Privacy Policy

This Privacy Policy explains how Oncallz ("we", "us") collects, uses and protects information when you use the Oncallz web application, the Oncallz mobile apps and this website (together, the "Service"). Oncallz is an on-call scheduling, incident alerting, escalation and notification platform for engineering and operations teams. The Turkish version of this page also serves as the KVKK information notice (Aydınlatma Metni), and a KVKK section is included below.

Who operates Oncallz and who is responsible for your data?

Oncallz is operated by the Oncallz team. We have not yet registered a separate legal entity for the Service; when we do, this section will name it. Until then, you can reach the people responsible for your data at support@oncallz.com, for any privacy question or request.

Oncallz is used by organizations (each one a separate "workspace" or tenant). The organization decides who it invites, which monitoring tools send alerts, and which optional features and providers it turns on. For the content an organization puts into its workspace, such as incidents, alert payloads, schedules and comments, we process data to provide the Service to that organization.

What information do we collect?

• Account information: your name, email address, password (stored only as a hash), language preference, your role, and the organization you belong to. Used to create and secure your account.
• Phone number: if you choose to add one. Used only to verify the number and to deliver SMS and voice incident pages and on-call notices.
• Device push tokens: when you enable notifications, we store the push token issued by Apple (APNs) or Google (FCM) so we can deliver incident alerts to your device.
• Incident and operational data: incidents, alert payloads sent by your organization's monitoring tools, comments, acknowledgements, on-call schedules, escalation policies, post-mortems and related activity created within your organization.
• Sign-in history: the time, IP address and browser or device (user agent) of sign-ins to your account, used for security.
• Configuration and credentials: settings your organization's administrators enter, including credentials for the organization's own SMS/voice provider and AI provider. These credentials are stored encrypted.
• Billing information: if your organization subscribes, the subscription status, seat count, the organization's name and the billing contact's email. Card and payment details are entered on Lemon Squeezy's checkout and are processed by Lemon Squeezy, not stored by us.
• Technical data: basic request and log information (such as IP address, browser type and error details) needed to operate and secure the Service.

How do we use information?

• To deliver incident notifications by push, SMS, voice call and email, and to escalate them according to your organization's settings.
• To authenticate you and keep your account and organization data secure and isolated per tenant.
• To provide on-call scheduling, incident triage, analytics, reporting and the other features your organization uses.
• To send service emails, such as verification, invitations, password resets, on-call reminders and digests.
• To handle billing for organizations that subscribe.
• To operate, maintain, troubleshoot and improve the Service, and to prevent abuse.

We do not sell your personal information, we do not use it for advertising, and we do not use your incident data to train AI models.

What are the legal bases for processing?

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on these legal bases:

• Performance of a contract: to provide the Service you or your organization signed up for, including account, notification, scheduling and billing processing.
• Legitimate interests: to keep the Service secure (for example sign-in history, rate limiting and audit logs), to prevent abuse and to fix problems. We weigh these interests against your rights.
• Legal obligation: where we must keep or disclose information by law.
• Consent: for optional processing that you choose, such as allowing push notifications on your device. You can withdraw consent at any time, for example in your device settings.

Does Oncallz send my data to an AI provider?

Only if an administrator of your organization turns on AI features. They are off by default. To enable them, the administrator enters the organization's own API key for the AI provider; the organization has its own account and agreement with that provider, and Oncallz has no platform-wide AI key that it uses instead. Today the supported provider is DeepSeek.

When enabled, the following is sent to the AI provider using the organization's key:

• AI incident investigation: the incident's title, description, severity, source and the raw alert payload received from the monitoring tool.
• Duplicate-incident analysis (started by an administrator): recent alert titles.
• Team scheduling analysis (started by a team lead): a snapshot of the team's schedules, rotations and escalation setup, which can include members' names.
• Daily digest briefing: the organization's name and the previous day's incident statistics.

Oncallz stores the prompts and responses of these requests in your workspace so administrators can review the request history and cost. Alert payloads can contain whatever your monitoring tools put in them, so review what your integrations send before enabling AI features. DeepSeek's privacy policy states (as of September 2026) that it processes and stores data in the People's Republic of China.

How are SMS and phone calls handled?

SMS and voice pages are sent through your organization's own provider account: SMS through Twilio or Vonage, and phone calls through Twilio. That provider receives the recipient's phone number and the message or call content (such as the incident title) and processes them under your organization's agreement with it. Carrier charges are billed by that provider directly to your organization.

