Privacy Policy

Second Phone Number

Operated by We Up LLC

Effective Date: September 21, 2026

1. Scope and Who We Are

This Privacy Policy explains how We Up LLC, a Delaware limited liability company (“We Up,” “we,” “our,” or “us”), collects, uses, discloses, retains, and protects personal information in connection with the Second Phone Number mobile application, our related websites, customer support, and associated calling, messaging, number-allocation, and account services (collectively, the “Service”).

For purposes of applicable data-protection law, We Up is the controller or business responsible for the personal information described in this Privacy Policy, except where another company independently determines how and why it processes information.

This Privacy Policy is a notice about our information practices. It is not a contract requiring consent to every processing activity. Where consent is legally required, we request it separately and allow it to be withdrawn. The Terms of Service and Acceptable Use Policy separately govern use of the Service.

This Privacy Policy applies to users and visitors worldwide, subject to the additional regional disclosures in Section 14. Local law controls to the extent it provides rights or obligations that cannot be waived.

2. Personal Information We Collect

The personal information we collect depends on the features you use, the permissions you grant, your device, your location, and how you interact with the Service.

2.1 Account and service identifiers

We may collect or generate:

• An internal user or account identifier;
• A device-linked or installation identifier used to recognize the account and restore access;
• The Second Number or Numbers allocated to the account;
• Authentication, session, and security tokens;
• Push-notification tokens;
• Account status, plan, credit balance, feature entitlements, settings, and preferences; and
• Country, language, time zone, and region inferred from device settings, IP address, marketplace account, or telephone-number allocation.

We do not require a legal name or email address to create a standard account unless a particular feature, support request, legal requirement, risk review, or account-recovery process requires it. If you voluntarily contact us, request support, submit a legal request, or provide information for verification, we collect the information you choose to provide.

2.2 Communications content

To provide calling and messaging features, we and our telecommunications providers process communications and related content, which may include:

• SMS, MMS, or other message bodies;
• Images, videos, documents, and other user-selected attachments;
• Voicemail audio and transcriptions, if offered or enabled;
• Caller and recipient numbers;
• Contact names or labels entered by the user; and
• Call audio while it is transmitted between participants.

We do not record or retain live call audio unless a separate recording feature is expressly offered, clearly indicated, and activated in accordance with applicable law. If such a feature is introduced, we will provide a specific notice before recording and update this Privacy Policy.

Messages, attachments, and voicemails may be stored so that they remain available in the user’s account. Communications may also be processed or temporarily retained by telecommunications carriers and routing providers under their own legal, technical, security, and retention obligations.

2.3 Telecommunications and activity records

We may collect:

• Originating and destination telephone numbers;
• Call and message timestamps, duration, direction, delivery status, and failure codes;
• Carrier, routing, network, and destination information;
• Number-allocation and number-reclamation records;
• Credits consumed and feature usage;
• Records of blocked, filtered, restricted, or reported communications; and
• Information necessary to investigate spam, fraud, abuse, security incidents, carrier complaints, and violations of our policies.

2.4 Device, network, and diagnostic information

We may automatically collect:

• IP address;
• Device type and model;
• Operating-system version;
• Application version and build;
• Device language and time zone;
• Network and connectivity information;
• Crash reports, error logs, latency, diagnostic events, and performance information;
• Dates and times of access;
• Features, screens, and controls used; and
• Security events and signals reasonably necessary to detect unauthorized or abusive activity.

We do not use device fingerprinting to circumvent user choices or platform restrictions.

2.5 Website technologies

Our websites may use cookies, local storage, pixels, and similar technologies to maintain sessions, remember preferences, protect forms and accounts, prevent abuse, measure performance, and understand use of the websites. Where legally required, non-essential analytics or similar technologies are disabled until the user makes an applicable choice. Users can manage available choices through our cookie controls and browser settings.

We do not use website technologies to sell personal information or share it for cross-context behavioral or targeted advertising.

2.6 Device permissions and user-selected information

Depending on the features you use, the Service may request access to:

• Microphone: to transmit your voice during calls or create voice messages;
• Contacts: to help you select recipients and display locally meaningful contact names;
• Notifications: to alert you to calls, messages, account activity, and service information;
• Photos, camera, or files: to let you select or create attachments; and
• Clipboard: only when you actively paste information or use a feature that clearly requires clipboard access.

