PRIVACY NOTICE
Aya Lookup privacy notice
Effective date: July 29, 2026
Operator: ASL LLC. Mailing address: 6422 S. Quebec St, Centennial, CO 80111. Privacy questions may be sent to the privacy contact. This Aya-specific notice supplements the Auto Secure Login Privacy Policy and applies to the Aya app and Aya website.
Data processed
The service processes account email, password hashes, verification and recovery tokens, credit balance, accepted terms, lookup purposes, lookup history, saved results, notes and tags, purchase identifiers, subscription status, security logs, privacy requests, and inaccurate-result reports. Plaintext passwords and full payment-card credentials are not stored by Aya Lookup.
Lookup data
A phone number is sent to the configured licensed provider to return available identity or call-information data. Results may be incomplete, stale, incorrect, or associated with a prior subscriber. Normalized results can be cached for the configured retention period. Raw provider responses are disabled by default. Verified suppression requests remove the number from Aya's cache, purge matching saved contacts, lookup-history entries, and recent replay records held in Aya user accounts, and prevent new Aya results while the suppression remains active.
Device permissions and local protection
Android contact matching reads only the contact record needed to compare a number after the user grants contact permission; the contact list is not uploaded to Aya. Android call screening compares incoming numbers against synchronized local protection rules. Optional Android notification access examines eligible message-notification text on the device to display a warning and does not upload, hide, delete, or reply to the notification. Notification permission is used to show Aya safety alerts. Push-notification device tokens are sent to Aya only when push is configured and the user enables the feature. Permissions can be revoked in device settings.
Payments and processors
Web payments are processed by Stripe. Native purchases are processed by Apple or Google and synchronized through RevenueCat. Aya stores transaction identifiers, product identifiers, credit grants, refund or dispute status, and subscription state for reconciliation and duplicate-credit prevention. Aya does not receive complete card numbers or App Store and Google Play payment credentials.
Service providers and disclosures
Aya uses service providers as needed for hosting, transactional email, phone lookup, payment processing, app-store purchases, security, and optional analysis features. Providers receive only the information reasonably needed for the requested function and operate under their own terms and privacy obligations. ASL LLC may also disclose information when reasonably necessary to comply with law, protect users or the service, investigate abuse, or complete a business transaction subject to appropriate safeguards. Aya does not sell account information, search history, submitted messages, or voicemail content, and does not use them for cross-context behavioral advertising.
Retention and deletion
Normalized provider lookup results are cached only for the configured cache period. Account lookup history and saved contacts are capped at 250 items each and remain until the user clears them, deletes individual saved records, or deletes the account. Message-analysis replay records are capped, and stored voicemail transcripts and analysis results expire under the configured analysis-retention period; uploaded audio is not retained by Aya. Privacy requests, inaccurate-result reports, transaction records, and security records use separate configured or legally required retention periods. Users can export account data and delete an account in the app or through the public account-deletion page. Account deletion removes account data, lookup history, saved results, and user-linked reports. Minimal transaction identifiers may be retained or anonymized when reasonably necessary for taxes, accounting, chargebacks, fraud prevention, and preventing duplicate credit grants. Payment and lookup providers maintain their own records under their policies and legal obligations.
Your choices
Use the privacy request page to request access, correction, deletion, a portable copy, or suppression. Suppression and correction requests require identity or number-ownership verification before data is changed. In-app reports can flag an incorrect identity, address, reassigned number, or privacy concern. Where applicable law provides an appeal right, you may appeal a denied privacy request by replying to the decision or contacting the privacy address above.
Children
The service is limited to adults age 18 or older and is not directed to children.
Security and transfers
Aya uses password hashing, verified bearer sessions, rate limits, security headers, idempotent billing, encryption in transit, and least-data defaults. No system is perfectly secure. Service providers may process data in other jurisdictions when needed to deliver the service, subject to applicable contractual and legal safeguards.
Changes and contact
ASL LLC may update this notice as Aya changes or legal requirements develop. Material revisions will be identified by a new effective date. Contact the privacy contact or mail ASL LLC at 6422 S. Quebec St, Centennial, CO 80111.