

Open the app → Settings → Privacy Settings

The withdrawal of consent does not affect the lawfulness of the processing carried out up to the point of withdrawal (Art. 7(3) GDPR).

As of: August 2026

Privacy Statement iOS App