Privacy Policy
Privacy Policy
Last updated: 18 October 2026
1. Who we are
MCOM is a trading name of Melmasti Global (Gibraltar) Limited, 8 Moorland House, Ordinance Wharf, Gibraltar GX11 1AA (“MCOM”, “we”, “us”). We are the controller of the personal data described here, under the Gibraltar General Data Protection Regulation (“Gibraltar GDPR”) and the Data Protection Act 2004.
Data protection contact: our data protection team answers every question and request about your personal data at legal@mcom.gi or by post to the address above, marked “Data Protection”.
2. What this policy covers
- our mobile services (calls, texts, mobile data, voicemail, Wi-Fi calling);
- the MCOM app for Android and its visual voicemail, usage and plan screens;
- MCOM ID, our sign-in service at
id.customers.mcom.gi, including sign-in with your SIM, a text-message code, or your Google, Apple or Facebook account; - our customer APIs at
api.customers.mcom.giand this website.
3. The data we use
| Category | Examples | Where it comes from |
|---|---|---|
| Account | name, e-mail address, preferred language, the sign-in methods you use | you, or the sign-in provider you choose (section 4) |
| Line and SIM | your MCOM phone number, SIM identifiers (IMSI), plan, balance and add-ons | our network and billing systems |
| Sign-in and security | time, method and result of each sign-in; one-time codes (stored only as a hash); the network address of a sign-in; SIM-change checks used to stop account takeover | MCOM ID and our network |
| Traffic and billing | who called or texted whom, when and for how long; mobile data volumes; charges, top-ups and payments | our network and charging systems |
| Location | the cell or Wi-Fi access point your phone uses (section 9) | our network and your phone |
| Voicemail | voicemail messages, greetings you record, your voicemail PIN (stored only as a hash) | callers and you |
| Device | device identifiers your phone sends to the network (for example the IMEI during Wi-Fi calling) | your phone |
| App | app version and settings; a diagnostics log that stays on your phone unless you choose to share it with us; a notification token if you allow notifications | the MCOM app |
| In-app calling | a random identifier of each app installation set up for calls, its device name, which account set it up and when; the app's internet address while it is connected; a notification token so the app can ring when it is closed (section 9) | the MCOM app and our network |
| Website | IP address, browser type, pages requested | our web server (section 14) |
We do not sell personal data and we do not use it for third-party advertising.
4. Signing in with Google, Apple or Facebook
You can create or open your MCOM account with an existing Google, Apple or Facebook account. MCOM ID then receives, from that provider only:
- a provider-specific identifier for you (not your password — we never see it);
- your name and e-mail address, and whether the provider has verified the address (Apple lets you share a private relay address and may share your name only the first time);
- for Google: the
openid,emailandprofilepermissions only. For Facebook:public_profileandemailonly.
We use this information only to create and secure your MCOM account, to recognise you when you sign in again, and to contact you about your account. We do not read your contacts, posts, photos or friends, we do not post anything on your behalf, and we do not share this information with anyone for advertising. Google, Apple and Meta process your sign-in under their own privacy policies, as separate controllers.
MCOM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
A social sign-in alone never gives access to a phone line. To manage a line from your account you first prove you control it (with the SIM in your phone, from the MCOM mobile network, or with a code sent to that number), and we check that the SIM has not been swapped recently (section 8). Owners can invite others to view or manage a line and can remove them at any time.
You can disconnect a provider in the MCOM app or by contacting us, and also at the provider: Google account connections, Apple (Settings › your name › Sign in with Apple, or account.apple.com), Facebook (Settings › Apps and Websites).
5. Why we use your data, and our legal basis
| Purpose | Legal basis (Gibraltar GDPR Art. 6) |
|---|---|
| Connecting calls, texts and data; voicemail; the app; your account and sign-in; billing, payments and support | performance of our contract with you |
| Emergency calls and caller location; lawful requests from authorities; number porting; tax and accounting records; legally required retention | legal obligation |
| Protecting accounts and lines, detecting SIM-swap and other fraud, keeping the network and our systems secure | our legitimate interest in preventing fraud and abuse, and yours in not having your line or account taken over |
| Improving our network and services using aggregated, de-identified statistics | our legitimate interest in running a reliable network |
| Telling a third-party app or website you approve that a number is yours or whether its SIM changed recently (GSMA Open Gateway / CAMARA); app notifications; news about MCOM; location-based services beyond the basic service | your consent, which you can withdraw at any time in the app or by contacting us |
6. Your right to object
Where we use your data on the basis of our legitimate interests (section 5), you have the right to object at any time, on grounds relating to your particular situation. We will then stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims. You can always object to direct marketing, and we will then stop using your data for it. To object, write to legal@mcom.gi.
7. Do you have to give us your data?
- For a mobile line: the details in your customer agreement, and the data our network needs to connect your calls and data, are required by the contract and partly by law (for example emergency-call location). Without them we cannot provide the line.
- For an MCOM account: a sign-in method is required. Your name and e-mail address help us contact you, but you can use an Apple relay address.
- Everything based on consent (section 5) is optional; saying no does not affect your mobile service.
8. Automated checks
To protect you from account takeover, our systems automatically check, when a line is added to an account or a sign-in looks unusual, whether the SIM was changed recently and whether the line is active. If a check fails, the link or sign-in is refused for now and you are told how to continue. These checks do not produce legal effects, use no profiling for marketing, and you can always ask a member of our team to review the decision at legal@mcom.gi.
