Privacy Policy

1. Controller

The controller for BurnDial platform data is Kirina Solutions Oy, business ID 3209839-9. Burn Dial Ltd is listed as BurnDial's UK company contact for UK operations where applicable. A participating business may also be an independent controller for the customer relationship, advice, support, or service it provides through BurnDial.

• Contact: info@burndial.com
• Address: Kirina Solutions Oy, Nuottaniementie 7 A 1, 02230 Espoo, Finland

2. Personal Data We Collect

The data we collect depends on how you use BurnDial.

• Customer data: phone number, optional email, selected business or creator, wallet balance, payment status, receipts, support messages, and access tokens used to keep the wallet session secure.
• Call metadata: call IDs, service number, creator or business, timestamps, connection status, duration, billing amount, route type, and technical diagnostics. BurnDial does not record call audio unless this is clearly disclosed before recording.
• Payment data: Stripe customer ID, PaymentIntent ID, payment method type, card last four digits, tokenized wallet or card reference where available, extension capability, amounts, currency, refunds, chargebacks, and related metadata. Full card numbers are handled by Stripe, not BurnDial.
• Business and creator data: company name, company ID, owner name, owner email, owner phone, profile details, pricing, availability, service numbers, business currency, Stripe Connect onboarding status, payout and ledger data, and support communications.
• Technical data: IP address, device/browser information, cookies, logs, approximate country from request headers, security events, and analytics needed to operate and improve the service.
• Visit source data, when a participating business measures where its customers come from: the campaign tags in the link you followed (utm), the referring website, the landing page and the time of the click. Only with your consent, it also includes the ad click identifier set by Google or Meta (gclid, gbraid, wbraid or fbclid). We link this to a random visit ID and to the checkout steps reached: opened the widget, entered a phone number, started paying, payment failed, paid. When you top up, we record the source once for that business, with your phone number and the amount and currency of that top-up, and it is attached to your payment at Stripe. Visit source data never includes your name, email address, messages or card details.

3. Why We Use Personal Data

• To create and manage customer wallet balance and call credit.
• To process payments, refunds, chargebacks, receipts, and saved-card call extensions.
• To connect calls through Twilio and show call status, history, and dashboards.
• To verify phone numbers, prevent unauthorized wallet access, fraud, and abuse.
• To provide customer support and resolve billing or technical issues.
• To show relevant service provider information to customers in legal, checkout, receipt, and support contexts.
• To meet legal, tax, accounting, security, and regulatory obligations.
• To improve product reliability, diagnose errors, and measure service performance.
• To measure which ads, campaigns and links bring paying customers to participating businesses, and to report those top-ups to the business's Google Ads account.

4. Legal Bases

We process personal data under the legal bases that apply to the specific activity, including contract performance, legitimate interests, legal obligations, and consent where required. Consent is used, for example, when a customer chooses to save or reuse a card for eligible future in-call extensions.

Ad click identifiers are stored, and visit source data is kept in your browser, only with your consent, which you can withdraw at any time (section 8). Without consent, visit source data without the ad click identifier is used only during the same visit and recorded with your payment, based on our and the participating business's legitimate interest in knowing which marketing brings customers.

Reports of top-ups to a participating business's Google Ads account (section 5) are based on our and the business's legitimate interest in knowing which advertising brings customers. Without your consent to optional cookies, they are made without Google cookies.

5. Sharing Personal Data

We do not sell personal data. We share data only when needed to run BurnDial, comply with law, or resolve disputes.

• Stripe for payment processing, saved payment methods, refunds, chargebacks, fraud checks, and Connect payouts.
• Twilio for phone calls, WebRTC calling, SMS verification, call routing, and telecom diagnostics.
• Supabase and hosting providers for database, authentication, storage, logs, and application hosting.
• Google (Google Ads), when a participating business advertises with Google and conversion reporting is switched on for it, so that Google can tell which ad clicks led to top-ups. Your first top-up at that business is reported from your browser, with a conversion ID derived from the payment, the amount and the currency. If you came through one of its Google ads, your later top-ups are listed in a file that the business's Google Ads account fetches regularly: the ad click identifier, an ID for each top-up, its time and its amount, for 90 days after the click. Reports never include your name, phone number, email address or balance. Google describes its use of this data at policies.google.com/technologies/partner-sites.
• Participating businesses and creators for call handling, receipts, dashboards, customer support, and service delivery.
• Professional advisors, authorities, banks, card networks, or dispute processors when needed for legal, tax, accounting, fraud, or chargeback matters.

6. International Transfers

Some providers may process data outside Finland, the EU, EEA, or the UK. Where required, transfers are protected through appropriate safeguards such as standard contractual clauses, provider data processing terms, or other lawful transfer mechanisms.

7. Retention

We keep personal data only as long as needed for the purposes described in this Policy. Customer wallet balance and related account data are kept while the balance remains available for use and for a reasonable period afterward, then deleted or anonymized when no longer needed. Payment, call, ledger, tax, accounting, support, fraud, and dispute records may be kept longer where necessary to comply with law, resolve chargebacks, prove transactions, or protect legal rights.

Visit source data saved in your browser expires after 90 days.

8. Cookies and Similar Technologies

BurnDial uses essential cookies and similar technologies for authentication, locale, payment return flows, customer wallet access, security, and embedded widget operation. We may also use limited analytics to understand performance and reliability.

If you accept optional cookies ("Accept all" in our cookie notice, or advertising cookies in a participating business's own cookie settings), pages hosted by BurnDial and the BurnDial widget on the business's website save where your visit came from in your browser for 90 days: the ad click identifier, campaign tags, referring website, landing page and time of the click. A top-up made on a later visit can then be credited to the ad or link that brought you. Without that consent, nothing is saved in your browser for this purpose, and the source of the current visit, without the ad click identifier, is used only during that visit.

On a business page hosted by BurnDial whose business advertises with Google, Google's tag (Google Ads) loads only after you accept optional cookies. Google can then recognise the ad you clicked and may set its own advertising cookies. When you make your first top-up, the payment confirmation page reports it to the business's Google Ads account (section 5); if you have not accepted optional cookies, it still sends that report, without Google cookies. Google receives your IP address and browser details with each of these requests. On a business's own website, the BurnDial widget can pass the same report to that website's own Google tag or Google Tag Manager, and that website's privacy policy and cookie settings apply.

On a business page hosted by BurnDial, you can change your choice at any time from the "Cookie settings" link at the bottom of the page. On a business's own website, use that website's cookie settings. Withdrawing consent deletes the saved source from your browser and stops further collection. Information already recorded with a payment stays.

Browser settings may block some cookies, but this can affect payment return flows, embedded wallet access, and login sessions.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict, object to, or receive a copy of your personal data. You may also withdraw consent where processing is based on consent.

• Send privacy requests to info@burndial.com.
• We may need to verify your identity before acting on a request.
• You can complain to your local data protection authority, including the Finnish Data Protection Ombudsman or the UK Information Commissioner where applicable.

10. Security

We use technical and organizational measures intended to protect personal data, including access controls, provider security controls, and limited access to sensitive operational data. No online or telecom system can be guaranteed to be completely secure.

11. Children

BurnDial is not intended for children. Customers must be at least 18 years old, or the age of majority required in their country if higher, to buy call credit or use paid call services through BurnDial.

12. Changes

We may update this Privacy Policy as BurnDial changes. The latest version is published on this page.