Protected device resources are accessed only after the applicable device permission or user action. You may change permissions in your device settings, although disabling a permission may prevent the related feature from functioning. If you choose to import or synchronize contacts, we process the selected contact names and telephone numbers only to provide the requested functionality and for no advertising purpose.

2.7 Purchase and subscription information

Purchases are processed by the applicable app marketplace or payment provider. We do not receive complete payment-card or bank-account details. We may receive and retain:

• Transaction and purchase identifiers;
• Product, plan, price tier, currency, and purchase date;
• Subscription status, renewal date, expiration date, and cancellation status;
• Trial, offer, refund, and chargeback status;
• Marketplace country or storefront; and
• Credit purchases, promotional credits, usage, and remaining balance.

The marketplace or payment provider independently processes payment credentials under its own privacy notice and terms.

2.8 Support, complaints, and legal requests

When you contact us or another party reports activity involving the Service, we may collect:

• Name, email address, telephone number, and other contact information provided;
• Support messages, screenshots, files, call or message details, and troubleshooting information;
• Abuse reports, carrier complaints, recipient complaints, and supporting evidence;
• Privacy, deletion, legal, law-enforcement, and regulatory requests; and
• Records of our investigation, response, and resolution.

2.9 Fraud-prevention and compliance information

We may create or receive information used to protect the Service, including risk indicators, rate-limit events, behavioral patterns, account linkages, device or network reputation, carrier notices, blocked destinations, prior enforcement actions, and results of manual or automated review.

We do not require or routinely collect government identification, biometric identifiers, or facial-recognition data. We may request proportionate verification information if required by law, a telecommunications provider, a valid legal process, or a high-risk investigation. If we do, we will provide an appropriate notice and retain it only for the permitted purpose and period.

2.10 Information from other sources

We may receive information from:

• The user and the user’s device;
• App marketplaces and payment providers;
• Telecommunications carriers, number providers, and routing partners;
• Cloud-hosting, security, analytics, diagnostics, and customer-support providers;
• Recipients of communications, rights holders, complainants, or other users;
• Regulators, courts, and law-enforcement authorities; and
• Public or commercial sources used to investigate fraud, security threats, sanctions, or unlawful activity, where permitted by law.

3. How and Why We Use Personal Information

We use personal information only for defined purposes and on an applicable lawful basis.

Purpose

Information commonly used

Lawful basis where required

Create and operate an account; allocate and maintain Numbers

Account identifiers, assigned Numbers, device information, subscription status

Performance of a contract

Complete calls, messages, voicemail, and related features

Communications content, recipient information, telecom metadata, microphone or attachment data

Performance of a contract; consent for protected permissions where required

Process subscriptions, credits, entitlements, refunds, and account status

Transaction records, subscription status, account identifier, credit balance

Performance of a contract; legal obligations

Provide support and resolve technical issues

Support communications, diagnostics, account and activity data

Performance of a contract; legitimate interests

Protect users, recipients, providers, and the Service

Security logs, telecom metadata, content reported to us, risk signals, complaints

Legitimate interests; legal obligations; establishment, exercise, or defense of legal claims

Prevent and investigate fraud, spam, harassment, unauthorized access, and policy violations

Account, device, network, communications, complaint, and enforcement information

Legitimate interests; legal obligations

Maintain service quality and improve reliability

Usage, diagnostics, crash, and performance data

Legitimate interests; consent where required

Comply with law and valid legal process

Information relevant to the request or obligation

Legal obligation; public interest; legal claims

Communicate service, security, legal, and policy notices

Account identifier, push token, contact information provided

Performance of a contract; legitimate interests; legal obligations

Send optional promotional communications

Contact channel and communication preferences

Consent where required; legitimate interests where legally permitted

Our legitimate interests include operating a reliable communications service, protecting users and recipients, preventing financial and telecommunications abuse, maintaining network integrity, enforcing our legal rights, and improving service performance. We consider the nature of the information, the user’s reasonable expectations, safeguards, and the potential impact on individuals before relying on legitimate interests.

We do not use the contents of calls or messages for advertising. We do not use personal information to train a general-purpose artificial-intelligence model.

Certain information—including an account identifier, assigned Number, telecom routing data, and transaction or entitlement status—is contractually necessary to provide the Service. If that information cannot be processed, the relevant calling, messaging, account, or paid feature cannot be provided. Device permissions, contact imports, attachments, promotional communications, and non-essential analytics are optional unless a particular permission is inherently necessary for the feature the user chooses to activate.

