App Privacy Policy

ListenApp is a restricted-access safeguarding support platform made available through approved partner organisations supporting individuals who may be at risk of abuse or harm.

Who we are: ListenApp CIC publishes and operates the ListenApp application and is the data controller for the personal data described in this policy. The ListenApp software and brand are owned by Listen Safeguarding Ltd, which licenses them to ListenApp CIC. Listen Safeguarding Ltd does not receive or have access to users’ personal data. In this policy, “ListenApp”, “we”, “us” and “our” mean ListenApp CIC.

ListenApp is promoted in partnership with The Mindful Foundation (registered charity 1209439). The Mindful Foundation does not receive app users’ personal data. If your organisation registers interest in ListenApp through our website, or subscribes as a partner, your details are covered by our separate partner privacy notice.

The application enables users to discreetly activate pre-configured alert messages to trusted contacts using voice triggers or manual activation features.

ListenApp is designed as a support tool only. It is not an emergency service and does not replace police, medical, safeguarding, or crisis support services.

ListenApp is designed using a data minimisation approach wherever reasonably possible.

ListenApp has been designed to minimise the amount of personal data processed centrally by ListenApp systems.

In particular:

• voice trigger detection operates locally on the user’s device
• audio recordings remain stored within the application environment on the user’s device
• ListenApp does not remotely monitor conversations or process continuous live audio streams
• ListenApp does not operate real-time user surveillance or tracking
• ListenApp does not store audio recordings on its servers

We only process the minimum information necessary to provide alert delivery and limited safeguarding-related functionality.

User instruction and user action

Users actively choose to:

• configure alerts
• input contact information
• activate triggers
• enable optional features

a) Emergency alert and messaging data

When a user activates an alert, ListenApp may process:

• recipient phone number(s)
• user-generated alert message content
• message transmission timestamps
• delivery status information
• optional location information attached by the user at the time of activation

This data is processed solely for:

• transmitting alerts
• confirming delivery
• maintaining service reliability and security
• safeguarding-related functionality

Alert recipients: if a ListenApp user has chosen you as a trusted contact, we process your phone number and the alerts sent to you only to deliver those alerts. Users are asked to get your permission before adding you.

This data is processed through Twilio, our SMS delivery provider. Twilio’s primary processing facilities are in the United States, and limited messaging-related personal data may therefore be processed and temporarily stored in the United States. ListenApp’s Twilio account is configured so that message records are accessible through Twilio’s Console and Messages API for no longer than 30 days, and Twilio backup storage is disabled. After that access period, message data may persist in Twilio’s back-end systems for up to a further 30 days before deletion, subject to any legal, security or regulatory retention requirements.

Messaging providers used by ListenApp may apply transmission controls, anti-spam measures, or rate limits as part of their communications infrastructure. These limits are set by the provider and may change without notice. As a result, some messages may be delayed, restricted, or not delivered where provider-imposed limits are reached.

b) Demographic and usage information (analytics)

When you set up the app, we ask for limited information about you, and we collect information about how the app is used. This may include:

• age range
• gender
• general location (for example, city or region level)
• preferred language
• the partner organisation that referred you
• feature usage statistics
• application engagement trends
• usage frequency data

This information:

• is held in pseudonymised form and is not used to identify individual users
• is not linked to alert content or audio recordings
• is shared with approved partner organisations only as aggregated reports that do not identify individuals, for safeguarding evaluation, service improvement, reporting, research, and funding assessment purposes

c) Audio and voice processing

Voice trigger detection and related audio processing occur locally on the user’s device.

Where users enable audio recording functionality:

• recordings remain stored within the application environment on the user’s device
• recordings are not transmitted to ListenApp
• recordings are not accessible to ListenApp
• recordings are not stored on ListenApp servers

ListenApp does not:

• remotely access user recordings
• conduct live audio monitoring
• process continuous background audio centrally
• operate remote surveillance systems

d) Location information

ListenApp does not use location information for tracking, profiling, monitoring, or behavioural analysis.

Where enabled by the user:

• location information may be temporarily processed for the purpose of attaching location details to an alert message
• location information is only shared with the user’s selected alert recipient(s)
• location information is not used for continuous tracking or monitoring

Location-related message processing data is retained only in accordance with our standard messaging retention period described below.

e) Support and feedback communications

Where a user selects the "Report an Issue" feature, ListenApp will open the default email application installed on the user’s device. Any email sent using this feature is transmitted through the user’s own email account and email provider. Such communications may contain the sender’s email address and any information voluntarily included in the email. Emails sent in this way may appear in the user’s sent items folder and may be retained by the user’s email provider in accordance with that provider’s own policies. ListenApp only processes information contained in support emails for the purpose of investigating, responding to, and resolving reported issues.

f) Account and access code information

We do not request names or email address. When you activate ListenApp with an access code from a partner organisation, we process your username, the access code, the partner organisation that issued it, your licence status and the activation date. This is for license management, and to produce aggregated reports for the partner organisation. This information is stored in Google Firebase.

Your partner organisation can see your username and licence status through the ListenApp partner portal, so that it can manage its licences. Only ListenApp CIC and your partner organisation have access to the portal. Your partner organisation cannot see your alerts, contacts, recordings or location through ListenApp.

Under UK GDPR, ListenApp relies on the following lawful bases:

Legitimate interests – Article 6(1)(f)

Processing is necessary for:

• safeguarding users
• enabling emergency communication functionality
• maintaining service reliability and security
• supporting users at risk of harm

Analytics: we process demographic and usage information with your consent, which we ask for when you set up the app (Article 6(1)(a) UK GDPR). You can withdraw your consent at any time.

