Privacy policy

Data controller

The data controller is SuperHelo SAS, a French simplified joint-stock company with a share capital of 1 000 euros, registered with the Paris trade register under number 938 743 473, headquartered at 14 rue des Moines, 75017 Paris, France. For any question about your data: dpo@ylumo.com.

Data about app users

When you use Ylumo, we process:

• your phone number, verified with a code when you sign up;
• a technical identifier of your device, its system (iOS or Android), the app version and your language;
• a proof that your device is genuine, provided by Apple or Google when you sign up;
• the numbers you look up or that call you without being in your contacts, to identify them;
• your reports (spam or not) and the names you suggest for a number;
• if you turn it on, the names and numbers in your address book;
• your settings, such as automatic spam blocking.

Your address book

On your phone, Ylumo reads your address book so that it never analyses calls from your contacts. This stays on the device.

If you turn on address book sharing, your contacts' names and numbers are sent to our servers. They are only used to identify those numbers when they call other users, and only when several users give the same name. Your contact list is never shown to anyone. You can turn sharing off in the settings: the contacts you sent are then deleted.

Data about people whose number is shown

To show who is calling, Ylumo may link a number to its owner's name, company, job title and profile picture. This information comes from:

• directories and professional sources that are public or licensed;
• the public name and picture the owner chose on a messaging service linked to the number;
• the names Ylumo users give the number in their address book or in the app;
• users' spam reports.

Why we process this data

We process this data to provide the service, that is identifying calls and fighting abusive telemarketing and scams, to prevent fraudulent accounts, and to secure and improve the app.

Legal bases

• Performance of the contract between us when you use the app.
• Your consent for address book sharing, which you can withdraw at any time.
• Our legitimate interest, and our users', in knowing who is calling and protecting themselves from telemarketing and fraud, for people whose number is shown. This interest is balanced against your rights: we only show a name when sources agree, and you can object at any time.
• Our legitimate interest in preventing abuse of the app.

How long we keep data

• Account and settings: as long as the account exists. You can delete it in the app; your reports, suggested names and shared contacts are then deleted.
• Verification code log: 3 days.
• Lookup history used for spam statistics: 30 days after the number was last looked up.
• Data linked to a shown number: as long as it stays accurate, and until the owner objects.

Recipients and processors

Identification details of a number are shown to Ylumo users who receive a call from it or look it up. Our technical providers only act on our instructions:

• Amazon Web Services: hosting of the app and the website;
• MongoDB Atlas: database;
• Hetzner (Germany): search engine;
• Telegram and Vonage: sending verification codes;
• Apple and Google: checking that devices are genuine;
• Cloudflare: bot protection on the website;
• Sentry: technical error monitoring.

Transfers outside the European Union

Some providers may process data outside the European Union, including in the United States. These transfers rely on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework when the provider is certified.

Your rights

You have the right to access, correct, erase, restrict and port your data, and the right to object. To object to your name being shown for your number, use the "Remove my number" page. For any other request, write to dpo@ylumo.com.

You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Cookies

ylumo.com sets no analytics or advertising cookies. The number removal form uses Cloudflare Turnstile, which may store technical data needed to detect bots.

Security

Traffic between the app and our servers is encrypted. Your session tokens are kept in your phone's secure keychain, and access to data is limited to the people who need it.