01Who we are
PhoneUse is run by Masta, Inc. ("PhoneUse", "we", "us"). We decide how and why your personal data is used for the service. Under data protection laws such as the GDPR, that makes us the "controller" of that data.
When we handle personal data on a business customer's phones or in its content, we do so for that customer, and the customer's own privacy notice applies.
This policy covers our website (www.phoneuse.com), the console (console.phoneuse.com), our API and MCP server (mcp.phoneuse.com), our docs (docs.phoneuse.com), the PhoneUse CLI and the AI Copilot. Our Terms of Service explain the rules for using them.
Questions? Email abdulla@phoneuse.com.
02What we collect
Your account
- Our sign-in provider, Clerk, collects your email address, your name and your password. If you sign in with Google, Clerk gets your profile from Google instead of a password. Clerk handles your password. We never see it.
- Clerk also keeps your organizations, team members, roles and invitations, and your sign-in sessions, including the device, browser, IP address and the time you were last active.
- Our own database mostly stores IDs for you and your organization, not your name or email. Two exceptions: when something goes wrong with an order or a phone, our internal staff alerts can include the paying customer's email address so we can reach you, and those alerts are kept in our database and sent to our team inbox. Your organization's name, which may include your first name, is stored too. Otherwise, when we need to email you, we look up your address from Clerk at that moment.
Payments
- Stripe handles payments. When you pay, Stripe collects your card details and your billing address. We never see or store your full card number. Your billing address is used to work out tax, and Stripe keeps it.
- We keep records of what you bought and paid: order details such as phone model, region and quantity, amounts, Stripe invoice and subscription references, and your per-minute balance and charges.
Your phones
- Screen text. When you or an agent ask for it, we read the text and layout on the phone's screen to answer that request. For the Copilot, it is saved in your chat.
- Action records. We keep a record of each action taken on a phone, such as a tap, a swipe or typing. It shows the time, where on the screen, which app was open, who did it (a user ID or an API key). For typed text, we record only how long it was, not the text itself.
- Agent runs. We keep the goal you give an agent run and how it ended.
- Phone details. We read each phone's list of installed apps and its device details. When a phone is set up, we record the phone's own public IP address, country, city and network. This is about the phone, not about you.
- Live video. Live video of a phone is sent to your browser. For cloud phones it comes from our cloud phone infrastructure providers. When you watch a cloud phone, video software from our cloud phone infrastructure providers connects your browser to their video networks. They receive your IP address, browser details and connection and quality logs. For real iPhones it goes through our video provider, LiveKit. We do not record live video. Our staff can watch a real iPhone's live video, including during your session, to run and fix the robot. Every time they do, it is logged.
- What is on the phone. What you put on a cloud phone, like app logins, files, messages and texts, is stored on the phone itself, with our cloud phone infrastructure providers. We do not keep a separate copy of your app passwords. But screen text and Copilot chats can capture anything that was on the screen or typed by the Copilot.
If the data on your phones includes other people's personal data, you are responsible for having the right to use it that way.
Copilot chats
- We keep your Copilot chats on our servers. A chat is private to the person who started it.
- We store every message, every action the Copilot took, what it typed and the results it got back (including screen text).
- If you delete a chat, it disappears from every view, but its records stay in our database.
API keys and webhooks
- For each API key we store a secure hash of the key, never the key itself, plus its name, its permissions, the phones it may use, who created it, and when it was created, last used, set to expire or revoked.
- If you set up webhooks, we store the web address you give us, the secret used to sign our messages, and the messages we send.
Emails, support and booking a call
- We send emails through Resend: your sign-up code, a welcome email, a note when a phone is ready (sent to everyone in your organization), and notices about orders, spending and phones that need you.
- If you email us, we keep the conversation in our inbox, which runs on Google Workspace.
- If you book a call with us, our booking tool, Cal.com, collects the name, email address and other details you enter.
Technical data
- Our servers use your IP address to limit how many requests can be made. This is held in memory only. It is not saved.
- When you log in to the CLI, we save the IP address of the device asking to log in, so the person approving the login can check it. We delete it once the request has been expired for a day, the next time anyone starts a CLI login. In practice this is usually within a few days.
- We do not keep a request log of our own. Our hosting and sign-in providers (Fly.io, Vercel and Clerk) keep their own logs.
Visitors to our website
Our website, www.phoneuse.com, uses no cookies and no analytics or advertising trackers. It loads fonts from Google Fonts, so your browser connects to Google, which sees your IP address. It remembers your light or dark choice in your browser.
03How we use it
- To provide the service: signing you in, running your phones, showing screenshots and live video, running the Copilot and agents, and delivering API and webhook features.
- For billing: taking payments, working out tax and keeping accounting records.
- To talk to you: sign-up codes, phone-ready emails, notices about orders and your balance, and replies to your messages.