Account and access code information: processing is necessary for our legitimate interests in making sure only eligible users referred by partner organisations can use the app, and in letting users manage and delete their account.

Special category data

Alert content may incidentally contain sensitive information relating to health or personal safety. Where this occurs, our processing condition is substantial public interest relating to the safeguarding of individuals at risk of distress, in accordance with Schedule 1, Part 2, Paragraph 18 of the Data Protection Act 2018. We hold an appropriate policy document, as required by Schedule 1 of the Data Protection Act 2018.

ListenApp uses third-party communications and service providers (processors), including:

• • Twilio as our SMS delivery provider (United States)
  • Google (Firebase) – hosting of the ListenApp backend service, partner portal and account information (United States, us-central1)
  • Google (Google Analytics for Firebase) – app usage analytics (United States)
  • Codes Orbit – app development and technical support, where access to our systems is needed (Pakistan)

These providers process limited messaging-related data solely for the purpose of delivering alerts and related communications services on our behalf.

Our other service providers process personal data only to provide their services to us, under written data processing terms. If we change or add a provider, we will update this policy.

Processing may include:

• message routing
• delivery confirmation
• temporary retention for reliability and security purposes

ListenApp requires service providers to implement appropriate contractual and technical safeguards.

We do not sell personal data or share user data for advertising or marketing purposes.

If ListenApp is transferred: if the operation of ListenApp is transferred to another organisation (for example, Listen Safeguarding Ltd or a future owner of ListenApp), your personal data may be transferred to that organisation so that the service can continue. We will tell you before this happens. The new operator must protect your data in line with data protection law and this policy, and will tell you about any changes.

ListenApp aims to minimise international transfers wherever reasonably possible.

Where third-party providers process limited data outside the United Kingdom, appropriate safeguards are implemented. In particular, where Twilio Inc. processes personal data in the United States, transfers may rely on the UK Extension to the EU-US Data Privacy Framework where applicable and while Twilio’s certification remains active. Where that mechanism does not apply, ListenApp relies on other appropriate transfer safeguards provided for under applicable data protection law and the relevant provider data protection terms.

Google (Firebase and Google Analytics) also processes personal data in the United States. These transfers rely on the UK Extension to the EU-US Data Privacy Framework, or otherwise on the safeguards listed below.

Codes Orbit, our app developer, is based in Pakistan and may access personal data when supporting the app. Pakistan does not have a UK adequacy decision, so this transfer is protected by the ICO’s International Data Transfer Agreement and a transfer risk assessment.

Appropriate safeguards may include:

• the UK Extension to the EU-US Data Privacy Framework, where applicable
• Standard Contractual Clauses (SCCs) together with any required UK international data transfer addendum or agreement
• contractual data protection obligations
• provider security commitments

Where EU GDPR applies, transfers may also rely on the EU-US Data Privacy Framework or another lawful transfer mechanism, where applicable.

Messaging-related data, including:

• recipient phone numbers
• message content
• delivery status information
• associated transmission logs

is retained only for a limited period. ListenApp’s Twilio account is configured so that message records are accessible through Twilio’s Console and Messages API for no longer than 30 days, and Twilio backup storage is disabled. After the 30-day access period, message data may remain in Twilio’s back-end systems for up to a further 30 days before deletion. Providers may retain limited information for longer where required by law, regulation, security or fraud-prevention obligations.

ListenApp does not retain:

• audio recordings
• live audio streams
• long-term location histories

Anonymised and aggregated statistical information may be retained for longer periods where it cannot reasonably identify individuals.

Account and access code information is kept while your licence is active, and deleted within 30 days after you ask us to delete your account or your partner organisation ends your licence.

ListenApp implements reasonable technical and organisational safeguards designed to protect processed information, including:

• encrypted communications
• restricted internal access controls
• authentication protections
• data minimisation practices
• limited retention periods
• provider security requirements

No system can guarantee absolute security.

Users remain responsible for:

• securing their own device
• protecting PIN access credentials
• controlling physical access to their device

Users are responsible for:

• ensuring they have authority or permission to provide recipient contact details
• configuring the application correctly
• understanding the limitations of the service
• assessing whether use of the application is appropriate for their circumstances

ListenApp is not specifically directed at children.

ListenApp is intended for people aged 16 and over. Where 16 and 17 year olds use the app, we follow the ICO’s Children’s Code (Age Appropriate Design Code): we collect the minimum data, we do not use their data for profiling or marketing, and optional features such as location sharing and recording are only switched on by the user.

Where younger individuals use the application, this should take place with appropriate safeguarding oversight from a responsible organisation, professional, parent, guardian, or support provider where appropriate.

Under UK GDPR, individuals may have rights including:

• the right to access personal data
• the right to request correction of inaccurate information
• the right to request deletion
• the right to restrict certain processing
• the right to object to certain processing activities
• the right to lodge a complaint with the Information Commissioner’s Office (ICO)

Due to limited retention periods and the local-device design of ListenApp, some requests may be limited by the availability of retained data.

To exercise any of these rights, email info@listenapp.org. We will respond within one month. You can contact the ICO at ico.org.uk or on 0303 123 1113.

We may update this Privacy Policy from time to time to reflect:

• legal requirements
• operational changes
• safeguarding developments
• technical improvements

Updated versions will take effect once published within the application or associated platforms. We will notify you of any material changes through the app interface or your partner organisation.

ListenApp CIC | Registered Community Interest Company (CIC): 13740982

Email: info@listenapp.org

Registered address: Suite 217 Queens Dock Business Centre, Norfolk Street, Liverpool, England, L1 0BG