Legal
Privacy Policy
This policy explains what personal data SpareLine processes when you use the SpareLine app and this website, why we process it, who else sees it and how long we keep it.
The short version: we need your account details to give you an account, the record of your calls to bill them correctly, and your billing details to charge the right tax. We do not record or listen to your calls, we do not sell personal data, and we do not run advertising or tracking.
1. Who is responsible for your data
JRKA Oy is the controller of the personal data described here. Company and contact details are in the Contact section at the end of this page.
Privacy questions and requests about your rights: ppa.enileraps@ycavirp.
2. What data we process
| Category | What it contains | Where it comes from |
|---|---|---|
| Account and identity | Email address, display name, the identifier given to your account by our sign-in provider, and which sign-in methods are linked to it | You, and our sign-in provider when you sign in |
| Session and device | App session records (we store only a one-way hash of the session secret, never the secret itself), device identifier, push notification token, app version and platform | The SpareLine app on your device |
| Phone numbers | The numbers assigned to you, their country, term, renewal state and status history | You and our telecom provider |
| Call records | For each call: the number called or calling, start and end time, duration, destination and rate, cost, and whether the call connected, was missed or failed | Generated when you use the Service, and reported by our telecom provider |
| Text messages | For each message: the numbers involved, the time, whether it was delivered, what it cost, and the text itself | Generated when you send or receive a message, and reported by our telecom provider |
| Voicemail | The recording a caller leaves, its length, the time, the caller’s number, and the greeting you record for a number if you choose to | The caller, and you for the greeting; the recording is made by our telecom provider |
| Connection quality | Technical call measurements such as jitter, packet loss and whether the microphone was picking up sound | Your device during a call |
| Payments and billing | Balance and transactions, amount and currency, the payment provider’s reference for a payment, billing name and address, country, VAT identification number, and invoices | You, and our payment provider |
| Tax evidence | The evidence used to decide the country of supply and the correct VAT rate: billing country, the country of the payment method, and the result of a VAT number check | You, our payment provider, the EU VIES service |
| Support messages | Your messages to us and our replies, plus any details you include in them | You |
| Technical logs | Server and application logs: request time, endpoint, result, IP address, error and diagnostic events | Automatically, when the app talks to our servers |
While you are on the waitlist we hold only your account and identity data and your sessions: enough to let you in and to email you when you can start. You can ask for a copy of it, or delete the account, from the waiting screen at any time. Waiting does not commit you to anything; the contract begins when you are let in.
If we invite you to test the Android app before it is released, we keep your answer, the terms as they were shown to you, and — if you say yes — the email address of the Google account you give us. We use that address only to add you to the test on Google Play, which means Google receives it, and only to tell whether you qualify for the credit the terms promise, which we read from how you already use SpareLine.
We do not ask for and do not want special categories of data (health, political opinions, biometrics and so on). Please do not send them to us in support messages.
3. What happens to your calls
We do not record your calls and we do not store call audio. Call audio travels between your device and our telecom provider, which connects it to the telephone network. The one exception is a voicemail, which a caller leaves on purpose as a recorded message — see the next section.
What we do keep is the record of the call - who was called, when, for how long, and what it cost - because we need it to charge you correctly, to show your call history, to answer billing questions and to detect fraud. This is normal telecommunications billing data, and it is treated as confidential.
Our application logs are written so that phone numbers and other personal details are deliberately left out: where a comparison is needed, the log records the outcome rather than the number.
4. Voicemail
If you do not answer and you have voicemail switched on for a number, the caller can leave a message. That is not a call being recorded: the caller is told they are leaving a message, and a message exists only because they chose to leave one.
A voicemail is available only to you. You can listen to it as many times as you like in the SpareLine app and save a copy on your own device. We do not listen to it or use it for anything else. The date it will be deleted is shown beside it, and it is deleted automatically after 30 days; you can also delete it yourself sooner. We warn you before messages are about to disappear. The number the caller rang from is erased from the record after 39 months, like the numbers on other call records.
A greeting you record yourself is kept for as long as the number is yours, and deleted with it.
