Privacy Policy and Data Retention
Who Called Canada is a Canadian service. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair-information principles: accountability, identified purposes, consent, limited collection, limited use and retention, accuracy, safeguards, openness, individual access and the right to challenge compliance. This page sets out what that means in practice.
Operator: OmegaIT Limited, Unit B2 Eden Business Park, Cooil Rd, Braddan IM4 2AY, Isle of Man. Company registration: Isle of Man Companies Registry, No. 135506C. E-mail: hello@whocalledcanada.com.
1. What we do not collect
No account is needed to use the site. We do not ask for your name, address or date of birth. We do not sell, rent or trade personal information. We do not buy subscriber lists and we never attempt to link a telephone number to a person: number pages describe the allocation of a prefix to a carrier, never the identity of a subscriber.
2. What we collect, and why
| Data | When | Purpose | Retention |
|---|---|---|---|
| Number looked up | Every lookup | Serve the requested page; aggregate demand statistics | Lookup log: 90 days |
| IP-address fingerprint (SHA-256 hash truncated, keyed with a server secret) | Lookup, vote, report, contact request | Abuse prevention, rate limiting, one vote per number per day | With the record it belongs to; lookups, votes, reports and contact requests keep only this fingerprint, not the IP address |
| Visit record: page, time, referring page, browser user agent, IP address and its fingerprint, wcl_sid session identifier | Each page you open (nothing is sent if your browser sends a Do Not Track signal) | Count visits and distinct visitors, tell people from automated traffic, see which countries visits come from | No fixed deletion date yet |
| Vote (scam / nuisance / safe) and optional comment | When you vote | Publish a moderated community reputation | While the number is in service or until removal |
| Report (text, caller type, optional pseudonym) | When you report | Publication after moderation | As above; rejected reports are deleted after 12 months |
| E-mail address and message | Contact form or privacy request | Reply to you and document the decision | 24 months after closure |
| Web-server logs (IP address, user agent, page, timestamp) | Every request | Security, diagnostics, traffic statistics | 14 days, then rotated |
The vote and report forms include a hidden field meant for bots; submissions that fill it are discarded. Reports are screened automatically (links, social insurance numbers, repetitive content) and then read by a moderator before publication; votes and their short comments are published after the same automatic screen and removed on request.
3. Cookies, advertising and your choices
The site sets a single cookie of its own, wcl_sid. It holds only a random identifier, which the visit beacon sends with each page you open so that several pages viewed in the same browser count as one visitor (the visit record is described in section 2). It is not used for advertising, is not shared with other companies and expires 12 months after it is set. If your browser sends a Do Not Track signal, the beacon sends nothing and the cookie is not set. We use neither Google Analytics nor social-media pixels.
Google AdSense advertising appears only on the editorial guides and on number pages. No other page loads advertising code: not the home page, the guides index, the province, city, area-code or carrier pages, nor the about, contact and policy pages.
Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. See how Google uses information from sites that use its services.
You can opt out of personalised advertising in Google’s Ads Settings, and opt out of interest-based advertising from other participating companies with the tools at youradchoices.ca.
Visitors from the European Economic Area, the UK and Switzerland see Google’s consent message before advertising cookies are used; if they refuse, Google does not use cookies to personalise ads but may still show non-personalised ads. They can change their choice at any time with the “Privacy settings” link at the foot of any page that shows advertising. For other visitors, and on pages without advertising, that link opens this policy.
4. Consent
By looking up a number you consent to the processing in section 2 for that lookup. By voting or reporting you consent to the anonymous publication of your contribution on the page for that number and in our sitemaps. You may withdraw that consent at any time by requesting deletion (section 6); the contribution is withdrawn from publication within five business days.
5. Where the data lives
The site and its database run on a dedicated server in Ireland (European Union), administered solely by the operator. Your data therefore leaves Canada; there it falls under a protection regime (GDPR) comparable to PIPEDA. Transfers are encrypted (TLS). Backups are encrypted and kept for 14 days. No processor has access to raw data; Google receives only the advertising requests described in section 3.
6. Your rights: access, correction, deletion
You may ask what data we hold about you, obtain a copy, have it corrected or have it deleted. Because we keep no named identifier, a request is in practice about a telephone number: give the number, attach reasonable evidence that you control it (a redacted bill is enough) and say what you want done. Write to hello@whocalledcanada.com or use the contact form. We acknowledge within five business days and answer within 30 days, as PIPEDA requires. Disputed content may be hidden while under review. The detailed procedure is on the Disputes, abuse and removal page.
7. Minors
The service is not directed at people under 16 and we do not knowingly collect data about them.
8. Complaints
If you consider our answer unsatisfactory you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
9. Changes
Material changes are flagged by the date below; earlier versions are available on request.
Last updated 2026-10-14.