Privacy Policy
Last updated: 6 July 2026
This Privacy Policy explains how ExpatTel ("we", "us", "our") collects, uses, stores and discloses your personal information when you use our website (expat.tel), our customer portal (portal.expat.tel) and our mobile applications (together, the "Service").
1. Who we are
ExpatTel is operated by [Legal Entity Name] ("ExpatTel"), a company registered at [Registered Address]. If you have any questions about this policy or how we handle your data, email us at privacy@expat.tel.
2. What data we collect
We collect the following categories of personal information:
- Account details — your full name, email address, password (hashed), display name, mobile number and country of residence.
- Identity verification — where required by carriers for number porting: date of birth, address, and ID document numbers.
- Number portability data — the mobile number you are moving to us, your existing carrier's account details, and any porting authorisation forms.
- Communications — voicemails, SMS messages, and voicemail transcriptions received on your ExpatTel number.
- Billing data — subscription plan, billing history, and a Stripe customer ID. We do not store your full card number or CVC.
- Usage data — pages visited, actions taken in the portal, timestamps, IP address, browser type, device type.
- Support conversations — the content of messages you send us via our contact form, help centre, or email.
3. Why we collect it, and the legal basis under GDPR
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service (delivering voicemails, SMS, porting numbers) | Contract |
| Verifying your identity for legal / carrier compliance | Legal obligation; contract |
| Taking payment via Stripe | Contract |
| Sending you service updates and porting notifications | Contract; legitimate interests |
| Fraud prevention, security, abuse detection | Legitimate interests |
| Marketing emails (only after opt-in) | Consent |
| Website analytics | Consent (via cookie banner) |
4. Sub-processors we share data with
We rely on the following third-party service providers, each under a data processing agreement:
| Provider | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Application hosting, database, backups, transactional email (SES) | AWS ap-southeast-2 (Sydney) |
| Stripe | Payment processing | United States / global |
| Twilio (or equivalent telco partner) | Number porting, voicemail and SMS delivery | Country of your number |
| Google Firebase | Mobile push notifications | United States / global |
| Slack | Internal alerting of support tickets and port events | United States |
5. International data transfers
Because we operate globally, your data may be transferred outside your country of residence. Where data is transferred out of the UK or EEA, we rely on adequacy decisions, Standard Contractual Clauses, or your explicit consent — whichever is appropriate.
6. How long we keep your data
- Account and billing records — for the life of your subscription, plus 7 years afterwards (financial record-keeping obligations).
- Voicemails and SMS — until you delete them, or 24 months after account closure, whichever is sooner.
- ID verification documents — for 12 months after the port completes, then deleted.
- Support conversations — 3 years from last contact.
- Marketing consent records — until you unsubscribe, then 12 months for audit purposes.
7. Your rights
Under the UK GDPR, EU GDPR, Australian Privacy Act, and California Consumer Privacy Act, you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Ask us to delete your data (subject to legal record-keeping obligations).
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent at any time (where consent is the legal basis).
- Lodge a complaint with your data protection authority — for example the UK ICO (ico.org.uk) or the Australian OAIC (oaic.gov.au).
To exercise any of these rights, email privacy@expat.tel. We will respond within 30 days.
8. Cookies and tracking
ExpatTel uses cookies for essential functionality (keeping you signed in, remembering your preferences) and — with your consent — for anonymous website analytics. We do not use advertising cookies or third-party tracking pixels.
You can control cookie consent through our cookie banner and change your choice at any time.
9. Security
We protect your data with TLS in transit, encryption at rest, hashed passwords, two-factor authentication, and strict access controls limited to trained staff. No system is 100% secure but we take reasonable steps to keep your data safe.
10. Children
ExpatTel is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. Material changes will be notified via email or a prominent notice in the portal. Continued use of the Service after the effective date constitutes acceptance.
12. Contact
Questions about your data, this policy, or to exercise any of your rights: privacy@expat.tel.