This document is provided in English.
Privacy Policy
Provided by Elefa Mobile Pty Ltd, ABN 16 694 346 088, Melbourne, Australia.
Version 3.3 · Effective 13 September 2026
In short. We collect what the service needs: your number, your email, your call and payment records, your device details. We use them to run the service, bill you, keep you safe and answer you. We do not sell your information. Contacts you pick stay on your phone. You can see, correct or delete what we hold.
1. Who we are
Elefa Mobile Pty Ltd provides elefa Connect and is bound by the Australian Privacy Principles in the Privacy Act 1988. Our Privacy Officer: [email protected].
2. What we collect
Account: your mobile number, your email address, your display name and language.
Payments: top-up amounts, currency, card type and last four digits, and the history of credit, refunds and chargebacks. Card numbers go directly to Stripe and never touch our systems.
Calls: the number called, your caller ID, start and end time, duration, route and cost. We do not record call audio.
Credit transfers: sender, recipient, amount, time and the balances before and after.
Contacts: when you use Contacts to pick a number, your phone's own picker opens and the number you pick is used for that action. When you match contacts to find friends on elefa, the app sends a one-way SHA-256 hash of each phone number, never the number itself and never the name. Your contact list is not stored on our servers.
Device and network: device model, operating system, app version, IP address, approximate location from the IP, network type, and push notification tokens.
Diagnostics: crash reports and call quality measurements.
Identity: where the law or our security rules require verification for higher limits, the identity information you provide and the result.
Website: the site uses cookies for sign-in and basic analytics; you can control non-essential cookies in the banner.
3. Why
To run your account and connect your calls; to bill you and process payments and refunds; to send service messages; to send updates unless you opt out; to detect and prevent fraud, including patterns across accounts; to support you and handle complaints; to improve the service; and to meet legal obligations.
4. Who receives it
We do not sell your information. It goes to those who need it to provide the service:
- Interconnect carriers: the number called, your caller ID, and call timing, to connect the call.
- Stripe, for payments and disputes.
- Twilio, for the SMS and WhatsApp codes that verify your number and for invitations you send.
- Resend, for email.
- Firebase, for crash reports and push notifications; Apple and Google, for push delivery.
- Supabase, our database and authentication provider, hosted in AWS eu-north-1, Stockholm, Sweden.
- Identity verification providers, where verification applies.
- Professional advisers under confidentiality; courts, regulators and law enforcement where the law compels or permits it; a buyer or successor in a corporate transaction, under this policy.
Some of these providers operate outside Australia. We take the steps the Australian Privacy Principles require before information leaves Australia.
5. Security
Encryption in transit between your device and our network, encryption at rest, access limited to staff who need it, multi-factor authentication for staff, logging and monitoring, and a tested incident response. If a breach is likely to cause serious harm we notify you and the Commissioner under the Notifiable Data Breaches scheme.
6. How long
Account information while your account is open and 12 months after; call records 2 years; payment and credit transfer records 7 years; identity verification records 7 years after the relationship ends, where collected; support correspondence 3 years; security logs 24 months. After that, deleted or de-identified.
7. Your rights
You can access the information we hold about you, correct it, opt out of updates, close your account and ask for deletion of what we are not required to keep, and complain. Write to [email protected]; we respond within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992.
8. Government requests
We require valid legal process before disclosing account information, except in an emergency involving imminent risk to life, as the law permits.
9. Children
The service is for people 18 and over. We do not knowingly collect information from anyone younger; tell us and we will delete it.
10. Changes
Material changes are notified before they take effect. The version and date at the top are current.
11. Contact
Privacy Officer, Elefa Mobile Pty Ltd, Melbourne, Australia. [email protected].