App Privacy Policy

ListenApp is a restricted-access safeguarding support platform made available through approved partner organisations supporting individuals who may be at risk of abuse or harm.

The application enables users to discreetly activate pre-configured alert messages to trusted contacts using voice triggers or manual activation features.

ListenApp is designed as a support tool only. It is not an emergency service and does not replace police, medical, safeguarding, or crisis support services.

ListenApp is designed using a data minimisation approach wherever reasonably possible.

ListenApp has been designed to minimise the amount of personal data processed centrally by ListenApp systems.

In particular:

• voice trigger detection operates locally on the user’s device
• audio recordings remain stored within the application environment on the user’s device
• ListenApp does not remotely monitor conversations or process continuous live audio streams
• ListenApp does not operate real-time user surveillance or tracking
• ListenApp does not store audio recordings on its servers

We only process the minimum information necessary to provide alert delivery and limited safeguarding-related functionality.

User instruction and user action

Users actively choose to:

• configure alerts
• input contact information
• activate triggers
• enable optional features

a) Emergency alert and messaging data

When a user activates an alert, ListenApp may process:

• recipient phone number(s)
• user-generated alert message content
• message transmission timestamps
• delivery status information
• optional location information attached by the user at the time of activation

This data is processed solely for:

• transmitting alerts
• confirming delivery
• maintaining service reliability and security
• safeguarding-related functionality

This data is processed primarily through Twilio, with Infobip retained as a contingency delivery provider where operationally required. Twilio’s primary processing facilities are in the United States, and limited messaging-related personal data may therefore be processed and temporarily stored in the United States. ListenApp’s Twilio account is configured so that message records are accessible through Twilio’s Console and Messages API for no longer than 30 days, and Twilio backup storage is disabled. After that access period, message data may persist in Twilio’s back-end systems for up to a further 30 days before deletion, subject to any legal, security or regulatory retention requirements.

Messaging providers used by ListenApp may apply transmission controls, anti-spam measures, or rate limits as part of their communications infrastructure. When Infobip is used as the contingency delivery provider, Infobip may restrict the transmission of substantially identical messages sent to the same recipient to six (6) messages per hour and messages containing different content sent to the same recipient to twenty (20) messages per hour. These limits are determined by the communications provider and may change without notice. As a result, some messages may be delayed, restricted, or not delivered where provider-imposed limits are reached.

b) Limited anonymised demographic and usage data

ListenApp may process limited anonymised and aggregated information including:

• age range
• gender
• general location (for example, city or region level)
• feature usage statistics
• application engagement trends
• anonymised usage frequency data

This information:

• is not used to identify individual users
• is not linked to alert content or audio recordings
• may be shared with approved partner organisations for safeguarding evaluation, service improvement, reporting, research, and funding assessment purposes

c) Audio and voice processing

Voice trigger detection and related audio processing occur locally on the user’s device.

Where users enable audio recording functionality:

• recordings remain stored within the application environment on the user’s device
• recordings are not transmitted to ListenApp
• recordings are not accessible to ListenApp
• recordings are not stored on ListenApp servers

ListenApp does not:

• remotely access user recordings
• conduct live audio monitoring
• process continuous background audio centrally
• operate remote surveillance systems

d) Location information

ListenApp does not use location information for tracking, profiling, monitoring, or behavioural analysis.

Where enabled by the user:

• location information may be temporarily processed for the purpose of attaching location details to an alert message
• location information is only shared with the user’s selected alert recipient(s)
• location information is not used for continuous tracking or monitoring

Location-related message processing data is retained only in accordance with our standard messaging retention period described below.

e) Support and feedback communications

Where a user selects the "Report an Issue" feature, ListenApp will open the default email application installed on the user’s device. Any email sent using this feature is transmitted through the user’s own email account and email provider. Such communications may contain the sender’s email address and any information voluntarily included in the email. Emails sent in this way may appear in the user’s sent items folder and may be retained by the user’s email provider in accordance with that provider’s own policies. ListenApp only processes information contained in support emails for the purpose of investigating, responding to, and resolving reported issues.

