Secure UICC Corp

SECURE-UICC, a Mobile Virtual Network Operator (MVNO), is committed to protecting the privacy and security of our customers' personal information. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our telecommunications services, including our compliance with the STIR/SHAKEN protocol to ensure secure and authenticated caller ID services. By using our services, you consent to the practices described in this policy.

1. Information We Collect

We collect information to provide and improve our telecommunications services, including voice, text, and data services, and to comply with legal and regulatory requirements, such as the STIR/SHAKEN protocol.

1.1 Personal Information

- Contact Information: Name, address, email address, and phone number provided during account setup or customer support interactions.

- Billing Information: Payment details, such as credit card numbers or bank account information, used for processing payments.

- Identification Information: Government-issued ID numbers or other identifiers required for account verification or regulatory compliance.

- Call and Messaging Data: Information related to calls, texts, and data usage, including phone numbers dialed, call duration, message metadata (e.g., sender, recipient, timestamp), and data usage patterns.

- Device Information: Information about your device, such as International Mobile Equipment Identity (IMEI), Universal Integrated Circuit Card (UICC) identifiers, and device settings.

- Location Information: Approximate location data derived from network usage or device GPS, when permitted, to provide location-based services or comply with legal requirements.

1.2 STIR/SHAKEN Protocol Data

To comply with the STIR/SHAKEN framework for caller ID authentication:

- Caller ID Information: Data related to the authentication and verification of calls, including attestation levels (e.g., A, B, or C) assigned to outbound calls and verification results for inbound calls.

- Digital Certificates: Information associated with cryptographic certificates used to authenticate caller ID under STIR/SHAKEN protocols.

- Call Metadata: Limited metadata, such as originating and terminating phone numbers, used to ensure compliance with STIR/SHAKEN requirements.

1.3 Automatically Collected Information

- Network Data: IP addresses, network performance metrics, and connection logs collected during service usage.

- Usage Analytics: Aggregated data about how you use our services, such as call frequency, data consumption, and service preferences.

2. How We Use Your Information

We use the information we collect to:

- Provide Services: Facilitate voice, text, and data services, including call routing, messaging, and billing.

- Comply with STIR/SHAKEN: Authenticate and verify caller ID information to prevent robocalls and spoofing, as required by the STIR/SHAKEN framework.

- Improve Services: Analyze usage patterns to enhance network performance, troubleshoot issues, and develop new features.

- Process Payments: Handle billing and payment processing securely.

- Ensure Security: Detect and prevent fraud, unauthorized access, or misuse of our services.

- Communicate with You: Send service-related notifications, respond to customer inquiries, and provide promotional offers (with your consent).

- Meet Legal Obligations: Comply with applicable laws, regulations, and industry standards, including telecommunications regulations and data protection laws.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

- Service Providers: With trusted third-party vendors who assist in delivering our services, such as billing processors, network providers, or STIR/SHAKEN certificate authorities, under strict confidentiality agreements.

- STIR/SHAKEN Compliance: With other telecommunications providers, intermediaries, or authorized entities to authenticate and verify caller ID information, as required by the STIR/SHAKEN protocol.

- Legal Requirements: When required by law, such as in response to a court order, subpoena, or regulatory request, or to protect the safety and security of our customers or the public.

- Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to a successor entity, subject to this Privacy Policy.

4. Data Security

We implement robust security measures to protect your information, including:

- Encryption: Using industry-standard encryption for data transmission and storage, including STIR/SHAKEN-related cryptographic processes.

- Access Controls: Limiting access to your information to authorized personnel only.

- Network Security: Employing firewalls, intrusion detection systems, and other safeguards to protect our network and your data.

- STIR/SHAKEN Protections: Using digital certificates and secure protocols to authenticate calls and prevent unauthorized spoofing.

Despite these measures, no system is completely secure, and we cannot guarantee absolute security of your information.

5. Your Choices and Rights

You have certain rights regarding your personal information, subject to applicable laws:

- Access and Correction: Request access to or correction of your personal information by contacting us.

- Opt-Out: Opt out of promotional communications by following the unsubscribe instructions in our emails or contacting customer support.

- Data Portability: Request a copy of your data in a structured, commonly used format, where feasible.

- Deletion: Request deletion of your personal information, subject to legal and regulatory retention requirements.

To exercise these rights, contact us at support@secure-uicc.com.

6. STIR/SHAKEN and Caller ID Authentication

As an MVNO, SECURE-UICC complies with the STIR/SHAKEN framework to combat illegal robocalls and caller ID spoofing. This involves:

- Authenticating Outbound Calls: Assigning attestation levels to verify the legitimacy of caller ID information.

- Verifying Inbound Calls: Checking attestation levels to inform you of the authenticity of incoming calls.

- Data Handling: Processing limited call metadata to support STIR/SHAKEN compliance, shared only with authorized entities in the telecommunications ecosystem.

We retain STIR/SHAKEN-related data only for as long as necessary to comply with regulatory requirements or troubleshoot service issues.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes