CALLERHUB – PRIVACY NOTICE
CallerHub (c) 2026 - Simon Bernhard · https://callerhub.de
Version: 17 October 2026 · CallerHub 3.0

1. Who is responsible?
CallerHub is software that you (the organisation or person operating CallerHub) run on your own computers. You, as the
operator, are the controller within the meaning of the GDPR for the processing in CallerHub. The provider of the
software (Simon Bernhard) receives no data from CallerHub and is therefore not a processor.

2. Which data does CallerHub process?
- Phone numbers of incoming calls sent to CallerHub by the phone system, and the names found (company or person names,
  optionally a link into the CRM).
- Phone numbers and names from the configured data sources (e.g. CRM, ERP, CSV file, Active Directory, Microsoft 365);
  they are held in memory for fast answers and are not stored permanently.
- Log (folder Logs): time, sender IP address, shortened phone number, result. Passwords and keys are masked. Retention
  can be set (Administration > Privacy).
- Statistics (folder Statistics): number of requests and matches; phone numbers only as a hash, names only on request.
  Retention can be set.
- Call analysis (folder CallData): call records that you export from the phone system or that the FRITZ!Box call
  monitor supplies (time, numbers, extension, duration).
- Settings (CallerHub.settings.xml) including credentials of data sources; passwords encrypted (DPAPI), API keys
  optionally as well.

3. Purposes and legal basis
Showing the caller's name on the phone, operation and troubleshooting, analysis of reachability. The legal basis is
usually Art. 6(1)(f) GDPR (legitimate interest in efficient communication) or (b) (contract with the caller). Call
analysis by extension may allow monitoring of performance or behaviour; involve the works council and employees before
using it where required.

4. Recipients and transfers
CallerHub sends data only to the destinations you configure: your phone system, your data sources (e.g. Microsoft 365,
HubSpot, Salesforce), notifications (e-mail, webhook) and – only when explicitly invoked – the AI assistant in the
browser. There is no transfer to the provider, no telemetry and no advertising. The Oracle driver does not transmit data
to Oracle. For cloud data sources, the contracts with their providers apply.

5. Retention
Data in memory is discarded when reloading or exiting. Log and statistics are deleted after the configured period. You
delete call records of the call analysis in the CallData folder.

6. Security
Access only with API key and allowed IP addresses, lockout after failed attempts, HTTPS, virtual service account with
few rights, encrypted passwords, checksums and SBOM of the delivery. Details: help, section "Security and standards".

7. Rights of data subjects
Callers and employees have the rights of access, rectification, erasure, restriction, data portability and objection
towards you as the controller, as well as the right to lodge a complaint with a supervisory authority. CallerHub
supports access and erasure because all data is stored in traceable files in the program folder (overview:
Administration > Privacy).

8. Note
This notice describes the processing by CallerHub. Transfer the relevant information into your record of processing
activities (Art. 30 GDPR) and your privacy information (Art. 13/14 GDPR). It does not replace legal advice.