This Privacy Policy explains how personal information is handled in connection with WyoCS Telecom, including website calling, VoIP and SIP services, virtual telephone numbers, hosted PBX, messaging, mobile-data eSIM products, integrations, and optional communications features. It applies to subscribers, their authorized users, people who call or receive calls, and visitors who interact with a WyoCS Telecom calling widget.
Effective date: November 1, 2026. Version: 1.0. Product availability and the processing actually performed depend on the service you order and the features that are enabled. Describing a possible feature in this Policy does not mean it is included in every plan.
1. Responsible companies and contact
WyoCS Global Inc., a Wyoming corporation, operates the WyoCS Telecom platform and is the default service provider for WyoCS Telecom. Its Wyoming registration number is 2026-002104001. Contact us about this Policy, privacy rights, recordings, or a particular processing activity at support@wyocs.org, with “WyoCS Telecom Privacy” in the subject line. Our public mailing details appear in the Telecom Terms and the applicable order.
Wyoming Cloud Solutions LLC, Wyoming registration number 2026-001951042, may distribute, resell, invoice, or support the services under arrangements with WyoCS Global Inc. Its mailing address is 30 N Gould St Ste N, Sheridan, WY 82801, United States. The same support email accepts requests concerning either company and routes them to the responsible entity.
The order, invoice, service agreement, or relevant point-of-collection notice identifies the seller and the company responsible for a particular activity. Each company is a controller for purposes it independently determines, such as its own customer administration, billing, security, and legal compliance. One company may also act as a processor or service provider for the other under a documented arrangement. Affiliation or an internal distribution agreement does not, by itself, make every group company a joint controller, remove a company's legal responsibilities, or authorize unrestricted sharing.
These Telecom-specific disclosures govern Telecom processing. The geographic company allocations in the general WYOCS Privacy Policy do not automatically substitute a different provider or controller for WyoCS Telecom.
2. Business customers, callers, and website operators
A business that subscribes to the service usually determines why it communicates with its staff and customers, whether to enable recording or an AI feature, and how to use the resulting content. For those activities, that business is generally the controller, and the relevant WyoCS entity processes customer communications on its documented instructions. A data processing agreement, where required, supplements this Policy.
We separately determine certain purposes necessary to administer our service, protect our networks, bill for usage, prevent abuse, and meet our own legal duties. Telecommunications, mobile-network, and numbering partners may also have independent obligations concerning traffic, subscriber verification, security, lawful disclosure, and network records. Roles depend on the processing actually performed, not simply on a contractual label.
If you call a business through a widget on its website, that business receives your communication and controls its own subsequent use of it. Read its privacy notice as well as this Policy. A client business's privacy link and a WyoCS Telecom privacy link describe different responsibilities. Ask that business about its recordings, sales follow-up, customer records, or staff access. You may also contact us, and we will identify our role and assist or route your request as appropriate.
3. Categories of information
| Category | Examples and when it applies |
|---|---|
| Subscriber and business details | Name, company, authorized contacts, postal and service addresses, email, telephone number, account identifiers, selected plan, support preferences, and the authority to act for an organization. |
| Verification and number-registration information | Where required for a number, territory, carrier, fraud check, or lawful request: identity and business documents, authorized-user details, proof of address, and information supporting a number's permitted use. We do not require an identity document merely to read this Policy or visit a customer's website. |
| Call and network metadata | Calling and called numbers or extension identifiers, SIP and routing identifiers, timestamps, duration, connection results, transfer and forwarding details, destination country or network, applicable rating information, and technical quality or error information. |
| Communication content | Live audio needed to carry a call. Saved recordings, voicemail, messages, fax documents, transcripts, summaries, and AI inputs or outputs only when the relevant feature is used or content is submitted to us. |
| Widget and browser information | IP address, browser and user-agent information, referring or embedding domain, selected language, session identifier, queue position, call status, and information needed to enforce domain or abuse restrictions. Depending on the integration, additional device or network signals may be supplied as described below. |
| eSIM and mobile-data information | The purchased package, activation and provisioning status, eSIM/profile identifiers, usage totals, network events, and device or subscriber identifiers supplied by the relevant partner. Mobile networks process location and connection information needed for connectivity. We receive the information made available for the particular product, rather than every record held by the mobile network. |
| Billing and payment information | Orders, invoices, taxes, amounts, currency, balance, consumption, renewal or cancellation status, transaction references, and limited payment-method descriptors. Payment processors collect payment credentials through their own secure flows; ordinary support email is not a payment-card submission channel. |
| Security and administration | Login and access events, administrator changes, API identifiers, abuse reports, rate-limit and block information, consent or notice records, support correspondence, and information needed to investigate an incident or establish a legal claim. |
We obtain information from you, your authorized users, people communicating with you, customer integrations, payment and telecommunications partners, and service activity. A telephone number, IP address, audio recording, or device identifier can be personal information even when it does not include a person's name.