4. Automated Security and Abuse Detection

We may use automated rules and risk signals to identify suspected fraud, spam, account compromise, abnormal usage, prohibited destinations, carrier-policy violations, or other security threats. These systems may rate-limit activity, block a communication, require additional review, or temporarily restrict an account.

We do not use solely automated processing to make a decision that produces legal or similarly significant effects on an individual unless applicable law permits it and required safeguards are provided. Where applicable, you may request human review of a qualifying automated decision by contacting us under Section 15.

We do not disclose confidential detection thresholds, models, or signals where doing so could facilitate evasion or compromise the security of the Service.

5. How We Disclose Personal Information

We do not sell or rent personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising. We do not disclose message content, call content, telecom metadata, or assigned Numbers for third-party advertising.

We may disclose personal information as follows:

5.1 Telecommunications and number providers

We disclose information necessary to allocate Numbers, route calls and messages, deliver voicemail, prevent fraud, satisfy carrier requirements, and operate communications features. These providers may independently retain certain records where required by telecommunications law, network rules, or their own lawful purposes.

5.2 Service providers and processors

We use vendors for cloud hosting, databases, security, customer support, analytics, diagnostics, communications delivery, and related operations. They may process information only for contracted purposes, subject to confidentiality, security, deletion, and data-protection obligations. We require protection that is materially consistent with this Privacy Policy and applicable law.

5.3 App marketplaces and payment providers

We exchange transaction, subscription, entitlement, refund, fraud, and account-status information as necessary to process and validate purchases and provide paid features.

5.4 Legal process, safety, and rights protection

We may disclose information where we reasonably believe disclosure is required or permitted by applicable law, regulation, court order, subpoena, warrant, or other valid legal process. We may also disclose information where reasonably necessary and legally permitted to investigate fraud, prevent imminent harm, protect users or recipients, enforce our agreements, defend legal claims, or protect the security and integrity of the Service.

We review legal requests for facial validity and scope and may challenge, narrow, or reject requests where appropriate. Nothing in this Privacy Policy limits any legally protected right to object to or seek review of a disclosure.

5.5 Corporate transactions

Personal information may be disclosed as part of due diligence for, or transferred in connection with, a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our business or assets. The recipient must use the information consistently with this Privacy Policy unless it provides legally required notice and obtains any required consent.

5.6 At your direction

We disclose information when you direct us to do so, request an integration or communication, or otherwise provide valid consent.

6. Data Retention

We retain information only for the period reasonably necessary for the stated purpose, subject to legal, accounting, fraud-prevention, security, dispute, and telecommunications requirements.

Information category

Standard retention period

Active account record, assigned Numbers, settings, and entitlements

While the account is active, then deleted or de-identified within 30 days after a valid account-deletion request, except for the categories retained below

Message content and user-selected attachments stored by We Up

Until deleted by the user or account deletion; residual copies are removed from active systems within 30 days and from routine backups within 90 days, unless preservation is legally required

Voicemail content stored by We Up

Until deleted by the user or account deletion; residual copies follow the same 30-day active-system and 90-day backup schedule

Live call audio

Transmitted in real time and not recorded or retained by We Up, unless a separately disclosed recording feature is activated

Call, message, routing, delivery, and credit-usage metadata

Up to 24 months after the communication or activity, unless a longer period is required by law, a carrier obligation, a pending dispute, or a documented security need

Purchase, subscription, refund, chargeback, tax, and accounting records

Up to 7 years after the transaction or account closure, or longer where legally required

Device, usage, crash, diagnostic, and performance data

Up to 24 months after collection, then deleted or aggregated

Security, abuse, complaint, suspension, and fraud-prevention records

Up to 5 years after the incident, investigation, or account closure, and longer only when reasonably necessary for an active legal matter or repeat-abuse prevention

Customer-support records

Up to 3 years after the matter is closed

Privacy requests, consent records, and legal-compliance records

Up to 6 years after completion, or as otherwise required by law

Routine backups

Rotated or overwritten within 90 days, unless isolated for security, disaster recovery, or legal preservation

When information is no longer required, we delete it, irreversibly de-identify it, or securely isolate it until deletion. De-identified information will not be used to re-identify an individual except to test whether de-identification controls are effective, where permitted by law.

Telecommunications providers, app marketplaces, payment providers, and other independent organizations may apply different legally permitted retention periods to information they control.

7. Account and Data Deletion

You may initiate deletion through the account settings in the application. You may also contact flyradarai@gmail.com if the automated flow is unavailable.

After verifying the request, we delete or de-identify the account and associated personal information according to Section 6. We may retain limited records where necessary to:

• Complete a transaction or provide a service requested before deletion;
• Comply with tax, accounting, telecommunications, sanctions, recordkeeping, or other legal obligations;
• Detect, prevent, and investigate fraud, abuse, security incidents, or repeat violations;
• Protect legal rights and resolve disputes;
• Preserve evidence subject to valid legal process or a litigation hold; or
• Maintain suppression records showing that a user opted out or an account was prohibited from re-registration.

Deleting an account does not automatically cancel a subscription managed by an app marketplace or payment provider. Users must separately cancel the subscription through the provider that processes it. We provide a clear reminder of this distinction during the deletion process.

8. Your Choices and Controls

Depending on your device, account, and location, you may:

• Change device permissions in operating-system settings;
• Disable promotional notifications while retaining essential service or security notices;
• Delete individual messages, attachments, voicemails, or call history where the feature is available;
• Correct account settings and information;
• Cancel a subscription through the applicable marketplace or payment provider;
• Delete the account through the in-app flow;
• Withdraw consent for optional processing without affecting earlier lawful processing; and
• Exercise the privacy rights described in Sections 13 and 14.

We do not condition paid core functionality on consent to unrelated advertising or tracking.

9. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, alteration, disclosure, loss, and destruction. Safeguards may include access controls, encryption in transit, credential and secret management, logging, monitoring, vendor review, least-privilege access, backup controls, incident response, and employee or contractor confidentiality obligations.

No system can be guaranteed completely secure. Users should protect their devices, operating-system credentials, account access, and any recovery information and should promptly report suspected unauthorized access.

If a security incident occurs, we will investigate and provide notifications to individuals, regulators, carriers, or law-enforcement authorities as required by applicable law.

10. International Data Transfers

We Up is based in the United States, and personal information may be processed in the United States and other countries where we or our providers operate. These countries may have data-protection laws different from those in your country.

Where required, we use a legally recognized transfer mechanism, which may include:

• An adequacy decision;
• The European Commission’s Standard Contractual Clauses and appropriate supplementary safeguards;
• The United Kingdom’s International Data Transfer Agreement or UK Addendum;
• Contractual safeguards recognized under Swiss law; or
• Another mechanism permitted by applicable law.

We do not rely on acceptance of this Privacy Policy as the sole legal basis for routine international transfers. You may request information about the applicable safeguard by contacting us.

11. Children and Minimum Age

The Service is intended only for persons who are at least 18 years old. We do not knowingly allow anyone under 18 to create or use an account, and we do not knowingly collect personal information from a person under 18 through the Service.

If we learn that a person under 18 has used the Service or provided personal information, we may suspend the account and take reasonable steps to delete the information, subject to legal retention obligations. A parent or guardian may report a concern to Flyradarai@gmail.com.

12. Third-Party Services and Websites

The Service may interact with telecommunications networks, app marketplaces, payment providers, device platforms, websites, or services operated by others. Their privacy practices are governed by their own notices. This Privacy Policy does not control an independent third party’s processing, but our service-provider contracts require appropriate protection where that third party processes information on our behalf.

13. General Privacy Rights

Depending on applicable law, you may have the right to:

• Know whether we process your personal information;
• Access or obtain a copy of personal information;
• Correct inaccurate personal information;
• Delete personal information;
• Receive certain information in a portable format;
• Object to or restrict certain processing;
• Withdraw consent;
• Opt out of sale, targeted advertising, or qualifying profiling;
• Appeal a refusal to act on a request;
• Use an authorized agent where permitted; and
• Complain to a privacy or data-protection authority.

Describe the right you wish to exercise and identify the account in a manner reasonably sufficient for us to locate it.

We verify requests proportionately. Verification may include confirming control of the device, account, assigned Number, transaction record, or another existing account factor. We will not request unnecessary government identification. If we cannot verify a request, we will explain the reason to the extent legally permitted.

We respond within the period required by applicable law. We do not discriminate against a person for exercising a privacy right. Certain rights are subject to exceptions, including legal obligations, security, fraud prevention, the rights of others, and the establishment, exercise, or defense of legal claims.

