Privacy Policy

QuikRing is operated by Syntropy Solutions, LLC (State of Delaware, United States). This policy explains what information QuikRing collects when you use our browser-based calling service, why we collect it, and the choices you have. By using QuikRing, you agree to the practices described here.

Account information. Email address, a hashed (never plaintext) password only if you choose to set one in account settings, and optionally a name if you add one there. If you sign in with Google, we receive your name and email from that provider.

Calling and messaging data. The numbers you dial or rent, call duration, call cost, country, and timestamps. If you rent a virtual number, inbound calls and SMS messages sent to that number are logged the same way.

Call recordings. If you turn on call recording in Settings, we record the audio of your calls and store it so you can play it back. Everyone on the call hears a spoken notice that the call may be recorded before it connects. Recordings are stored by our call carrier (Telnyx or Twilio) on our behalf and are only accessible to you and to QuikRing staff for support or legal purposes. For a call billed to a Team Calling team, the team's owner and admins can also play the recording, and a team can turn recording on for its members' calls. Turning the setting off stops new calls from being recorded; it does not delete recordings already made. A recording is deleted automatically, at the carrier too, 30 days after the call. A recording of a call billed to a Team Calling team follows the retention period that team sets instead (12 months unless the team changes it).

Voicemail. If you rent a number and a call to it isn't answered, the caller can leave a voicemail. We keep the recording, the caller's number and an automatic transcript made by our call carrier, so you can read and play it in your dashboard. If the caller hangs up without leaving a message, we email you that you missed a call from their number (you can turn this off in Settings). You can delete any voicemail at any time; deleting it also deletes the recording from the carrier.

Text messages. If you rent a number, text messages sent to it (text only, no pictures) reach us through our carrier (Telnyx or Twilio). We store the text and the sender's number so you can read it in your dashboard, and we email it to you (you can turn this off in Settings). You can delete a text at any time; deleting it erases its text and the sender's number right away. A record that a message arrived (the time, which of your numbers received it, its size and the carrier's reference for it) stays for up to 90 days, so we can apply limits against abuse and account for what the carrier charges us. A copy stays in the database backups made before you deleted it (see "Data retention"). A text sent to a number you share with your team is visible to the members of that team, and your team's owner and admins can delete it. We do not send text messages from your number.

Contacts. Any contact you save (name, phone, company, email, notes) is stored so you can reuse it. A contact saved to your team's shared contact list is visible to the members of that team; any other contact is visible only to you.

Payment data. We use Stripe as our payment processor. We never see or store your payment card numbers — Stripe handles checkout securely and provides tokenized confirmations and transaction references according to strict PCI-DSS compliance.

Device and usage data. Browser type, IP address, and basic usage logs, used for security and abuse prevention. At signup and login we also compute a device identifier from your browser's characteristics, in your browser, and send it in a short-lived first-party cookie. We use it to spot the same device opening many accounts, and to check a payment for card testing: when you buy credit, we send Stripe, our payment processor, this identifier (if the cookie is still set) and your IP address with the payment. We share it with no one else.

Push notifications. If you allow notifications in your browser, we keep the subscription your browser gives us and send alerts (an incoming call, text or voicemail on a number you rent, a reply from support, a service notice from us such as an outage, and, if you agreed to marketing emails, an occasional announcement) through your browser vendor's push service. You can turn them off in your browser at any time.

Affiliate program. If you apply to our affiliate program, we keep your name, email address, country, your confirmation that you are not a US person (or a Form W-9 if you are one and your payouts approach the US reporting threshold), the clicks and sign-ups your link brought, the commission you earned and the payouts we sent. Your bank details are entered on Stripe's page and never reach us. If you signed up through a partner's link, we record which partner referred you.

Bringing your number. When you move a US or Canadian number to QuikRing, we ask for the account holder name and service address on your current carrier account, the account number and your carrier PIN, a recent bill, and your typed signature on the letter of authorization. We keep the account number and the PIN encrypted, and delete both as soon as the request ends, whether the move completes, is rejected or is cancelled; the last four digits of the account number stay, so you can recognize the request. We pass your bill to our carrier to move the number and do not keep a copy. The signed letter (its text, the time you signed it and a shortened form of your IP address) stays with the request as a record of what you authorized. One year after the request ends we delete the name, address, contact details, last four digits and IP address from the request. The copy of your name, address and IP address inside the letter is removed at the same time, or two years after you signed it if that is later; the rest of the letter (the number, the carrier, its text and when you signed it) stays with the request. After the move you can set a port-out PIN for the number. We give it to our carrier so that it can check requests to move the number away, and keep only a one-way hash of it ourselves, which can be reset but never shown.

Gifts. If you buy a gift of credit for someone, you give us the recipient's email address and, if you choose, a message and your own display name to show on the gift. We use them only to deliver and administer the gift, and we keep them with the gift record for as long as we keep payment records. If you receive a gift, we record against your account when you redeemed it and how much it was.

Sales enquiries. When you send our Team Calling or sales contact form, we store it with your message and how you reached our site (campaign tags, the landing page, the site that referred you, your approximate country from your network, and the page language), to answer you and to measure which channels bring business enquiries; enquiries that do not become customers are deleted 12 months after they are closed.