4. Purposes and legal grounds
Where data protection law requires a legal basis, we identify the basis applicable to the particular activity. We do not treat acceptance of a privacy policy as blanket consent to every processing purpose.
| Purpose | Basis where GDPR-type rules apply |
|---|---|
| Provide a requested service, account, number, call, eSIM package, or support response | Performance of a contract with the individual, steps the individual requests before a contract, or a legitimate interest in providing services to an organization. Processing on a business customer's behalf follows that customer's instructions and applicable agreement. |
| Route communications, maintain quality, prevent misuse, and secure accounts and networks | Relevant legal obligations and proportionate legitimate interests, subject to communications confidentiality and device-access rules. A separate consent or other authorization is obtained where those rules require it. |
| Verify subscriber identity, number eligibility, and required service location | Applicable legal obligations and, where appropriate, legitimate interests in preventing fraud and ensuring lawful service provisioning. |
| Calculate charges, process payments, maintain accounts, and handle disputes | Contract, legal recordkeeping duties, and legitimate interests in administering and defending the relationship. |
| Enable recording, transcription, AI assistance, analytics, or other optional processing | The lawful instructions of the customer and the basis required for the particular purpose, including consent where required. Purchasing an add-on does not establish a legal basis for processing every caller's information. |
| Send optional marketing or operate nonessential tracking | Consent or another basis specifically permitted by applicable marketing law. An objection, withdrawal, or opt-out is honored as required. |
| Comply with lawful requests and protect legal rights | Applicable legal obligations and establishment, exercise, or defense of legal claims. |
For corporate accounts, an employee or caller is not automatically a party to the customer's service contract. We therefore do not automatically apply the contract basis to every person whose information passes through the service. Consent, when relied on, may be withdrawn; withdrawal does not retroactively invalidate earlier lawful processing.
5. Website calling and microphone access
A calling widget may be loaded from WyoCS Telecom infrastructure while you browse another company's website. Loading that component can disclose your IP address and request information to the infrastructure serving it, before you start a call. Opening the calling window can also provide the embedding domain, language, and branding information needed to display the correct business and apply its configuration.
When you ask to call, the browser may request microphone permission. Audio is used to connect and carry the call. The service processes a session identifier and status information to manage ringing, queues, connection, and hangup. Operator availability, configured business hours, your browser, and your internet connection can affect the result. Closing a window or revoking microphone access can interrupt a call.
Allowing microphone access is permission for the browser to use that device. It is not, by itself, consent to save a recording, perform optional AI analysis, send marketing, or collect nonessential device information. The called business must provide any additional notice and obtain any consent required for its selected features.
A “free online call” label concerns the visitor-facing calling feature described in the offer. Your internet or mobile-data provider may still charge for connectivity. Merely clicking a customer's call button does not purchase a subscription or a telephone number from WyoCS.
6. Optional paid recording, transcription, and AI features
Call recording, automated transcription, AI operators, summaries, and speech-analysis functions are optional paid extras where offered. A customer must order and activate the relevant feature. We do not describe them as automatically included in every ordinary call or account.
Live audio may need to be transmitted and temporarily processed to carry a call even when a saved-recording feature is not enabled. Voicemail and a deliberately submitted audio attachment are also different from recording every live call. An AI interaction may process audio and produce text even if the customer does not keep a separate audio recording.
Before recording or other optional content processing begins, the customer is responsible for clear notices, legally required permissions, staff-monitoring requirements, and an appropriate alternative where required. We are responsible for notices and processing that we independently control. A customer instruction or an acceptance checkbox in its WyoCS account does not replace consent that the law requires from another participant.
When enabled, selected content may be sent to speech recognition, speech synthesis, AI, storage, or communications partners needed for the feature. The applicable service documentation or data processing agreement identifies the relevant arrangements. We do not promise that every external AI service has identical retention, training, or regional-hosting terms. A customer must not activate a feature for regulated or sensitive content without the necessary agreement and safeguards.
We use customer communications to provide, secure, support, and lawfully administer the requested service. These functions do not authorize unrelated advertising use of call content or unrestricted training of general-purpose models. Any separate use requiring additional permission must have that permission and the required disclosures. Transcripts, translations, summaries, classifications, and AI responses can be inaccurate and must be checked before consequential use.
