Privacy Policy
Last updated: 24 October 2026. Softphone is provided by Cerdik (“we”).
What we collect
- Account details your organisation gives us: name, email or username, role, and phone extension.
- Contacts your team saves in the shared directory.
- Messages sent between teammates inside Softphone.
- Call history: who was called, direction, time and duration. We do not record or store call audio.
- Presence (whether you are online or on a call) and Do Not Disturb status.
- Device push-notification tokens, so incoming calls and messages can reach your phone.
- Basic server logs (such as IP address and time) needed to run and secure the service.
How we use it
Only to provide the service: connecting your calls, showing your team's directory, history and messages, sending notifications, preventing abuse and supporting you. We do not sell personal data and we do not use it for advertising.
Microphone, camera and notifications
The microphone is used only during calls. The camera is used only during video calls. Audio and video are sent between participants and are not recorded by us. Notifications are used for incoming calls and messages.
Who it is shared with
- Your organisation's administrators, who can see its users, contacts and call history.
- Service providers that deliver the service: our hosting provider, Apple and Google (push notifications), and an email provider for sign-in links.
- Your organisation's own phone system (PBX), which carries the calls.
- Authorities, only where the law requires it.
Security
Traffic is encrypted in transit. Passwords are hashed and stored extension credentials are encrypted. Each organisation's data is kept separate. No system is perfectly secure, and we will tell affected customers promptly if a breach affects them.
Keeping and deleting data
Data is kept while your organisation uses Softphone. Administrators can remove users and contacts at any time. To have your data deleted or exported, email stevenlim@cerdik.co. We will respond within 30 days.
Your rights
You can ask to access, correct or delete your personal data. Because your organisation controls its account, we may refer your request to it.