Reports and do-not-call requests. You do not need an account to report a number or to ask that no QuikRing user can call yours. When you use those forms we keep the number you report or give us, the reason, your description and the email address if you add one, with the time you sent them. We use them only to review the report, to answer you if you left an address and, for a do-not-call request, to block the number from being called through QuikRing. Twelve months after we close a case we erase from it the email address, your description, a copy of any email you sent us about it, our notes and, on a do-not-call request, your number. The number you reported, the dates and how we resolved the case stay for three years after we close it and are then deleted; a case that is still open is kept. A number on the do-not-call list stays on it while the entry is in force, so that no one can call it through QuikRing; if the entry is removed we delete it three years later.

• To operate the calling, messaging, and virtual number service you signed up for
• To calculate and deduct per-minute call costs from your credit balance
• To detect fraud, spam, and abuse of the network. Some of these checks are automated: for example, an account that calls many new numbers in a short time, or places many very short calls, can have calling to new numbers paused or be held for review without a person deciding first. If this affects you, email support and a person will review it; you can also contest the decision
• To provide customer support and respond to account issues
• To operate the referral and promo code programs
• To deliver and administer a gift of credit: the recipient's email address, and the message and display name the buyer chooses to add, are used only to send the gift, let the recipient redeem it and handle any refund or dispute
• To improve reliability and add features
• To send you occasional emails about calling abroad and your account, each one prompted by something that happened in your account: for example, help placing your first call after you sign up, what the next call costs after your free one, a top-up you started but didn't finish, credit still unused on your balance, or features worth knowing once you've made a few calls. If you sign up from the EU or EEA, the UK, Switzerland, Canada or Australia, or from a country we can't identify, you receive them only if you tick the box at signup; elsewhere the box is ticked by default. An account created by signing in with Google has no box and gets the same default for its country. Either way you can opt out at any time: use the unsubscribe link in every such email, or switch it off in Dashboard > Settings. We never sell or share your address.

Where the GDPR or the UK GDPR applies, we rely on these legal bases:

• Contract: to open and run your account, connect your calls, rent you numbers, take your payments and answer your support requests.
• Legitimate interests: to prevent fraud and abuse, to keep the service and your account secure, and to understand how the service is used so we can improve it. You can object to this; see "Your rights".
• Consent: for marketing emails and for non-essential cookies where the law asks for consent first. You can withdraw it at any time; that does not affect what we did before.
• Legal obligation: to keep tax and accounting records and to answer lawful requests from authorities.

We share the minimum data necessary with the vendors that power QuikRing:

• Telnyx and Twilio — our call carriers. They connect and route your calls, provide rented numbers, and record and transcribe voicemail. They process call content only as needed to provide those services.
• Contabo — hosts our servers, database and support mailbox in the European Union.
• Stripe — processes payment transactions securely, supports card verification, and handles related fraud prevention. For those fraud checks it receives with each payment your email address and name, your IP address, the device identifier described above, the IP address you signed up from (while we still keep it) and how old your account is.
• Cloudflare — delivers our website, verifies you're human when you sign up, sign in or use our contact, chat and report forms (Turnstile) without tracking you for advertising, counts page visits and page load times (Web Analytics) without cookies or anything stored on your device, and stores our backups (see "Data retention").
• YouTube (Google) — some of our how-to guides show a video from our YouTube channel. Nothing is requested from YouTube until you press play. Then, if the optional cookies are on, the video plays on our page in YouTube's privacy-enhanced player, which receives your IP address and may store data on your device; otherwise the video opens on YouTube itself. Either way YouTube handles that data under Google's own privacy policy.
• Slack — our team's internal notifications. When someone signs up, pays, gets a refund, opens a dispute, opens a support ticket or starts a website chat, our team is notified in Slack with the account's email address, the amount where there is one, and for a ticket or chat its first lines.
• Trustpilot — may receive your name and email address so it can send you one invitation to review QuikRing about an hour after your first purchase.
• PostHog and Google Analytics — tell us which pages get read, where people click, which features get used and how visitors find the site. PostHog may also record how a page is used (clicks, scrolling, layout) so we can fix confusing pages; what you type into form fields and chat messages are hidden from those recordings, and pages inside your account are never recorded. Where the law requires consent first (the EU and EEA, the UK, Switzerland and the other countries listed in our Cookie Policy), both only use cookies after you accept non-essential cookies; if you decline or haven't chosen yet, PostHog still counts your visit anonymously, with no cookies or anything stored on your device, so we can see how the site is used overall. Everywhere else they are on by default and you can turn them off from the Cookie Policy page. Neither tool receives your email address, and the number you are calling is stripped from the page address before it is counted, so it is not sent to either of them. PostHog also receives reports of errors that happen in your browser on our site (the error message and the part of our code where it happened), with phone numbers and email addresses removed first, so we can find and fix them. For a signed-in account, we also record account actions -- calls placed, payments made, and pages viewed inside your account -- to operate and improve the service; these are tied only to an anonymous account identifier in our analytics tool, never your name or email, and are never sold.