9. Call, traffic and location data
- We process traffic data (numbers, times, duration, data volumes) to carry your communications, to bill you and to prevent fraud. We erase or anonymise it when it is no longer needed for that, except where Gibraltar law requires us to keep it longer.
- We process location data (the cell or Wi-Fi access point in use) to deliver calls and data, and to pass your location to emergency services when you call them. Any other use of your location needs your consent, which you can withdraw at any time.
- We do not listen to or read the content of your calls and texts, except voicemail you ask us to store and where the law requires it.
Calling in the MCOM app
You can make and take calls with your MCOM number in the MCOM app, over any internet connection. For this:
- Each app installation gets its own calling identity for your number. We keep a random identifier of the installation, the device name you see in the app (for example the phone model), which MCOM account set it up and when. Its password is created for that installation only; our network keeps only a one-way hash of it and your phone keeps it in its secure storage.
- Only the owner of a number and people they gave “Can manage” access can set up devices, at most four per number. When a new device is set up, we send a text message to the number so the person with the SIM knows.
- While the app is connected, our network sees the app’s internet address so calls can reach it. We do not pass this address, or the app’s notification token, to the people you call.
- To ring when the app is closed, the app gives us its Firebase notification token. When a call comes in we send a notification through Google Firebase Cloud Messaging that contains no caller number or call details — only a reference the app uses to collect the call from us.
- Calls are encrypted between the app and our network and are not recorded. Calls in the app are charged and recorded as traffic data like calls from your phone.
- Emergency calls are not made over the app. When you dial an emergency number (such as 112 or 999) the app passes it to your phone’s own dialer.
- You can remove a device in the app under Account. We also remove it when you sign out, unlink the number, an owner withdraws your access, the SIM of the number changes, or you delete your MCOM account.
10. Who we share data with
- Service providers acting for us, under data processing agreements and only as needed: Hetzner Online (data centres in Germany, our network core), Vultr (a data centre in Frankfurt, Germany, this website), Cloudflare (DNS and web delivery), Microsoft (e-mail), and Google Firebase Cloud Messaging (app notifications — the notification token and the message, not your account details).
- Other networks when you call, text or roam, as needed to route the communication.
- Third parties you approve, such as an app checking that a number belongs to you — only the answer you consented to, and only while your consent lasts.
- Authorities where Gibraltar law requires it (see our data requests page).
11. Where your data is stored, and transfers
Our systems run in data centres in the European Union (Germany). Some providers (for example Cloudflare, Microsoft, Google and Vultr) are based in or have support staff in the United States or other countries. Where personal data leaves Gibraltar, the United Kingdom or the European Economic Area, we rely on an adequacy decision (such as the EU-US Data Privacy Framework and the UK extension for certified providers) or on standard contractual clauses with additional safeguards. You can ask for a copy of the safeguards at legal@mcom.gi.
12. How long we keep it
| Data | Kept for |
|---|---|
| MCOM account, sign-in links, line links | while the account exists; deleted within 30 days after you delete the account |
| One-time sign-in codes | 5 minutes (then unusable), stored only as a hash |
| Sign-in sessions | until you sign out or the session expires, at most 180 days |
| Sign-in and security records | 12 months |
| Consent records | while the consent is valid, then as long as we need to prove it was given or withdrawn |
| Traffic data for billing | until the end of the period in which a bill can be challenged or payment pursued, or longer only where Gibraltar law requires it |
| Billing, payment and accounting records | for the period required by Gibraltar tax and company law |
| Voicemail messages and greetings | until you delete them, or they are removed under your mailbox settings or when the line closes |
| In-app calling devices and their notification tokens | while the device is set up; deleted when it is removed (see section 9) |
| Network signalling logs, including an app’s internet address | 30 days |
| Website server logs | 30 days |
| App diagnostics you send us | until your support case is closed |
13. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict its use, or send it to you or another provider in a portable format; you can object (section 6) and withdraw consent at any time. Requests are free; we may ask you to confirm your identity and we answer within one month (two more months for complex requests, in which case we tell you why). Write to legal@mcom.gi.
14. This website
mcom.gi uses no cookies, no analytics and no third-party trackers; fonts and images are served from our own server, so your browser does not contact anyone else. The web server records your IP address, browser type and the pages requested to keep the site secure and working; these logs are deleted after 30 days.
15. Deleting your MCOM account
See how to delete your MCOM account and the data linked to it. Deleting your account does not cancel a mobile line contract; we will tell you what still applies.
16. Children
MCOM accounts are for people aged 16 or over. A parent or guardian can hold a line for a younger person and invite them to view it.
17. Security
We protect data with encryption in transit, hashed secrets (codes, PINs, tokens), access controls with audit logs, and monitoring of our network and systems. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.
18. Changes
We will post updates here and change the date above; for significant changes we will tell you in the app or by e-mail.
19. Contact and complaints
Melmasti Global (Gibraltar) Limited (MCOM), 8 Moorland House, Ordinance Wharf, Gibraltar GX11 1AA · legal@mcom.gi · general enquiries hello@mcom.gi
If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Gibraltar Regulatory Authority (Information Rights / Data Protection), or to the data protection authority where you live or work.