Privacy policy
Last updated: 22 September 2026
Callspot lets a visitor start a video call by tapping or scanning a tag, without an app or an account. This policy explains what personal data Call Spot BV processes when you order a Callspot, use the app, or call someone through a tag, and which rights you have.
Who we are
Call Spot BV, Graaf Florislaan 2, 1217 KK Hilversum, the Netherlands, is the controller for the processing described here. You can reach us at privacy@callspot.com.
Whose data we process
- Customers who order a tag or a subscription and manage an account.
- Recipients who use the Callspot app to receive calls for an account.
- Visitors who tap or scan a tag and start a call from their browser.
- Website visitors of callspot.com.
What we process and why
Orders and payments
When you order, we process your email address, shipping address, the items ordered and the payment status. Payment is handled by Stripe. We never see or store your card details. We use this data to deliver the tag, set up your account and subscription, and send invoices. Legal basis: performance of the contract and our legal bookkeeping obligations.
Accounts and the app
Recipients sign in with their email address. We store your name, email address, language preference, device type and a push token so that we can ring your phone when a visitor calls. Legal basis: performance of the contract.
Calls
For each call we record which tag was used, when the call started, who was rung, who answered and when it ended. Audio and video are streamed directly between the visitor and the recipient using WebRTC and are not recorded by us. When a direct connection is not possible, media is relayed through a Twilio server. During a call a single still image of the visitor's camera may be captured and shown to the recipients so they can see who is at the door. Legal basis: performance of the contract with our customer, and our legitimate interest in letting recipients see who is calling.
Visitors who call through a tag
Visitors do not need an account. To set up the call, your browser asks permission to use your camera and microphone. We process your IP address and browser details for the duration of the call to establish the connection. We do not identify you or build a profile. Legal basis: our legitimate interest in providing the service the customer has asked for.
Smart lock integration
If you connect a Bold Smart Lock, we store the access token Bold gives us so that you can open your door from the app. We do not receive the lock's activity log. You can disconnect the integration at any time in the app. Legal basis: your consent.
Website
When you reach callspot.com through a campaign link, we record the visit together with the campaign parameters in the link so that we can measure our marketing. We do not use advertising cookies. Legal basis: our legitimate interest in understanding how people find us.
Contact
If you email us, we keep the correspondence for as long as needed to handle your request. Legal basis: our legitimate interest in answering you.
Service providers
We share data only with providers who process it on our behalf:
- Supabase, database, authentication and file storage.
- Vercel, hosting of the website and the call pages, in Frankfurt.
- Stripe, payments, invoices and subscription management.
- Resend, transactional email.
- Twilio, relay servers for calls that cannot connect directly.
- Apple and Google, push notifications to the Callspot app.
Some providers are established in the United States. Where data leaves the European Economic Area we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
- Account data: for as long as the account exists, then deleted within 30 days.
- Call records and snapshots: for as long as the account exists.
- Order and invoice data: 7 years, as required by Dutch tax law.
- Connection data of visitors: only for the duration of the call.
Your rights
You may ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and you may withdraw consent at any time. Send your request to privacy@callspot.com. We respond within one month. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
All traffic is encrypted in transit. Calls use end-to-end encrypted WebRTC media. Access to our systems is limited to people who need it for their work.
Changes
We may update this policy when our service or the law changes. The date at the top shows the current version. For significant changes we notify customers by email.