Privacy policy

This policy describes how personal information is handled on Who Called Australia, with reference to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as the GDPR for visitors from the EU.

1. Who operates this service

The operator is named in the legal notice. Contact: contact@whocalledaustralia.com.

2. Principle: no database about people, no raw IP addresses

This site does not offer a reverse lookup based on personal data. Number pages are built exclusively on the official ACMA register data (which identifies carriers, not people) and on moderated community reports. The application never stores raw IP addresses. To prevent abuse (duplicate ratings, spam, rate limits), an irreversible keyed HMAC checksum is computed from the IP address; the IP cannot be recovered from that value.

3. Server logs

The web server (Nginx) logs accesses for technical reasons: IP address, time, requested page and browser identifier. Logs serve operational security and error diagnosis, rotate automatically and are deleted after 14 days at the latest. Traffic statistics keep only aggregated daily values, with no IPs and no browser identifiers.

4. Number lookups

Looked-up numbers are logged with a timestamp and the HMAC checksum described above — for abuse prevention and to identify frequently checked numbers. Lookups cannot be traced back to any person.

5. Ratings and reports

When you submit a rating or report we store the content, the chosen category, an optional name (free text, no real name required), the time and the HMAC checksum. Longer written reports are published only after editorial review and labelled as personal opinion.

6. Removal and dispute procedure

Anyone affected by a number page can request review, correction or removal of content via the Data removal and disputes page (APPs 12 and 13 cover access and correction). Requests enter an internal queue and decisions are logged verifiably. The email address you provide is used solely to handle the request.

7. Advertising (Google AdSense)

Pages with qualifying content may embed Google AdSense (Google LLC / Google Ireland Ltd.). Google may set cookies and process personal information (e.g. your IP address); details: policies.google.com/privacy. On pages without qualifying content — in particular number pages without verified reports — the ad code is not loaded at all.

8. Your rights

Under the Privacy Act you can ask for access to (APP 12) and correction of (APP 13) personal information we hold, and complain to the Office of the Australian Information Commissioner (oaic.gov.au) if you believe we've mishandled it. EU visitors additionally have the GDPR rights of access, rectification, erasure and objection. Exercise any of these by writing to contact@whocalledaustralia.com or via the Data removal and disputes form.

9. Retention

Community content is kept for as long as it serves the service or until a removal request is upheld. Lookup and rate-limit logs are purged periodically. Server logs: see section 3.