Privacy policy

Last updated: 31 October 2026

This policy explains what data Who Was That (who-was-that.net) collects, why, how long we keep it and what your rights are. We keep it short and only collect what we need.

Who we are

Who-Was-That.net is run by Who Was That. We are the controller of the personal data described below. You can reach us at contact@who-was-that.net.

When you check a phone number

We store:

• the phone number you checked and the date;
• a scrambled code made from your IP address (a one-way hash with a secret key). We use it to count how many different people checked a number and to stop abuse. We don't store your IP address itself.

We use this to show how often a number has been checked and to limit how many checks one visitor can do. These records are deleted after 12 months.

To find out more about a number, we send the number (and nothing about you) to our data providers: Abstract API for network and line information, and LeakCheck for data breaches. We keep only the parts of their answers that we show on the result page, such as the network, whether the number is active, the names of breached websites and which types of data were exposed, for up to 30 days before we refresh them. We never store or show the breached data itself, and we do not store the names of private individuals.

When you post a report

If you report a call, we store the phone number, the type of call you chose, your optional comment, the date and the scrambled code made from your IP address. The scrambled code lets us limit reports to one per number per day and is never shown. The type of call, the comment and the date are visible to everyone who checks that number. We automatically remove links, email addresses and phone numbers from comments. Please don't include names or other personal details.

Reports stay online as long as they help others. We remove reports that are wrong, abusive or contain personal information, and you can ask us to remove one.

If your number is checked or reported

A phone number can be personal data, even if you didn't use our site yourself. We process numbers that visitors check or report because we have a legitimate interest in helping people recognise scams and nuisance calls. We don't show who checked your number, and we don't show the names or addresses of private individuals. You can object to this processing or ask us to remove reports about your number by contacting us.

When you ask for scam help

If you fill in the form on our scam help page, we store your name, email address, phone number (if given), the details of what happened, the date and the scrambled code made from your IP address (to stop abuse). With your consent, we share these details with a partner investigation firm so they can contact you about your case. That firm then handles your data under its own privacy policy.

You can withdraw your consent at any time by emailing us. We will then stop sharing your details and delete your request. Withdrawing consent does not undo sharing that already happened, but we will ask the partner to delete your details too. We delete help requests after 12 months.

When you email us

We use your email address and message only to answer you. We keep emails for as long as needed to deal with your question, and no longer than two years.

Legal basis

• Checking numbers, community reports and preventing abuse: our legitimate interest in providing a free, safe tool that helps people avoid scams.
• Scam help requests and sharing them with a partner firm: your consent, which you give by ticking the box on the form.
• Answering your emails: our legitimate interest in replying to you, or taking steps you ask for.

Who we share data with

• Cloudflare hosts the website and stores our database. It processes IP addresses to deliver the site and protect it from attacks.
• Abstract API receives the phone numbers that are checked, to look up network and line information.
• LeakCheck receives the phone numbers that are checked, to look up data breaches.
• Partner investigation firms receive scam help requests, only when you consent to this on the form.

These providers may process data outside the UK, including in the United States. Where that happens, we rely on the safeguards required by UK data protection law. We never sell personal data.

Cookies

We don't use cookies or tracking for advertising. If an advert on the result page takes you to another website, that website's own privacy and cookie policy applies.

Your rights

Under UK data protection law you can ask us for access to your data, ask us to correct or delete it, object to our processing or ask us to restrict it. Because we don't store your IP address or name, we may not be able to link stored records to you. Tell us the phone number concerned and we'll do what we can. Email contact@who-was-that.net.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO).

Children

Who Was That is not intended for children under 13.

Changes

We may update this policy. The date at the top shows when it last changed.