1Who we are
whoownsnumber.com is run by Hakan Boğan, an individual based in Türkiye, who is the data controller for the data described here. Contact: hello@whoownsnumber.com.
2What we collect
| Category | Data |
|---|---|
| Listing | Display name; the link, if you add one; if you are an Owner, the logo, note and colour you add; if you pay as a brand, its sector |
| Contact | Email address |
| Customer transaction | Number, amount, date, payment reference, card brand, last four digits and country, payment status, refunds and disputes, the texts you agreed to and the time you agreed. Your full card details stay with Dodo Payments. |
| Transaction security | IP address and a device identifier (both kept as hashes), browser information, request logs |
| Country | The country your IP address points to when you pay. We keep the country, not the address, and use it to place your Listing in that country’s list on the home page. |
| Emails | The emails we send you and whether they were delivered |
| Reports | The reason and note in a report you file, and an identifier of who filed it |
| Visit statistics | The page you open, the site you came from, your browser and device type, your country and how fast the page loaded. They are counted without cookies and are not tied to you or your device. |
We collect it electronically, through the checkout, edit and report forms, our server logs, a cookieless statistics script, and from Dodo Payments. To pay you must give a name and an email; the link is optional. Without them we can’t publish your Listing or confirm your payment. The site is for people 18 or over, and we don’t knowingly collect children’s data.
3Why we use it
| Purpose | Legal basis |
|---|---|
| Providing the service: publishing Listings, recognising a payer’s device, sending confirmations, edit links and “someone took your Number” emails | Performance of our contract with you |
| Keeping a record of each order and what was agreed, to settle disputes and chargebacks | Our legitimate interests |
| Tax and accounting records | Legal obligation |
| Moderation, fraud prevention and security, including Turnstile checks | Our legitimate interests |
| Counting visits and how fast pages load, to see what to improve | Our legitimate interests |
4What is public
These are shown on the site, in share images and in badges, and search engines may index them: your display name; your link, whose domain is shown and whose full address is where it leads; while you are the Owner, your logo, note and colour; your Total and payment dates; the amount and display name of each payment that claimed a Number, took it over or put a name on its list; the country of your payment, through your place in that country’s list (the country is not shown next to your name); and, once we approve it, that you are a brand and its sector. A badge shows only the Number, the Owner’s display name and the colour, never the logo. Your email is never published.
5Who receives it
| Recipient | Role |
|---|---|
| Dodo Payments | Merchant of record. We send it your email, the amount and the Number; it collects your card and invoice details itself and is an independent controller under its own privacy policy. |
| Cloudflare | Hosting, security, the Turnstile check, cookieless visit statistics and storage of the encrypted backups |
| Cloudflare | Email delivery |
| GitHub | Runs the weekly backup job: the database is exported and encrypted on its runner, and only the encrypted file leaves it |
Our providers process data outside your country, including in the United States and the EU, under their data processing terms, which include standard contractual clauses. Email us for a copy. We do not sell your data or share it for advertising.
6Cookies and browser storage
When you pay or open your edit link, we set two first-party cookies for 400 days: wo_dev, a random device identifier (we store only a hash of it), and wo_p, a marker that this device has paid. They let the site recognise a payer’s device and show your names as yours. Your browser also stores your theme and the names you have reported. “Forget this device” on the edit page removes the cookies and the device’s ties in our database.
Visit statistics are counted without cookies or browser storage. We use no tracking or advertising cookies, and no third party tracks you across sites through ours, so Do Not Track signals change nothing.
7How long we keep it
We keep personal data for the periods below and then erase, destroy or anonymise it.
| Category | Retention period |
|---|---|
| Customer transaction | 5 years from the end of the year of the transaction, as required by tax and commercial law. Afterwards the card details and the technical identifiers of the checkout are erased; the amount and date remain as part of the public Total, together with the payment reference, country and the time you consented. |
| Contact | Until you ask us to erase it; we need it for your edit link and to tell you when someone takes your Number |
| Transaction security | Server logs: 7 days. Hashed address and browser information of a checkout: 30 days if the checkout is not completed, otherwise as long as the transaction record above |
| Visit statistics | Cloudflare keeps them for up to six months |
| Reports | The identifier of the person who reported is replaced after 7 days. Notes are deleted after 30 days. Reports on a closed review are deleted after 30 days. |
| Hidden logos | A logo hidden by moderation is deleted after 30 days. |
| Emails | The text of an email, and the content of a notice from Dodo Payments, is deleted after 30 days; the record of either (address and status) after 60 days |
8Your rights
You can ask us to give you access to your data, correct it, erase it, restrict or stop our use of it, or hand it over in a portable form; to tell those we passed it to about a correction or erasure; and to review a purely automated result that works against you. You can claim compensation for unlawful processing and complain to the data protection authority where you live.
You can change your name and link yourself with the edit link in your confirmation email. For anything else, write to hello@whoownsnumber.com from the email you paid with; if you did not pay, tell us what your request is about. We answer free of charge within 30 days.
If you ask us to erase your data, we erase the display name, link, logo, note and email address. The payment stays on the public list without identifying information so that Totals stay accurate. Customer transaction data are kept as set out in section 7. Backup copies are encrypted and are kept for up to 30 days: erased data can remain in them until they expire, and is not restored.
9Changes
We may update this notice and will publish the new version here with its effective date. We email everyone with a Listing about material changes.