Legal
Privacy policy
BadCall is built to know as little about you as possible. There are no accounts, and your IP address is never stored.
This policy explains how XTO Pty Ltd (ACN 702 801 410) ("BadCall", "we") handles information on badcall.com.au. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
- Reports you post: the phone number, your verdict and category, whether it was a call or text, who the caller claimed to be, your message, and optionally your state and a display name. These are published on the site.
- Lookups: that a number was looked up, counted per day. We don't record who looked it up.
- A one-way visitor code: a keyed hash (HMAC) of your IP address, cut short, stored with reports and votes so we can stop floods, duplicates and double votes. It can't be turned back into your IP address. The IP address itself is never stored.
- Contact messages: what you send through the contact form, including your email address if you give it.
- Server logs kept by our hosting provider for security, for a limited time.
What we never collect
No accounts, passwords, phone contacts or call logs. The scam text checker runs entirely in your browser - the text you paste into it is never sent to us.
Personal information inside reports
Reports are about phone numbers, not people. Please don't include anyone's full name, address or other personal details. Our software masks e-mail addresses and card or account numbers automatically. If a report contains personal information about you, ask us to remove it.
Phone numbers of businesses
Some pages show the name, category, town and website of a business that publicly lists the number. This comes from the business's own public listing. A business can ask us to update or remove it.
Cookies, analytics and advertising
BadCall itself sets no tracking cookies (it remembers your light/dark choice in your browser's local storage). If analytics or advertising are switched on, Google Analytics and Google AdSense may set cookies to measure visits and show ads; see how Google uses information from sites that use its services. You can control ad personalisation at adssettings.google.com.
How long we keep things
- Published reports: until they are removed, or the number's page is.
- Reports held back by the spam filter: deleted after 30 days.
- Daily lookup counts: about 13 months.
- Contact messages: as long as needed to deal with them.
Disclosure
We don't sell personal information. Published reports are public by design and are available through our API and feed. We may disclose information if the law requires it.
Overseas
Service providers we use (for example hosting, analytics or advertising) may process information outside Australia.
Access, correction and complaints
Contact us through the contact form. Because we hold so little, we usually can't link a report to you - so tell us which report you mean. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
XTO Pty Ltd (ACN 702 801 410), L1 457 Elizabeth Street, Surry Hills, NSW 2010, Australia.