Privacy policy for the app.

Mallen Phone is a business telephone app. It is supplied by Mallen Services Pty. Ltd. (ABN 66 630 719 970) and used by staff of the organisation that issued them their account. This policy explains what the app accesses, where that information goes, and what it does not do.

01Who is responsible for your information

The organisation that issued your account — your employer — controls the Microsoft 365 tenant and the phone system the app connects to, and is responsible for the information held there. Mallen Services supplies the app and, where contracted, operates the phone system on that organisation's behalf.

02What the app accesses, and why

Your Microsoft account identity

Your name, work email, and the sign-in tokens issued to the app — used to sign you in and to prove to your phone system that you are entitled to make and receive calls on your extension. Shared with Microsoft and your organisation's phone system. Tokens are stored on your device.

Your Outlook contacts

Names, organisations, job titles, phone numbers, email addresses and contact photos — so you can find and call people, and so incoming calls show a name instead of a number. Read from your own Microsoft 365 mailbox and stored on your device. Not sent anywhere.

Voicemail messages sent to your mailbox

Transcripts, audio recordings, caller details, and whether you have listened to them — to show voicemail in the app, play it back, and keep read and deleted status in step with Outlook. Read from your own Microsoft 365 mailbox. Audio is cached on your device and deleted automatically.

Call audio

To carry the call. Sent over an encrypted connection to your organisation's phone system. The app does not record calls.

Your call history

To show recent calls. Stored on your device only.

A notification token issued by Google, and your device name

So your phone can be woken when someone calls you, and so your phone system can tell your devices apart. Shared with Google (Firebase Cloud Messaging) and your organisation's phone system.

Contacts stored on your phone

Names, numbers, email addresses and photos — to show a photo for a contact your mailbox has none for, and to put a name to a caller who isn't in the company phonebook. Read on the device only and sent nowhere. Optional — the app works without it.

Crash diagnostics

Device model, operating system version and stack traces — to diagnose app faults. Sent to Google Firebase Crashlytics. Call logs, SIP identities and dialled numbers are not included.

The server address you enter when you first set up the app

To look up the settings for your organisation's phone system. Shared with Mallen Services. This is the address itself — a hostname — and nothing about you.

Notification messages are used to wake the app for an incoming call or a new voicemail. They carry routing identifiers, not the contents of your calls or messages.

03What the app does not do

• It does not send the contacts stored on your phone anywhere. With your permission the app reads them on the device, so that a contact photo you already have can be shown and so a caller who isn't in the company phonebook still shows a name. That reading happens entirely on the handset. Nothing is uploaded, nothing is changed, and the app works without the permission — you lose the photos and the personal caller names, not your work phonebook.
• It does not record your calls. Where call recording or transcription applies, it is performed by your organisation's phone system, under your organisation's own policies.
• It contains no advertising and no analytics or usage tracking. The only diagnostic service is Google Firebase Crashlytics, which receives the crash diagnostics described above — never your calls, contacts, messages or dialled numbers.
• It does not sell or share your information with any third party.
• It does not collect your location.

04Permissions the app asks for

• Microphone — to carry your voice during a call.
• Notifications — to alert you to incoming calls and voicemail.
• Phone — so calls appear and behave like normal phone calls, including on a paired watch or in a car.
• Contacts — optional. Read on the device to show contact photos and name personal callers. Never uploaded.
• Run in the background — the app must stay connected to your phone system, or it stops receiving calls about an hour after you last opened it.

05Information stored on your device

The app keeps your contacts, call history, voicemail transcripts, recently played voicemail audio, contact photos and your sign-in tokens on the device itself, so that it works quickly and without re-fetching everything constantly. Cached voicemail audio is removed automatically over time.

This information is not backed up to Google or transferred to a new device. Uninstalling the app removes all of it. If you sign in on a new phone, the app fetches what it needs again from your Microsoft 365 account.

06How long information is kept

Voicemail and contacts live in your Microsoft 365 mailbox and are kept for as long as your organisation's own retention rules say. Deleting a voicemail in the app deletes it from your mailbox. Information held on the device lasts until you delete it or uninstall the app.

07Your rights

Because the information the app shows is held in your employer's Microsoft 365 tenant and phone system, requests to access, correct or delete it are handled by your employer. Contact your IT team in the first instance.

08Children

Mallen Phone is a workplace tool. It is not directed at children and is not intended for anyone under 16.

09Changes to this policy

If this policy changes, the date at the top of this page will change with it.

10Contact & complaints

To make a privacy enquiry, access request, correction request, or complaint about the app, contact:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.