1. Who we are
OG VoIP is the controller of personal data collected through our website and for managing customer accounts. When we process communications data (such as call recordings) on behalf of a business customer, that customer is the controller and we act as its processor.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Contact & account data | Name, company, email, phone number, billing address, account username | You, when you contact us or sign up |
| Verification data | Identity or company registration documents, proof of address, required by carriers and regulators for certain numbers | You |
| Billing data | Invoices, payment history, tax information. Card details are handled by our payment processor; we do not store full card numbers | You and our payment processor |
| Call detail records (CDRs) | Calling and called numbers, date, time, duration, route, cost, call quality metrics | Generated by our network when you use the Services |
| Communications content | Call recordings, voicemails, faxes and messages, only where you enable these features | Your use of the Services |
| Technical data | IP addresses, SIP user agent, device and registration information, portal and API logs | Your devices and our systems |
| Support data | Content of your emails, chats and tickets | You |
3. How we use your data
- To provide the Services: routing and connecting calls, provisioning numbers, operating your PBX, storing recordings you enable.
- To bill you: calculating usage from CDRs, invoicing and collecting payments.
- To protect you and our network: detecting and preventing fraud, IRSF, abuse, spam calls and security incidents.
- To support you: answering requests and troubleshooting call quality.
- To comply with the law: tax and accounting obligations, number verification, lawful requests from authorities, caller ID authentication (e.g. STIR/SHAKEN).
- To communicate with you: service notices and, where permitted, information about our offers. You can opt out of marketing at any time.
4. Legal bases (EEA / UK visitors)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Services); legal obligation (billing records, regulatory requirements); legitimate interests (fraud prevention, network security, service improvement, B2B communications); and consent (where required, for example for certain marketing).
5. How we share data
We do not sell your personal data. We share it only with:
- Telecommunications carriers and interconnect partners, to the extent necessary to route and terminate calls and to provision numbers.
- Service providers acting on our behalf (hosting, payment processing, email, accounting), under contractual confidentiality and security obligations.
- Authorities, when required by law, court order or valid legal process, or to protect the rights, safety and property of our customers, the public or OG VoIP.
- A successor, in the event of a merger, acquisition or sale of assets, subject to this Policy.
6. International transfers
Voice calls are by nature international, and our infrastructure and partners may be located in different countries. When we transfer personal data outside your country, we use appropriate safeguards such as standard contractual clauses where required by law.
7. Data retention
| Data | Typical retention |
|---|---|
| Account and contract data | For the life of the account, then up to 6 years for legal claims |
| Invoices and billing records | As required by tax and accounting law (generally 7 years) |
| Call detail records (CDRs) | Up to 24 months, or longer where required by law or an ongoing dispute or fraud investigation |
| Call recordings and voicemails | According to the retention setting of your plan (e.g. 90 days on Business), or until you delete them |
| Technical and security logs | Up to 12 months |
| Website contact requests | Up to 24 months after the last contact |
8. Security
We apply technical and organizational measures appropriate to the risk, including encrypted signalling and media (TLS/SRTP) where supported, encrypted web access (HTTPS), access controls and least-privilege administration, firewalls and intrusion prevention, continuous fraud and traffic monitoring, and backups. No system is completely secure; you are responsible for protecting your own credentials and devices.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or port your personal data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with a data protection authority.
California residents have the right to know, delete and correct personal information and to opt out of its "sale" or "sharing". We do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.
To exercise a right, email contact@ogvoip.com. We may need to verify your identity. Requests concerning data we process on behalf of a business customer will be forwarded to that customer.
10. Call recording
Call recording is a feature controlled by our customers. Customers who enable it are responsible for informing participants and obtaining any consent required by applicable one-party or all-party consent laws.
11. Cookies
Our website does not use advertising or tracking cookies. We use only the technical data strictly necessary to deliver the site securely (such as server logs). If we introduce analytics or other non-essential cookies, we will update this Policy and request consent where required.
12. Children
Our Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children.
13. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date shows when it was last revised, and we will notify customers of material changes by email or through their account.
14. Contact
For any privacy question or request, contact us at contact@ogvoip.com.