Legal

Privacy Policy

Last updated: 5 November 2026

This Privacy Policy explains how CMPM (“CMPM”, “we”, “us”) collects, uses, stores and protects personal data when you use the CMPM Android app and the website at https://cmpm.app (together, the “Service”).

1. Data controller

The data controller for the Service is the operator of CMPM. You can contact us at [email protected].

2. Data we collect

• Account data: display name, email address, password (stored only as a salted hash), bio, category, profile picture (if you add one), price per minute and availability status.
• Device and connection data: device identifier and name, platform, app version, IP address, SIP registration times and a SIP credential derived from your password (a hash, not the plain password).
• Call records: who called whom, start and end time, duration, call status (answered, missed, declined, failed), and the price and amount charged. We do not record, listen to or store the content of your calls.
• Wallet and payout data: balance, top-ups, withdrawals, and the payout details you save for bank transfer (account holder, IBAN, SWIFT/BIC), USDT (TRC20 address) or Bitcoin (BTC address).
• Contacts: the names, public IDs and notes you choose to save in the app, together with publicly available profile information of those users.
• Diagnostics: if you press “Send logs”, we receive a technical log (PJSIP/SIP log, crash trace, device model, Android version and app version). Logs are only sent when you explicitly ask for it.
• Permissions: microphone and camera access are used only while a call is active. Camera frames are processed for the video call and are not stored.

3. How we use data

• to create and operate your account and public profile;
• to establish, route and bill app-to-app audio and video calls;
• to calculate charges, credit earnings, process top-ups and withdrawals, and keep accounting records;
• to prevent fraud, abuse, spam and misuse of the Service;
• to provide support and diagnose technical problems (including crash logs you send);
• to comply with legal, tax and accounting obligations.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the Service and billing), legitimate interests (security, fraud prevention, service improvement), consent (microphone/camera and optional diagnostics), and legal obligation (tax and accounting records).

5. Sharing

We do not sell personal data. We share data only with:

• our hosting and SIP/media server provider, which processes call signalling and media;
• Cloudflare, which provides CDN, DNS and TLS protection for the website and API;
• banks and payment/payout providers, to the extent needed to process top-ups and withdrawals;
• authorities, when required by law or to protect our rights.

6. Retention

Account and profile data are kept while your account is active. Call and billing records are kept for as long as required for accounting, tax and dispute resolution (normally up to 10 years). Technical logs you send are kept only as long as needed to diagnose the issue. When you delete your account, we delete or anonymise personal data that we are not legally required to keep.

7. Security

We use TLS for the website/API and for SIP signalling, SRTP for call media where supported, hashed passwords and restricted access to production systems. No system is perfectly secure; please use a strong, unique password.

8. International transfers

Our servers and service providers may process data inside and outside the European Economic Area. Where data leaves the EEA, we use appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

9. Your rights

You may request access, correction, deletion, restriction or portability of your data, or object to processing, and you may withdraw consent at any time. Contact [email protected]. You also have the right to lodge a complaint with your local supervisory authority (in Bulgaria, the Commission for Personal Data Protection).

10. Children

The Service is intended for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from children.

11. Deleting your account

You can request deletion of your account and personal data at any time via the Delete account page or by emailing [email protected] from the email address registered to your account. We will process the request within 30 days, subject to records we must keep by law.

12. Changes

We may update this policy from time to time. The “Last updated” date above shows the current version. Material changes will be announced in the app or on this page.

13. Contact

CMPM — [email protected] · [email protected]