7. Device signals, browser storage, and abuse controls
Depending on the integration and enabled safeguards, the service may receive device or network signals such as a client-supplied device identifier, local WebRTC network information, screen characteristics, processor-concurrency information, canvas or audio signatures, and graphics-renderer information. Not every integration supplies every signal. A session-generated random identifier is different from a persistent device fingerprint.
Cookies, local or session storage, and techniques that access information on a device are assessed under the rules applicable to that technology. Where a measure is strictly necessary to provide a communication expressly requested by the user or to meet a legally recognized security exception, the relevant exception may apply. Otherwise, any required prior consent must be obtained before the measure is used. A general reference to fraud prevention does not automatically exempt all fingerprinting or tracking from consent requirements.
Optional analytics, advertising, and marketing tracking are not conditions for making a basic widget call. The Telecom widget is not intended as a cross-site advertising tracker. The client website may have its own cookies, analytics, consent manager, or advertising tools, for which its operator is responsible.
IP-derived location, VPN indicators, and automated abuse scores can be incomplete or wrong. They are not reliable proof of a person's identity, physical location, misconduct, or emergency-service address. If a restriction prevents legitimate use, contact the relevant business or us for review.
8. Who may receive information
Access and disclosures are limited to the purposes described in this Policy and may involve:
- the business or person you communicate with, its authorized staff, and administrators of the relevant account;
- WyoCS Global Inc., Wyoming Cloud Solutions LLC, and authorized personnel or contractors to the extent required by their actual operating, distribution, support, billing, or processing roles;
- telecommunications, numbering, SIP, interconnection, mobile-network, eSIM, routing, messaging, and fraud-prevention partners;
- hosting, infrastructure, authentication, communications, storage, payment, and professional-service providers;
- AI, transcription, voice, analytics, or CRM partners for features actually selected and lawfully enabled;
- public authorities or other recipients where disclosure is legally required or otherwise lawful and necessary to protect rights, safety, or service security; and
- a party to a proposed business transaction, subject to appropriate confidentiality and any required notice or other legal safeguards.
A partner may act as a processor under instructions or as an independent controller for its own legal duties. Public category descriptions do not replace any obligation to identify an actual controller or authorized subprocessor. Relevant identities, locations, and processing details are provided in the applicable contractual, regulatory, or data-processing disclosures when required. A business customer can request the information needed to assess its processing arrangements.
We do not sell call content or identity documents. Service delivery, lawful carrier routing, and necessary disclosure to an authorized partner are not a license to trade that information for unrelated purposes.
9. International processing and communications
WyoCS Global Inc. and Wyoming Cloud Solutions LLC are United States entities. Service delivery and support may involve personnel and infrastructure in the United States, Bulgaria or other European locations, and countries involved in the chosen destination, number, mobile network, or partner service. A global call may cross several networks. Buying a number associated with one country does not guarantee that all related information stays in that country.
Where a restricted international transfer requires a safeguard, the relevant parties must put an applicable mechanism in place, such as a valid adequacy decision, appropriately completed standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another mechanism permitted by the relevant law. Necessary assessments and supplementary safeguards depend on the particular transfer. United States incorporation alone is not a transfer safeguard.
We do not claim in this Policy that either WyoCS company is certified under a data privacy framework or that an international transfer agreement has been signed merely because this Policy is available. Contact us for information about the safeguards applying to your service and a copy or description, subject to appropriate redaction of confidential information.
10. Retention and deletion
Retention depends on the record, the service configuration, customer instructions where we act as processor, legal duties, and a documented need to investigate an incident or resolve a claim. An applicable data processing agreement or service schedule may set more specific periods. We do not treat an account's closure as permission to retain all communications indefinitely.
| Record | Retention approach |
|---|---|
| Core PBX audio recordings, if enabled | The configured recording period. The standard PBX administrative setting at this Policy's effective date is 30 days, subject to an agreed different setting, an applicable legal requirement, or a justified preservation hold. |
| Core PBX call history and call events | The configured operational-history period, presently 90 days under the standard setting. Audio removal and metadata removal are separate operations. |
| Core PBX administrative audit events | The configured audit period, presently 180 days under the standard setting, except where a longer preservation duty applies. |
| Widget sessions, abuse records, and block rules | For the period needed to establish and support the call, prevent or investigate repeated misuse, maintain an appropriate restriction, and handle related disputes. Core PBX history settings are not a promise that every separate widget or security record is erased on the same schedule. |
| AI content, transcripts, voicemail, messages, fax documents, and exports | The period disclosed for the selected feature, the customer's lawful instructions and agreement, and applicable preservation requirements. Separate partners and customer-exported copies may have different lawful retention responsibilities. |
| Verification, billing, tax, and contractual records | For applicable registration, accounting, tax, fraud, and legal-claim requirements. These records can need to remain after audio deletion or account termination. |
| Backups and disaster-recovery copies, if maintained | Until the relevant backup cycle expires, with access limited to recovery, security, or legal needs. If data is restored, applicable deletion or suppression instructions must be applied again where required. |
The stated PBX periods describe its standard configuration, not a universal retention rule for every carrier, add-on, or statutory record. Customers should confirm the schedule for their selected features before enabling them. We can explain the applicable period or the criteria used to determine it. Requests for deletion, restriction, or an export are considered under our role, the customer's instructions, and applicable law.