5. Your message history on your device, and your own backup
We keep the text of a message on our servers only until every device you are signed in on has received it, and at most 30 days. After that, the copy in the SpareLine app on your device can be the only one.
On your device, the app keeps your messages and call history encrypted, with a key that belongs to your account. The key is stored on our servers, itself encrypted, and given only to the app while you are signed in. The history stays on the device when you sign out, so it is there when you sign back in, and anyone else who signs in on the same device cannot read it. You can remove it at any time in the app under Privacy & security; the text of messages already delivered cannot then be loaded again.
In a web browser, the same history is kept encrypted in that browser’s own storage for this site, and it also stays when you sign out. The key is fetched again each time the page loads and is not kept in the browser. There is no backup in a browser, and clearing the site’s data in your browser removes the history for good. We ask the browser not to clear it on its own to free space, but the browser decides.
Your own backup is optional and off unless you turn it on. On Android you can keep an encrypted copy of your messages and call history in your own Google Drive, in a hidden folder that belongs to the app, and choose whether it is made only when you ask or automatically. The app asks Google for access to that folder only, not to your other files. The backup is created and encrypted on your device and sent straight to your Google account: we never receive it, and Google keeps it under your own agreement with Google. It is encrypted with a key derived from your account’s key, so we could technically read a backup only if we obtained the file, which we do not. You can delete your backups in the app or in your Google Drive settings.
Deleting your account deletes the key, which makes the history on every device and every backup you have kept unreadable, including copies we cannot reach.
6. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, assigning numbers, connecting calls, keeping your balance and call history | Performance of the contract (Art. 6(1)(b)) |
| Keeping your account on the waitlist until you can start, and telling you by email when you can | Steps you asked us to take before a contract (Art. 6(1)(b)) |
| Inviting you to test the Android app before it is released | Legitimate interest in testing the app (Art. 6(1)(f)) |
| Adding you to the Android test when you say yes, and giving the credit its terms promise | Steps you asked us to take under those terms (Art. 6(1)(b)) |
| Taking voicemail messages for you and letting you listen to them | Performance of the contract (Art. 6(1)(b)) |
| Charging for usage, taking payments, deciding the correct VAT and issuing invoices | Performance of the contract, and legal obligation for accounting and tax (Art. 6(1)(b) and (c)) |
| Keeping accounting records, answering lawful requests from authorities, meeting telecommunications obligations | Legal obligation (Art. 6(1)(c)) |
| Security, abuse and fraud prevention, protecting the Service and other customers, investigating incidents | Legitimate interest (Art. 6(1)(f)) |
| Diagnosing faults and improving call quality and reliability | Legitimate interest (Art. 6(1)(f)) |
| Answering your support requests | Performance of the contract, or legitimate interest (Art. 6(1)(b) and (f)) |
| Push notifications so the app can ring for an incoming call, and access to your microphone | Performance of the contract, with the device permission you grant and can withdraw at any time in your device settings |
| Keeping your message history on your device, and the optional backup to your own Google Drive when you turn it on | Performance of the contract, at your request for the backup (Art. 6(1)(b)) |
| Marketing messages, if we ever send them | Consent (Art. 6(1)(a)), withdrawable at any time |
7. Profiling and automated decisions
We do not build advertising profiles and we do not sell personal data. Automated checks do run on payments and usage to catch fraud and abuse, and they can block a payment, a call or an account. If such a check affects you, contact us at ppa.enileraps@troppus and a person will look at it.
9. Transfers outside the EU
Our systems are hosted by Microsoft Azure in the European Union, and we keep the data our providers process for us in the EU. If a provider or its support functions ever operate from a country outside the EU and the EEA, the transfer relies on an adequacy decision by the European Commission or on the Commission’s Standard Contractual Clauses together with the additional safeguards those clauses require. You can ask us for details of the mechanism used for a specific provider.
10. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account exists, then deleted or anonymised within 30 days |
| An account on the waitlist that has not been let in | While you use it. If it goes unused for 6 months it is deleted, and we email you a month before |
| Your answer to an invitation to test the Android app, and the Google account you gave for it | While your account exists |
| Call and message records — the numbers involved | 39 months |
| Call and message records — time, length and cost, without the numbers | While your account exists |
| The text of a message, on our servers | Until every device you are signed in on has received it, and at most 30 days |
| Your message history and call history on your device, and a backup you keep in your own Google Drive | Until you remove them. Deleting your account makes them unreadable |
| A voicemail recording | 30 days, or until you delete it yourself. The caller’s number is erased from the record after 39 months |
| Invoices and the evidence for the VAT charged on them | 10 years, as accounting and tax law requires |
| Payment records | 6 years from the end of the calendar year in which the financial period closed, as accounting law requires |
| Support messages | 24 months |
| Technical and security logs | 30 days, longer for an incident under investigation |
| Sessions and push tokens | Until the session expires, you sign out, or the app is removed |
Call and message records lose the numbers first and the rest later. We keep the number you called, or that called you, for 39 months, which covers the time an invoice can still be disputed and itemised. After that the number is erased from the record and what remains — when the call was, how long it lasted and what it cost — stays while your account exists, because it is what your billing is made of.
Backups follow their own rotation and are overwritten in the normal cycle, so a deletion can take a little longer to disappear from backup copies.
11. Your rights
Under the GDPR you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer have a legal reason to keep (accounting records are the usual exception);
- restrict or stop a particular use of your data;
- object to processing based on our legitimate interest, and to any marketing;
- receive the data you gave us in a machine-readable form, or have it sent to another provider;
- withdraw a consent you have given, at any time.
Write to ppa.enileraps@ycavirp. We answer within one month and may need to verify your identity first - we will not hand your data to someone else claiming to be you. Asking costs nothing.
If you are not happy with how we handle it, you can complain to the Office of the Data Protection Ombudsman (Finland) (tietosuoja.fi/en) or to the data protection authority of the EU country where you live.
12. Deleting your account
You can delete your account from the SpareLine app. Deletion asks you to sign in again first, then cancels your subscriptions, releases your numbers and removes your profile and call history within 30 days. Invoices and the tax records behind them are kept for 10 years, and payment records for 6, because the law requires it; they are no longer used for anything else. Deleting your account also deletes the key to your message history, so the copies on your devices and any backup in your Google Drive can no longer be opened.
13. How we protect it
Traffic between the app and our servers is encrypted in transit, and data at rest is encrypted by our cloud provider. Sign-in is handled by a dedicated identity provider, app session secrets are stored only as one-way hashes, and sensitive actions require a fresh re-authentication rather than a stored token. Access to production data is limited to the people who need it, and administrative functions are gated on individually granted permissions that are checked on every request.
No system is perfect. If a breach happens that puts your rights at risk, we notify the supervisory authority within 72 hours and tell you without undue delay. Security issues can be reported to ppa.enileraps@ycavirp.
14. Children
The Service is not intended for children: an account requires you to be at least 18 years old. We do not knowingly collect data about children, and we delete it if we find we have.
15. This website, cookies and analytics
This website sets no advertising or tracking cookies and runs no analytics or advertising scripts. Standard server logs of requests are kept for 30 days for security and troubleshooting.
The site loads its typeface from Google Fonts, which means your browser contacts a Google server and Google sees your IP address as part of serving the font file.
The payment return page (/stripe) reads the result of a checkout from the address bar in your browser to show you whether the payment went through. Nothing about it is stored on this site.
16. Changes to this policy
We update this policy when the Service, our providers or the law change. The version and date at the top of the page always tell you which version you are reading. If a change materially affects how we use your data, we tell you in the app or by email before it takes effect.
17. Contact
Questions about this document can be sent to ppa.enileraps@ycavirp.
JRKA OyBusiness ID 3655311-7VAT ID FI3655311701610 VantaaFinlandGeneral support: ppa.enileraps@troppusBilling: ppa.enileraps@gnillibPrivacy: ppa.enileraps@ycavirpAbuse reports: ppa.enileraps@esuba