Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

This website provides information about Callstack, support, legal information and privacy information. It has no user accounts, forms, proprietary backend or tracking operated by us.

The website is hosted by Vercel. Visiting it may involve processing technically necessary data, including IP address, access time, requested URL, browser and device information and technical logs. This processing is necessary to provide the website securely and reliably.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically reliable provision of the website.

The hosting provider is Vercel Inc., USA. Processing outside the European Union cannot be ruled out. Vercel states that it uses appropriate mechanisms for international transfers and participates in the EU–US Data Privacy Framework. Further information is available in Vercel’s privacy notice.

Language selection uses your previously saved manual choice, or otherwise your browser’s preferred language. A manual language choice is stored locally in your browser (localStorage) for future visits. No location or IP lookup is performed, and this preference is not used for tracking.

call-stack.de currently uses no analytics, advertising or marketing tools operated by us. In particular, it does not use Google Analytics, advertising pixels or similar tracking services.

We do not use cookies or similar technologies that are not technically necessary. No consent banner is currently used.

The website is registered in Google Search Console. Search Console is used only to manage visibility in Google Search and evaluate the search information Google provides. No Google Search Console tracking script is embedded in this website.

If you contact us by email, particularly at support@call-stack.de, we process the information you provide, such as your email address, message and, where applicable, your name. The information is processed solely to respond to your enquiry.

For enquiries relating to a contract or pre-contractual measures, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on Article 6(1)(f) GDPR and our legitimate interest in handling enquiries.

The data is deleted when it is no longer needed to handle the enquiry and no statutory retention obligations apply.

Callstack is an app for managing and processing calling lists. Lead and sales data, including company name, contact person, phone number, location, notes, status and other information entered or imported by the user, is stored locally on their device.

Callstack operates no proprietary cloud backend for this data. We do not upload lead or sales data to our servers and cannot view it. CSV and Excel imports, status changes, notes and local backups are processed on the device.

Users choose which personal data they enter or import into Callstack and are responsible for using that data lawfully.

With your permission, Callstack reads device calendar events to identify scheduling conflicts when planning callbacks and appointments, and to show events in the read-only calendar view. This may include event titles, times, all-day information, locations and notes, where supplied by the calendar.

Callstack processes the calendar information locally. It does not send that information to us, RevenueCat or a Callstack push server. Callstack does not create, change or delete events in the device calendar. Calendar services you have configured on your device may separately synchronise their calendars under their own terms.

Calendar access is optional. Without permission, planning still works and conflict checks use only the callbacks and appointments stored in Callstack. You can withdraw permission in your device settings. On iOS, the operating system describes the permission needed to read existing events as full calendar access; Callstack uses it only to read events.

With the required system permission and the relevant app settings enabled, Callstack schedules local reminders for upcoming callbacks and appointments and a daily task overview. Reminder text may include the company name and scheduled time; the overview includes task counts. The operating system may display this information on the lock screen depending on your settings.

Scheduling and counting take place on your device. No proprietary push server, Expo push token or remote push service is used for these functions. Callstack does not send lead or calendar information to us or third parties to deliver these local reminders.

Where supported by the operating system and launcher, the app icon can show the number of overdue callbacks and appointments, capped at 99. It is calculated from locally stored tasks, not unread notifications. An independent numeric badge cannot be guaranteed on every Android launcher.

You can disable notifications in the app or device settings. Delivery can be affected by system settings, battery saving and focus modes. Forward scheduling is refreshed when the app opens; continuously current reminders and badges during long periods without opening the app cannot be guaranteed.

You can create local JSON backups and CSV or Excel exports and download or share them using your device. Callstack does not automatically upload these files to us. If you select another app, a cloud folder or a recipient, processing by that provider or recipient follows your action and their applicable terms.

The trial-usage counter in a backup is encrypted with AES-GCM and the backup is authenticated to detect tampering. Lead contents are not fully encrypted. Keep backups and exports secure and share them only with intended recipients.

Callstack can pass a phone number selected by the user to the operating system’s phone app. The call itself does not pass through Callstack servers. Further processing is performed by the operating system, telecoms provider and, where applicable, other telecommunications services.

Callstack offers paid Pro subscriptions. Purchases are processed through Google Play or the Apple App Store. RevenueCat is used to manage subscriptions technically and determine whether a Pro subscription is active. The provider is RevenueCat, Inc., USA.

For this purpose, RevenueCat processes technical identifiers and information about purchases and subscriptions, such as purchase status, product, term, renewal, expiry and transaction information provided by Google Play or Apple. Callstack receives information from RevenueCat about entitlement to Pro features.

Callstack and RevenueCat do not collect complete payment details, such as card or bank details, to process payments themselves. Payment is handled by Google Play or the Apple App Store.

This processing is necessary to provide and manage the subscription purchased by the user. The legal basis is Article 6(1)(b) GDPR.

RevenueCat may process data in the USA. RevenueCat states that it provides safeguards for transfers of personal data from the European Economic Area, including the European Commission’s Standard Contractual Clauses. Further information is available in its privacy policy.

The relevant platform operator also processes data when you download the app or purchase or manage a subscription. This is Google Play on Android and the Apple App Store on iOS. Our influence over processing by Google and Apple is limited. Their respective privacy policies also apply.

Lead and sales data stored locally in Callstack generally remains on the device until the user deletes it, replaces it through a restore, or removes the local app data or app accordingly.

Subscription data is additionally subject to the necessary retention periods and policies of RevenueCat, Google and Apple. Personal data held by us for support enquiries is deleted when no longer needed for that purpose, unless statutory retention obligations apply.

Personal data is disclosed only as necessary for the services described, where legally required or where another legal basis applies. In particular, recipients may include:

• Vercel, to provide the website;
• RevenueCat, to manage subscriptions;
• Google, in connection with Google Play and Android subscriptions;
• Apple, in connection with the App Store and iOS subscriptions.

Lead and sales data is not uploaded to these services unless required for an external action expressly initiated by the user. Calendar access and local reminders do not upload lead or calendar data to these services.

Subject to the statutory requirements, data subjects have the following rights in particular:

• Access under Article 15 GDPR;
• Rectification under Article 16 GDPR;
• Erasure under Article 17 GDPR;
• Restriction of processing under Article 18 GDPR;
• Data portability under Article 20 GDPR;
• Objection to processing based on legitimate interests under Article 21 GDPR.

To exercise your rights, email support@call-stack.de. We have no technical access to data stored solely within the Callstack app on your device. You can manage that data directly in the app or by deleting its local app data.

Under Article 77 GDPR, data subjects may lodge a complaint with a supervisory authority. The competent supervisory authority is:

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

The website is transmitted over HTTPS. Lead and sales data in the app is generally stored locally on the device. Users are also responsible for securing their devices and backups.

This policy is updated when Callstack’s functions, service providers or legal requirements change.

Last updated: October 2026