11. Security and communications confidentiality
We use safeguards appropriate to the service and risk, including access restrictions, authentication, account separation, protected administrative interfaces, logging, and measures to secure storage and transport. The customer must manage its users, devices, SIP credentials, API access, authorized website domains, and exported copies.
Internet telephony can involve a browser, a PBX, mobile or telephone carriers, and the public switched telephone network. Encryption on one connection does not establish end-to-end encryption across every leg or prevent an authorized endpoint from accessing content. No service can promise absolute security or uninterrupted confidentiality regardless of endpoint compromise, a lawful disclosure duty, or the networks involved.
Report suspected compromise promptly to support@wyocs.org. Please describe the incident without emailing passwords, payment-card security codes, eSIM activation secrets, or unnecessary identity documents. We make legally required breach notifications and assist business customers with their own duties as applicable.
12. Your privacy rights
Depending on the applicable law and our role, you may request access and a copy, correction, deletion, restriction, portability, information about recipients or transfers, or withdrawal of consent. You may object to processing based on legitimate interests and to direct marketing. Some laws also provide rights concerning certain automated decisions, sale or sharing, or profiling. A right applies subject to its legal conditions and exceptions; we do not claim that every right applies identically in every country.
Send a request to support@wyocs.org. Identify the service and, if relevant, the business, call date, or account needed to locate the information. Do not include a password or an entire identity document unless we arrange a necessary, proportionate verification method. An authorized agent may act where permitted by law.
Where GDPR or UK GDPR applies, the usual response period is one month, subject to a lawful extension and notice. Where another law sets a different period or appeal process, that law applies. If we are a processor for a customer, we generally refer the request to that controller and assist it rather than independently overriding its lawful instructions. We will explain a lawful refusal, limitation, or retention exception as required.
You can complain to the competent data protection authority, including the authority for your habitual residence, workplace, or the alleged infringement where the law provides that right. An applicable right to complain is not conditional on first obtaining our permission. Contact us for details of any representative or other contact required for the processing in question; this Policy does not claim that an unspecified representative or data protection officer has already been appointed.
13. Marketing, automated restrictions, and sensitive information
Calling a business, holding a virtual number, buying an eSIM, or enabling microphone access does not automatically authorize promotional calls or messages. Marketing preferences and legally required consent are managed separately. Operational or legally necessary service notices may still be sent.
Security systems can apply rate limits, queue restrictions, or abuse blocks. If a restriction affects you, you can seek review through support. This Policy does not authorize solely automated decisions with legal or similarly significant effects without the safeguards required by applicable law.
Do not intentionally submit sensitive or regulated content to a general-purpose communications feature unless the relevant service and agreement support that use. Ordinary voice is not automatically a biometric identifier, but using voice to identify a person can involve additional legal requirements. Voice cloning, biometric identification, or a high-risk use requires a separate, lawful and adequately safeguarded arrangement; an ordinary AI add-on does not authorize it.
14. Children and other people's information
Telecom subscriptions are intended for persons who can enter the relevant contract and authorized business representatives. The services are not designed as a child-directed platform. A business operating a service for children must disclose that fact and agree on the required safeguards before using our processing features. If you believe a child has supplied information inappropriately, contact us so we can assess the situation and take the action required by law.
People communicating with you may choose to share personal information during a call. You remain responsible for how you collect, use, disclose, and retain that information in your own systems. A caller's voluntary statement does not authorize unrelated processing of it.
15. Changes and related documents
We update this Policy when services, processing arrangements, or legal requirements change. We identify the updated version and give additional notice when required. A new notice does not retroactively create consent for an incompatible purpose or erase an existing contractual protection.
Read this Policy together with the WyoCS Telecom Terms of Service, the relevant order and service disclosures, the customer's own notice where it controls a communication, and any applicable data processing agreement. Contact: support@wyocs.org.