Under UK GDPR, ListenApp relies on the following lawful bases:

Legitimate interests – Article 6(1)(f)

Processing is necessary for:

• safeguarding users
• enabling emergency communication functionality
• maintaining service reliability and security
• supporting users at risk of harm

Special category data

Alert content may incidentally contain sensitive information relating to health or personal safety. Where this occurs, our processing condition is substantial public interest relating to the safeguarding of individuals at risk of distress, in accordance with Schedule 1, Part 2, Paragraph 18 of the Data Protection Act 2018.

ListenApp uses third-party communications providers, including:

• Twilio as our primary SMS delivery provider
• Infobip as a contingency delivery provider, where operationally required

These providers process limited messaging-related data solely for the purpose of delivering alerts and related communications services on our behalf.

Processing may include:

• message routing
• delivery confirmation
• temporary retention for reliability and security purposes

ListenApp requires service providers to implement appropriate contractual and technical safeguards.

We do not sell personal data or share user data for advertising or marketing purposes.

ListenApp aims to minimise international transfers wherever reasonably possible.

Where third-party providers process limited data outside the United Kingdom, appropriate safeguards are implemented. In particular, where Twilio Inc. processes personal data in the United States, transfers may rely on the UK Extension to the EU-US Data Privacy Framework where applicable and while Twilio’s certification remains active. Where that mechanism does not apply, ListenApp relies on other appropriate transfer safeguards provided for under applicable data protection law and the relevant provider data protection terms.

Appropriate safeguards may include:

• the UK Extension to the EU-US Data Privacy Framework, where applicable
• Standard Contractual Clauses (SCCs) together with any required UK international data transfer addendum or agreement
• contractual data protection obligations
• provider security commitments

Where EU GDPR applies, transfers may also rely on the EU-US Data Privacy Framework or another lawful transfer mechanism, where applicable.

Messaging-related data, including:

• recipient phone numbers
• message content
• delivery status information
• associated transmission logs

is retained only for a limited period. ListenApp’s Twilio account is configured so that message records are accessible through Twilio’s Console and Messages API for no longer than 30 days, and Twilio backup storage is disabled. After the 30-day access period, message data may remain in Twilio’s back-end systems for up to a further 30 days before deletion. Where Infobip is used as a contingency provider, data is retained in accordance with the applicable provider settings and ListenApp’s data minimisation and retention requirements. Providers may retain limited information for longer where required by law, regulation, security or fraud-prevention obligations.

ListenApp does not retain:

• audio recordings
• live audio streams
• long-term location histories

Anonymised and aggregated statistical information may be retained for longer periods where it cannot reasonably identify individuals.

ListenApp implements reasonable technical and organisational safeguards designed to protect processed information, including:

• encrypted communications
• restricted internal access controls
• authentication protections
• data minimisation practices
• limited retention periods
• provider security requirements

No system can guarantee absolute security.

Users remain responsible for:

• securing their own device
• protecting PIN access credentials
• controlling physical access to their device

Users are responsible for:

• ensuring they have authority or permission to provide recipient contact details
• configuring the application correctly
• understanding the limitations of the service
• assessing whether use of the application is appropriate for their circumstances

ListenApp is not specifically directed at children.

Where younger individuals use the application, this should take place with appropriate safeguarding oversight from a responsible organisation, professional, parent, guardian, or support provider where appropriate.

Under UK GDPR, individuals may have rights including:

• the right to access personal data
• the right to request correction of inaccurate information
• the right to request deletion
• the right to restrict certain processing
• the right to object to certain processing activities
• the right to lodge a complaint with the Information Commissioner’s Office (ICO)

Due to limited retention periods and the local-device design of ListenApp, some requests may be limited by the availability of retained data.

We may update this Privacy Policy from time to time to reflect:

• legal requirements
• operational changes
• safeguarding developments
• technical improvements

Updated versions will take effect once published within the application or associated platforms. We will notify you of any material changes through the app interface or your partner organisation.

ListenApp CIC | Registered Community Interest Company (CIC): 13740982

Email: info@listenapp.org

Registered address: Suite 217 Queens Dock Business Centre, Norfolk Street, Liverpool, England, L1 0BG