We do not sell your personal information, and we do not share it with advertisers. We may disclose information if required by law or a valid legal process.

For the full, always up-to-date list of sub-processors and what each one does, see our Sub-processors page.

We keep call history, contacts, and account data for as long as your account is active. Some records have a shorter life of their own:

Call recordings are deleted 30 days after the call, or, for a call billed to a Team Calling team, after the retention period that team sets (12 months unless it changes it). Text messages received on a rented number are deleted 90 days after they arrive, or right away if you delete them (only the record that one arrived stays for the 90 days). Images you attach to a support ticket or chat are stored with their location and camera details removed, are visible only to you and our support staff, and are deleted 90 days after the ticket is resolved, or right away if your account is deleted. Sign-in records (the email address used, the IP address, and whether the attempt succeeded) are kept for 180 days. Web server logs (IP address, browser type, the page requested) are kept for 30 days, and the application's own logs, which refer to accounts by an internal ID and contain no phone numbers or email addresses, for 90 days. Error reports sent by your browser are kept for up to 12 months. The IP address and device identifier recorded at signup are cleared after 90 days, unless the account was suspended for abuse; a copy sent to Stripe with a payment stays with Stripe under its own terms. A block placed automatically on an IP address or a device for abuse is kept while it is in force and for 90 days after it is lifted. An entry we add to our block list (an IP address or range, a device identifier or an email domain) is never deleted automatically: once it is lifted or expires it stays as a record of the block. A record of each request a block refused (when it happened, the IP address, device identifier or number range it matched, and the account if there was one) is kept for 400 days. Records of how you used the product (which screens and actions, by internal account ID) and of which emails we sent you (never their content) are kept for about 13 months. Analytics data is kept by PostHog for up to 1 year (recordings of how a page is used for up to 30 days) and by Google Analytics for 14 months.

The account number and carrier PIN you give us to move a number are deleted when the request ends, and the other personal details of the request a year later (see "Bringing your number").

Reports and do-not-call requests are erased in part after 12 months and deleted after three years (see "Reports and do-not-call requests" under "Information we collect").

Affiliate applications that we turn down are deleted 12 months after the decision. An affiliate partner can ask us to delete their partner record once nothing is owed to them; records of payouts we made are kept as long as tax and accounting rules require.

If you delete your account, we erase right away your name, email address, password and two-factor settings, contacts, blocked numbers, verified caller IDs, sign-in records and your conversations with our support. On your calls we erase the numbers dialled, notes, tags, ratings and recordings; on text messages the text and both numbers. Voicemail recordings and transcripts are deleted, at the carrier too, when you delete them or your account.

What stays after deletion is no longer linked to your name or email: call and payment records (when, how long, to which country, what was charged), as required for accounting and legal purposes (e.g., tax records, payment disputes); the record that you accepted our Terms and any record of a fraud or abuse review of the account; and the shorter-lived records above, until their own period ends. Backups of our database made before the deletion still contain your data. On our own server we keep the 20 most recent backups; an encrypted copy of each one is also stored with Cloudflare, and those copies are deleted after 35 days. Our support mailbox, which holds the emails you send us, is copied each day to the same Cloudflare storage, which encrypts what it stores; those copies replace one another and are kept for up to about 12 months. Backups are used only to restore the service after a failure.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. If you're in the European Economic Area or UK, these are the rights granted to you under the General Data Protection Regulation (GDPR). Contact us to exercise any of these rights. You also have the right to complain to the data protection authority where you live or work.

If your team uses our Team Calling product, QuikRing processes your team's call data (numbers called, call length, cost and, if you turn on recording, the recordings) as a processor acting on your team's instructions — your team is the controller for that data, and remains responsible for telling its members and for any internal approval needed before forcing call recording. Our Data Processing Agreement sets out these terms in full, including sub-processors, security measures and data retention — no request needed, it's published and applies automatically; email legal@quikring.com if you need a signed, standalone copy.

When a member is removed from a team, the team's call records involving that member stay with the team as its own business records (they're needed for the team's billing and call history); the former member's own personal account data follows our normal account-deletion rules above. Either way, once an account is deleted its call and payment records are kept only in de-identified form, as described under "Data retention" above.

Passwords are hashed with bcrypt and never stored in plaintext. Traffic to and from QuikRing is encrypted in transit (TLS). No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard practices.

If a data breach occurs that's likely to result in a risk to your rights and freedoms, we'll notify the relevant data protection authority within 72 hours of becoming aware of it, as required by GDPR, and will notify affected users directly where the law requires it or the risk to you is high.

QuikRing is not directed at children under 18, and we do not knowingly collect personal information from them.

Our production servers and database are hosted in the European Union. Some of the third-party services we rely on — including Telnyx, Twilio, Stripe, Cloudflare, Slack, PostHog and Google (see our Sub-processors page) — are located outside the EEA or UK. Where that applies, we rely on appropriate safeguards such as Standard Contractual Clauses with those providers.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions about this privacy policy or how we handle your personal data? Contact our privacy team: