Privacy notice
Updated 21 September 2026. This notice covers the public informational prelaunch website at ownanumber.io. New purchases remain closed. Existing account holders may sign in to access orders, documents, account data and support. These private routes use essential authentication cookies and the account processing described below.
Existing accounts during prelaunch or a sales pause
If you already have an account, Supabase verifies your login and Resend delivers its email. Private order, billing, contractual and support records remain accessible to their holder where applicable. Stripe processes payment and tax records for existing orders. We retain these records to provide after-sales service and meet applicable legal obligations; closing new sales does not erase them. You may request your account data or closure through the private account pages or support.
Optional Google sign-in
Where Google sign-in is enabled, choosing it sends you to Google. Google and Supabase process your Google account identifier, verified email address and basic profile information, which may include your name and profile image, to authenticate and secure your requested account (Article 6(1)(b) GDPR). We request only openid, email and profile access, not Gmail, Drive or contacts. Authentication information is kept with your private account records; your login email is not published. You choose your public profile details separately. Email sign-in remains available. You can revoke this application's Google access in your Google account; this does not by itself close your Own a Number account or erase records subject to retention. Google may process information internationally under its privacy policy. Account export, closure and retention rules on this page apply to these records too.
Who is responsible?
Kevin Santiago Correa Villa, Demuthgasse 11/5, 1160 Vienna, Austria. Email: hola.camiliaapp@gmail.com. Telephone: +43 660 6635500.
Visiting the website
Our hosting provider, Vercel Inc., processes technical request data to deliver and secure the website. This can include your IP address, requested address, request time, browser information and error or security logs. The purpose is reliable delivery, troubleshooting and protection against abuse. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
We do not operate visitor analytics or advertising trackers on this public prelaunch site. Account sessions are used only when signing in. The application does not set optional analytics cookies here. Hosting security systems may process technical information needed to prevent abuse.
Language preference
On public pages with language-specific addresses, the address determines the language; English uses an address without a language prefix. Other translated pages use your saved preference, or your browser’s language preference if none is saved. Selecting a language or loading a public page whose language is defined by its address stores that choice in the first-party cookie oan-language for up to 180 days. Preloading a page does not change this preference. The cookie contains only the language code, remembers your choice and is not used for analytics or advertising. You can change it using the language selector or clear it in your browser. Translations are served by this website; page contents are not sent to a translation provider.
One launch notification
If you ask to be notified, we store your email, request and confirmation dates, consent version, language and hashed verification tokens in our separate Supabase database in the United Kingdom. Resend delivers the confirmation and launch emails. We save the language to send these messages in the language selected when you requested them. We process this information with your consent under Article 6(1)(a) GDPR. Confirming does not create an account or reserve a number. You may withdraw consent at any time through the unsubscribe link in your confirmation email or by contacting us.
Unconfirmed requests expire after 48 hours and are removed by daily cleanup. Confirmed requests expire after one year and are removed by daily cleanup, or earlier following the launch notification or your withdrawal. Daily cleanup can take up to another 24 hours. To limit abusive requests, we store secret-key hashes derived from email/network identifiers for rate limiting; those entries expire after 24 hours and are removed by daily cleanup. This security processing is based on our legitimate interest in preventing abuse.
For recovery after data loss, encrypted database backups are created using GitHub Actions and stored in private GitHub artifacts for up to 30 days. The restoration key is kept separately. Deleted records may remain in these restricted backups until expiry; they are not used for marketing and deletions must be reapplied before a restored database is returned to service. This security processing is based on our legitimate interest in protecting data against loss.
GitHub also processes data during backup generation and may process it internationally. See its privacy information.
Supabase and Resend may use international subprocessors. Details: Supabase data processing terms and Resend privacy policy. We do not sell the notification list or use it for unrelated marketing.
Contacting us
Online requests and withdrawal
The request form records your name, receipt email, request type, any contract reference and the information you submit, together with its receipt time and the language used to submit the request. These are stored privately in Supabase so we can handle your request and provide its receipt in that language. Resend sends a receipt containing your submitted declaration; authorized operators record handling notes. Submitting a request does not subscribe you to marketing and does not automatically change a purchase.
We use these details to handle requests concerning a contract, meet applicable legal obligations, or respond to other correspondence, as appropriate (Article 6(1)(b), (c) or (f) GDPR). Email and network identifiers are hashed for abuse prevention; the counters expire after 24 hours. Request records and email delivery copies follow the correspondence retention described below. The Supabase, Resend and backup processing described on this page also applies to these records.
Email links open your own email application. No message is submitted just by clicking a link. If you send an email, we receive your address, message and any information you choose to include. We use these to answer your request, based on our legitimate interest in responding to correspondence (Article 6(1)(f) GDPR), or Article 6(1)(b) where necessary for steps you request before a contract. Email is handled through the Gmail address shown above and your own email provider. Sending feedback does not subscribe you to marketing.
Recipients and international processing
Vercel provides hosting; Google provides the receiving email service. These providers may process data outside the European Economic Area. Applicable safeguards and processing arrangements depend on the service, including standard contractual clauses where applicable. See Vercel’s data processing information, Vercel’s privacy notice and Google’s privacy policy. You can contact us for information about processing relevant to your request.
How long is information kept?
Correspondence is kept for the time needed to answer and follow up on your request, and longer only where needed to meet an applicable legal obligation or establish, exercise or defend legal claims. Hosting providers control their operational log retention under their service policies; we do not maintain a separate visitor log archive. You may request deletion of correspondence when it is no longer needed.
Your rights
Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction and portability of your personal data. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing. Contact us using the details above; we normally respond within one month, with any permitted extension explained to you.
You may lodge a complaint with the Austrian Data Protection Authority or the competent supervisory authority in your country. You do not have to contact us first.
Your choices
Contacting us is voluntary. We need an address to reply to an email, but please do not send passwords, payment-card details or identity documents. We do not make automated decisions producing legal or similarly significant effects about visitors.