An unknown number is calling: how caller ID services work and what you hand over for them

An unknown number is calling. You let it ring out, it calls again. You want to know who it is, so you ask an AI assistant. The answer arrives in a second: install an app that shows you the caller's name. It will work. This article is about what you pay for it, because the price is not a sum of money and it is not entirely your decision to make.

Where those databases get the names in the first place

There is no public register stating who owns which phone number. Operators do not publish such a list and the printed directories our parents knew are gone. So when an app shows you a name as the phone rings, it had to get that name from somewhere.

It got it from the address books of its own users. The principle is simple and worth saying out loud:

• Somebody saved you in their contacts under your name.
• That somebody installed the app and granted it access to their contacts.
• Your name and number landed in the database, even though you have never heard of the app.

From this follows the point that makes sense of the whole article: in this trade you are not the customer, you are both the goods and the supplier. You are the customer only in the moment you pay for the better version. You are the supplier from the second you tap “Allow”.

And more importantly: you do not supply only yourself. You supply your entire address book. Colleagues, your doctor, a former partner, clients, children, the person you saved under a nickname. None of them asked you, and you asked none of them.

What you learn when you actually read the terms

This is the heart of the article, and also the advice we would give about anything else online: open the terms and read them, even when they are long and even when they are in a foreign language. A translator handles it in a minute. It tends to be the one place where the truth is written down in black and white, because the company is required to write it there.

We did it for you on the service the AI recommended. What follows is what can be read out of its own documents, specifically the privacy policy as last modified on 16 June 2025 and the terms of service as last updated on 7 March 2025. None of it is an accusation. It is a description of what the user agrees to.

Who is on the other side

The data controller is Getverify LDA, registered at Avenida do Infante 50, Funchal, Madeira, Portugal. The terms of service, meanwhile, are governed by the laws of England and Wales and disputes belong before the English courts. Subscription payments are handled, as commercial agent, by the Turkish company Teknasyon Yazılım Sanayi ve Ticaret A.Ş.

A Portuguese company, English law, a Turkish payment agent. There is nothing unlawful about that, it is an ordinary structure. But if you ever wanted to enforce your rights, you already know it will not happen at your local district court.

Your address book leaves the phone

The privacy policy states that to enable the features, the user must agree to share the names, numbers and information contained in their contact list, and that this sharing may be periodically synchronised.

That word “periodically” deserves attention. This is not a one off upload at installation. It is a continuous flow: every new contact you save from then on travels the same route.

The clause that shifts the whole responsibility onto you

This is, in our view, the most important sentence in the whole document. The policy states that if the user provides personal information about someone else, they thereby confirm that the person is aware of it and consents to the processing of their data, and continues to consent for the whole term of use.

Read that again and picture what it means in practice. With one tap you declare that all 400 people in your phone know you are handing their data to a Portuguese company, and that they agree to it. They do not know and they did not agree. They could not have: nobody asked them.

Legally it is elegant: responsibility moves from the company to the user. Factually it is a declaration that nobody on earth can truthfully make.

How long they keep the data

The document gives a general retention period of three years from the moment they become aware that you have stopped using the service. Notice the construction: the clock starts not when you stop, but when they find out. For some types of data the periods are shorter, for example call metadata up to six months and recordings up to 180 days. An account is deleted within 30 days of the request at the latest.

A detail that shows how well the document is maintained

In the section on transfers abroad, the safeguards listed are the standard contractual clauses approved by the European Commission and, alongside them, Privacy Shield certification for transfers to the USA.

The problem is that Privacy Shield was struck down by the Court of Justice of the European Union on 16 July 2020 in case C-311/18, known as Schrems II. Since 2023 it has been replaced by the EU-US Data Privacy Framework. A document last modified in June 2025 therefore cites a mechanism that had been invalid for five years by then.

This does not mean the company is breaking the law; it also cites the standard contractual clauses, and those are valid. It means something else, and something more useful to the reader: nobody reads that document properly, not even inside the company. And it is exactly the kind of discrepancy you find only when you open the terms yourself.

Four risks, ordered by how much they affect people who installed nothing

1. Your address book, emptied out

Not “emptied out” in the criminal sense. The point is that you hand over something you think of as yours, although most of the data in it belongs to somebody else. An address book is an extraordinarily revealing document. It is not just 400 numbers. It is a map of your relationships.

The notes are especially treacherous. People routinely write things into their contacts like “Peter owes 300”, “Dr Novak, psychiatry” or “mum, account PIN 1234”. The terms speak of the names, numbers and information contained in the contact list.

2. The privacy of people who have no idea

This is where a technical question becomes an ethical one. The people in your phone have no way of learning that you handed them over. They get no chance to refuse. And if they ever do find out, they discover that the only way out runs through a form on the website of a company they have never heard of.

