Privacy policy

1. Who is responsible for your data

The controller of your personal data is the operator of HeyNum, the company identified in our legal notice. For any question about your data or this policy, write to privacy@heynum.com, or use our contact form.

2. The data we process

• Account data: your email address, a hash of your password (never the password itself), your two-factor authentication settings and your preferences (such as currency and notification settings).
• Billing data: the details of your subscriptions and payments, the country of your payment method (to apply the right taxes), and — if you add them — your company name, address and VAT number. Card details are handled by our payment processor; we never receive your full card number.
• Service records: your HeyNum numbers and, for each call and text, the numbers involved, the date, time and duration. These are needed to route communications, bill them and answer your questions.
• Your content: the text messages, voicemails, voicemail transcripts, greetings and call notes stored in your account.
• Support data: the messages you send us and our replies.
• Technical data: the IP address of your connection (used for security and abuse prevention), your browser type and device type. Our web servers don't record IP addresses in their access logs.

3. What we never collect

We don't ask for and don't process identity documents, selfies or biometric data, your home address, your existing phone number, your contacts, or your location. We don't use advertising trackers.

4. Why we use it, and on what legal basis

5. Who receives your data

We never sell personal data. We share it only with:

• Telecom carriers and interconnection partners, which route your calls and texts to and from the phone network;
• our payment processor, which handles payments and fraud checks;
• our infrastructure providers — hosting, content delivery and security (including Cloudflare), and email delivery;
• our transcription provider, for voicemail-to-text, and our eSIM partner if you buy a travel eSIM;
• competent authorities, when we receive a valid legal request — we check each request and disclose only what the law requires.

Our providers act on our instructions, under contracts that require them to protect your data.

6. International transfers

Some of our providers, and the carriers that connect calls to numbers abroad, may process data outside the European Economic Area or the United Kingdom. When that happens, we rely on an adequacy decision or on the European Commission's standard contractual clauses, with additional safeguards where needed.

7. How long we keep it

8. Your rights

Depending on where you live, you have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time.

Most of this you can do yourself from your account: delete conversations and voicemails, export your data, or close your account. For anything else, write to privacy@heynum.com. We answer within one month. We may ask you to confirm the request from the email address of your account, to protect your data.

You can also complain to your data protection authority — for example the CNIL in France or the ICO in the United Kingdom.

9. Security

We protect your data with encrypted connections (HTTPS, and DTLS-SRTP for call audio), encryption at rest for stored content, hashed passwords, optional two-factor authentication and strictly limited internal access. If a data breach is likely to put you at risk, we'll tell you and the relevant authority as the law requires. More on our privacy & security page.

10. Children

HeyNum is for adults: you must be at least 18 to use it. We don't knowingly process data about children. If you think a child has created an account, tell us and we'll delete it.

11. Cookies

We only use cookies that are needed for the website and the service to work, such as remembering your currency. No advertising or analytics cookies. Details in our cookie policy.

12. Changes to this policy

We'll update this policy if our practices change. If the changes are significant, we'll tell you by email before they apply. The date at the top of the page shows the latest version.