- For safety and security: preventing abuse, protecting accounts and enforcing our terms.
- For support: helping you and fixing problems.
- To improve the service: understanding what works and what breaks.
- To follow the law: tax and accounting rules, and lawful requests.
We do not sell your personal data, and we do not use it for advertising.
Our legal reasons (UK and EEA)
If you are in the UK or the European Economic Area, the law asks us to say why we are allowed to use your data. Our reasons are:
- Contract: we need the data to give you the service you signed up for.
- Legitimate interests: keeping the service safe, fixing and improving it, and keeping records of what happened on a phone, in ways that do not override your rights.
- Legal obligation: for example, keeping billing records for tax law.
- Consent: where we ask for it. You can withdraw consent at any time.
04The AI Copilot and agents
- When you use the Copilot, we send these to an AI model provider: your messages, your recent chat history, text from the phone's screen and screenshots.
- Today the Copilot uses OpenRouter, which passes each request to the company that makes the AI model. For the model we use now, that is OpenAI. Some agent features may also send instructions and screenshots to OpenAI directly.
- These providers handle the data under their own terms and privacy policies.
- A screen can show personal information, yours or other people's. Do not use the Copilot on a screen you do not want an AI provider to see.
- If you connect your own AI tool (such as an MCP client) or your own software through the API or CLI, it receives the screenshots, screen text and action records it asks for. What that tool, and the AI provider behind it, does with the data is between you and them.
06Where your data is
- Our servers and our main database are in the United States.
- Cloud phones run on systems of our cloud phone infrastructure providers. For monthly phones you choose the country when you buy. Per-minute phones run in one location that we choose. Either may be outside your country and outside the United States.
- Our other service providers may also handle data in other countries.
- When personal data moves out of the UK or the European Economic Area, we rely on the transfer safeguards our providers offer, such as the European Commission's standard contractual clauses and the UK's addendum to them.
07How long we keep it
| Data | How long |
|---|---|
| Action records and agent runs | No time limit. |
| Copilot chats | No time limit. Deleting a chat hides it, but its records stay. |
| Billing and order records | Kept, including as long as tax and accounting laws require. |
| Your account profile | Kept by Clerk while your account exists. You can delete your account in Account settings. |
| CLI login requests (with IP address) | Deleted once the request has been expired for a day, the next time anyone starts a CLI login. Usually within a few days. |
| Staff alerts that mention you | No time limit. |
| Short-lived technical records | About 24 hours. |
| Request limits by IP address | Memory only. Never saved. |
| Our providers' logs and backups | Under each provider's own rules. |
Records in our own database that are linked to you or your organization, such as orders, runs and chats, are not deleted automatically when you delete your account or leave an organization. Email us if you want them deleted.
When a cloud phone ends, our default is to have our provider wipe it before it is used again. If it cannot be wiped, we stop using it. We rely on the provider to tell us the wipe is finished.
08Security
- We store only a secure hash of each API key, not the key itself.
- Card details stay with Stripe.
- No system is perfectly secure. If you find a security problem, or think your account or a key has been exposed, email abdulla@phoneuse.com right away.
- If a breach affects your personal data, we will tell you when the law requires it.
09Your rights
Depending on where you live, you may have the right to:
- see the personal data we hold about you, and get a copy;
- correct it if it is wrong;
- have it deleted;
- object to, or limit, how we use it;
- get it in a format you can take elsewhere;
- withdraw consent you have given.
You can delete your own account in Account settings in the console. For anything else, including deleting an organization, email abdulla@phoneuse.com. We may need to check that the request really comes from you. We will reply within the time the law gives us.
Sometimes we must keep data, for example billing records that tax law requires, or data we need to settle a dispute. If so, we will tell you.
UK and EEA
If you are in the UK or the European Economic Area, the GDPR gives you the rights above. Our legal reasons for using your data are in section 3. You can also complain to your local data protection authority, such as the Information Commissioner's Office (ICO) in the UK. We would like the chance to help first, so please contact us.
California
If you live in California, you have the right to know what personal information we collect, use and share, to ask us to delete or correct it, and not to be treated differently for using these rights. You can also ask someone you authorize to make a request for you.
We collect these kinds of personal information: identifiers (such as name, email address, IP address and account IDs), commercial information (orders and payments), internet activity (how you use the service, including actions), and anything shown on your phones' screens. We use it for the purposes in section 3, and share it with the providers in section 5.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
11Children
PhoneUse is not for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, email abdulla@phoneuse.com and we will delete it.
12Changes to this policy
We may update this policy. When we do, we change the "Last updated" date at the top. If a change is important, we will tell you by email or in the console.
13Contact us
Questions about your data or this policy, or a request to use your rights:
Email: abdulla@phoneuse.com
Company: Masta, Inc.