Phone-number verification is different: it uses Oncallz's Twilio Verify account. Twilio receives the number being verified, generates and delivers the one-time code and checks it; we do not see the code.

Which service providers process data for us?

We share the minimum data necessary with providers that help us deliver the Service:

• Hetzner Online GmbH: hosts our application servers in Germany.
• Cloudflare: sits in front of oncallz.com as a content delivery network and proxy, terminates HTTPS and protects against attacks. It processes request data such as IP addresses.
• Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM): deliver push notifications to your devices.
• Twilio (Oncallz's account): phone-number verification through Twilio Verify.
• Our email delivery provider: sends service emails such as verification, invitations, password resets and notifications.
• Lemon Squeezy: our reseller and merchant of record for subscriptions. It runs the checkout, processes payments, calculates and collects sales tax or VAT, and issues invoices. It processes billing details under its own privacy policy.

In addition, your organization may choose to send data to providers it controls: its own Twilio or Vonage account (SMS and voice), its AI provider (see above), Slack or Microsoft Teams channels, and outbound webhook destinations. Your organization can also publish a read-only status board or public incident reports. What is sent to those destinations follows your organization's configuration.

Is data transferred to other countries?

Our application servers are in Germany, in the European Union. Some of the providers listed above, including Cloudflare, Apple, Google, Twilio, Vonage, Lemon Squeezy and the AI provider your organization chooses, may process data in other countries, including the United States and, for DeepSeek, China. Using these providers means personal data can be transferred outside the European Economic Area and outside Turkey. We use such providers only to the extent needed to deliver the features you or your organization use.

How long do we keep data?

• Account and incident data are kept for as long as your organization maintains an active account.
• When you delete your account, your personal account data is deleted from our live systems immediately. Incidents and activity stay with your organization, unattributed. See Delete Your Account and Data for exactly what is removed and kept.
• When an organization's last member deletes their account, the whole workspace and its data are deleted.
• Residual copies may persist in encrypted operational backups until those backups age out on their normal rotation.
• We keep records longer only where the law requires it. Billing records are kept by Lemon Squeezy under its own obligations.

Does Oncallz use cookies?

We use only cookies that are strictly necessary for the Service to work: a session cookie that keeps you signed in and an XSRF-TOKEN cookie that protects forms against cross-site request forgery. We do not use analytics, advertising or tracking cookies, and we do not load third-party analytics scripts. This website stores one preference in your browser's local storage if you dismiss the language suggestion banner.

What are your rights?

Depending on where you live, and in particular under the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected (you can edit most account details yourself in your profile);
• have your data deleted (you can delete your account yourself at any time, in the app under More → Delete account or on the web from your profile);
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

You can also disable push notifications in your device settings and remove your phone number from your profile to stop SMS and voice pages. If your account belongs to an organization, some requests about workspace content may be handled together with that organization's administrators. To exercise any right, email support@oncallz.com from the address associated with your account.

Information for users in Turkey (KVKK)

This section is provided under Turkey's Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, "KVKK"). The full Turkish notice is available on the Turkish version of this page.

• Data controller: the Service is operated by the Oncallz team, reachable at support@oncallz.com. We will publish the registered entity's details here once it is established.
• Data processed and purposes: as described in the sections above.
• Legal grounds (KVKK Article 5): processing is necessary for the establishment and performance of a contract, for compliance with legal obligations, and for our legitimate interests, provided your fundamental rights are not harmed; explicit consent is requested where the law requires it.
• Method of collection: electronically, through the web app, the mobile apps, integrations your organization configures, and emails you send us.
• Transfers: to the service providers and organization-configured destinations listed above, some of which are located abroad, as described under “Is data transferred to other countries?” above.
• Your rights (KVKK Article 11): to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether data is used for that purpose; to know the third parties in Turkey or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions of Article 7; to request that correction or deletion be notified to third parties to whom the data was transferred; to object to an outcome against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing.
• How to apply: email support@oncallz.com from the address associated with your account, stating your name and your request. We will respond as soon as possible and within 30 days at the latest, as required by KVKK Article 13. You may also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

Children

The Service is a business tool for engineering and operations teams. It is not directed at children, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy as the Service changes. The date at the top of the page shows the latest revision. If a change materially affects how we use personal data, we will tell account owners by email or in the app before it takes effect.

Contact

For privacy questions or requests, contact us at support@oncallz.com.