Legally this is not trivial. The General Data Protection Regulation (GDPR) does exempt processing in the course of a purely personal or household activity in Article 2(2)(c), but handing a contact list to an outside company that makes it available to an indefinite number of people is no longer a personal or household activity. The Court of Justice of the EU has long read this exemption narrowly, from Lindqvist (C-101/01) through to Ryneš (C-212/13).

A German court in Bad Hersfeld in 2017 (file no. F 120/17 EASO) went as far as ordering a mother, in a single child welfare case, to obtain written consent from everyone saved in her son's phone, on the reasoning that otherwise he risked acting to their detriment. It was a specific family law decision, not a blanket precedent, and it should not be overstated. But the idea behind it is sound and it travels: your contacts' data is not your data.

3. Tags, or what strangers decided to call you

The tag feature shows the names other people have saved you under. For the company it is the hook that makes people pay for the higher tier. For you it is a list of labels you did not choose and never approved.

The problem is not when those names are neutral. The problem is when they are not. A tag can be set by anyone who has your number: an angry customer, a former partner, a competitor. For somebody who trades under their own name, that is a reputational risk entirely outside their control. And getting rid of one is not straightforward: reviews and complaints repeatedly report that tags outlive the deletion of a profile.

4. A data breach

This risk does not come from bad intent, it comes from the nature of the thing. A database linking a phone number to a name, to what other people call you, and to who is connected to whom, is worth more to a fraudster than a list of email addresses. It is exactly the material a convincing phone call is built from: the attacker knows your name, and knows how your banker addresses you.

No company can guarantee a breach will never happen. The only difference is how much you lose when it does. And with this type of database the answer is: a lot, and not only you.

How to find out who called without handing over your address book

The good news is that the original problem has solutions that do not cost the privacy of 400 people.

• Search for the number. For business numbers and nuisance callers this works surprisingly often. The forums where people report annoying numbers to each other cover most of what an app would show you.
• For Slovak companies, use the public registers. The Commercial Register and the Register of Financial Statements will give you the managing director and the registered seat behind a company name, which is far more than a tag in an app.
• Turn on silencing of unknown callers. Both iPhone and Android do this out of the box: an unknown number does not ring, but you find it among your missed calls. That alone deals with most nuisance calls, with no app at all.
• Report unsolicited marketing calls. Calling for direct marketing purposes without your prior consent is prohibited by Section 116 of Act No. 452/2021 Coll. on electronic communications. Supervision lies with the Regulatory Authority for Electronic Communications and Postal Services, and for personal data processing with the Office for Personal Data Protection of the Slovak Republic.
• If you are already in the database, the company runs an Unlist page for removing a number. Be aware that hiding a number and deleting the data are not the same thing. If you want erasure, ask for it expressly under Article 17 GDPR and keep a copy of the request.

How to read terms in a few minutes

You do not need to be a lawyer and you do not need to read all of it. It is enough to look for answers to these six questions, and to know what it means when an answer is missing.

1. Who is on the other side? Company name, registered seat, company number. Look in the footer and in the terms.
2. Which law governs it and where are disputes settled? One sentence, usually in the last third of the document.
3. What data do they collect, and from where? Look for words like contacts, list, synchronise, permissions.
4. Who do they send it to? Look for “third parties”, “partners”, “advertisers”, “group companies” and the names of countries.
5. How long do they keep it and how is it deleted? Look for periods in months and years and the word “erasure”.
6. What are you declaring about other people? Look for sentences beginning “you confirm”, “you represent”, “you warrant”.

A foreign language is not a reason to skip it. Paste the text into a translator. For legal documents, today's machine translation is more than good enough to let you grasp what a sentence means, and that is exactly what you need.

So should you install it or not

We will not tell you what to install. We will only say that you should make the decision knowing that it does not concern only you. With most apps, the risk is borne by the person who took it. This is one of the few categories where the price is also paid by people who know nothing about it.

One more thing from experience. When we get onto this subject with clients, the answer tends to be “nobody is interested in me anyway”. But this is not about anyone being interested in you. Your number reached the database because somebody else installed the app, and the people in your phone will reach it because you installed it. Nobody had to take an interest in you specifically; it was enough that you were on a list. The same holds for data collection in general: what gets collected is not what is interesting, it is what is available.

And if you tell yourself this is an extreme case, we have bad news. The sheer volume of data we hand over entirely voluntarily, day after day, to one of the most used social networks is, when you read its own documents, considerably more alarming than anything in this article. We are devoting a separate article to it.

For now, take away one sentence: open the terms and read them. It takes five minutes and it is the only place where somebody is obliged to tell you the truth.

Related reading

The same principle, that it pays to read before you sign, applies to choosing a supplier. We set it out in How to vet a development partner: ten questions before you sign.

What the same mechanism looks like when money is directly at stake is described in A clone instead of the original: how a fake site outranks the real one in Google.

And if you want to know what your own website reveals about you, our Free audit will show you which scripts and tracking codes run on it, and therefore who you are sending your visitors' data to.