14. Regional Disclosures

14.1 European Economic Area, United Kingdom, and Switzerland

Individuals in these regions may have rights of access, correction, erasure, restriction, objection, portability, consent withdrawal, and complaint. Where processing is based on legitimate interests, you may object based on your particular situation. Where processing is based on consent, withdrawal does not affect processing completed before withdrawal.

You may complain to the data-protection authority where you live or work or where an alleged violation occurred. UK users may contact the Information Commissioner’s Office, and Swiss users may contact the Federal Data Protection and Information Commissioner.

14.2 California Notice at Collection and Privacy Disclosure

This subsection applies to the extent We Up is subject to the California Consumer Privacy Act, as amended (“CCPA”). The following table describes categories collected during the preceding 12 months, sources, purposes, and categories of recipients. We retain each category according to Section 6.

California category

Examples

Sources

Business or commercial purposes

Categories of recipients

Identifiers

Account ID, device ID, IP address, assigned Number, recipient Numbers, push token, contact details provided

User, device, marketplace, telecom providers

Provide and secure the Service; account administration; support; compliance

Telecom providers, cloud/security/support providers, marketplaces, authorities where legally permitted

Customer records and commercial information

Plan, subscription, transactions, credit balance, purchase and refund history

User, marketplace, payment provider

Billing, entitlements, accounting, fraud prevention, support

Marketplaces, payment and cloud providers, professional advisers, authorities where required

Internet or electronic-network activity

App interactions, diagnostics, logs, network and security events

Device and Service

Reliability, security, analytics, fraud prevention

Hosting, analytics, diagnostics, and security providers

Communications and telecom information

Message content, attachments, voicemail, call/message metadata, routing and delivery information

User, recipients, telecom providers

Deliver communications, maintain history, resolve failures, investigate abuse

Telecom, hosting, security, and support providers; recipients; authorities where legally permitted

Audio or visual information

Live call audio in transmission, voicemail, user-selected images or videos

User and device

Complete calls, provide voicemail, transmit attachments

Telecom, storage, and routing providers; intended recipients

Approximate location

Country or region inferred from IP address, device settings, storefront, or telephone number

Device, network, marketplace

Service availability, number allocation, localization, security, legal compliance

Hosting, telecom, security, and marketplace providers

Inferences and security information

Risk indicators, suspected account linkages, abuse flags, enforcement status

Service activity, providers, complainants

Detect fraud, spam, abuse, and account compromise

Security, telecom, legal, and compliance providers; authorities where legally permitted

Sensitive personal information

Contents of messages; account authentication information; communications that may reveal sensitive facts

User, device, communications

Provide the requested Service, maintain security, investigate malicious or illegal activity

Providers necessary for those purposes and authorities where legally permitted

We do not sell these categories and do not share them for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about users. Because we do not sell or share information for cross-context behavioral advertising, we do not offer a sale/sharing opt-out link. We will honor legally applicable opt-out preference signals for any activity that becomes subject to such a requirement.

California residents may request access, categories and specific pieces of information, correction, deletion, and information about disclosure. An authorized agent may submit a request with proof of authority, and we may also verify the request directly with the user. We do not knowingly sell or share the personal information of individuals under 16.

14.3 Other United States jurisdictions

Residents of a U.S. state with an applicable comprehensive privacy law may exercise rights provided by that law, including access, correction, deletion, portability, opt-out, and appeal rights where applicable. We do not sell personal information or use it for targeted advertising. We do not conduct profiling in furtherance of decisions producing legal or similarly significant effects. If we deny an appealable request, our response will explain how to appeal and, where required, how to contact the relevant state authority.

14.4 Canada

Canadian users may request access to and correction of personal information and may withdraw consent where processing depends on consent, subject to legal or contractual restrictions. Questions or complaints may be directed to our privacy contact. Users may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

14.5 Israel

Individuals in Israel may exercise applicable rights of access, correction, and deletion and may contact the Israeli Privacy Protection Authority regarding concerns. We process and transfer personal information using safeguards required by applicable Israeli law.

15. Contact Us

We Up LLC
Privacy email: Flyradarai@gmail.com

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, law, vendors, or information practices. We will post the revised version with a new effective date. If a change materially affects how we use previously collected personal information, we will provide advance or prominent notice and obtain consent where applicable law requires it.

We maintain prior versions for compliance and dispute-resolution purposes. Continued use does not constitute consent to a new processing activity where applicable law requires a separate affirmative choice.