Privacy Policy

1. Introduction

Contacts Plus LLC, a Delaware limited liability company with offices at 3636 S. Geyer Road, Suite 100, Saint Louis, MO 63127 (“we”, “us”, “our”), is committed to protecting your privacy. This Privacy Policy governs how we collect, use, disclose, and protect your personal information, as defined under GDPR Article 4(1) and CCPA Section 1798.140 — including End User Contact Data and Completed Contact Data (as defined in our Terms of Use, Section 4) — in connection with your access to and use of our website at contactsplus.com (the “Site”), the Contacts Plus mobile application (the “App”), and related contact management and synchronization services, including APIs and integrations (collectively, the “Services”).

We are the data controller under GDPR and the business under the CCPA, as amended by the CPRA, and we comply with other applicable data protection laws (e.g., Virginia CDPA, Colorado CPA, Canada PIPEDA). This Privacy Policy applies to all Users, including individual End Users, organizational Clients, and Developers, as defined in our Terms of Use. Capitalized terms not defined here have the meanings given in our Terms of Use. For inquiries, contact us at support@contactsplus.com or, for GDPR-related requests, our Data Protection Officer at dpo@contactsplus.com.

Overview

This Privacy Policy covers the information we collect, how we use and share it, how long we keep it, how we secure and transfer it, the cookies and tracking technologies we use, your privacy rights and choices, how to complain, your “Do Not Sell or Share” rights, financial incentives, how we notify you of changes, and how to contact us.

2. Information We Collect

2.1 Types of Data We Collect

“Personal Information” means any data that allows someone to identify or contact an individual data subject — for example, name, address, telephone number, email address, or other non-public information associated with such data. “Anonymized Data” means data that cannot be linked to an identifiable individual, per GDPR Recital 26. We collect Personal Information and Anonymized Data, as described below.

2.2 Information You Provide to Us

We collect the following Personal Information when you interact with our Services:

• Account Information: when you register for an Account, we require information such as your full name, organization (if applicable), phone number, email address, and password. You may optionally sign in using a third-party service (e.g., Google); if you do, you will be asked to consent to that service providing us limited information such as your name, email address, and profile photo, in compliance with the Google API Services User Data Policy (including Limited Use requirements). Only data necessary for account creation is collected.
• Profile Information: you may voluntarily provide a name, photo, email, phone number, URLs, physical address, instant-message handles, job title, bio, interests, or other details. Sensitive information, such as gender or dates (e.g., birthdays), is optional and processed only with your explicit consent, per GDPR Article 6(1)(a).
• Referral Information: when you use the Services to refer others, we collect contact information you provide (e.g., name, email) for the invitee, excluding data of minors under 13. We generate automated invitations based on this information, processed under GDPR Article 6(1)(b) (contract performance).
• Payment Information: for paid Services, we collect billing information (e.g., name, billing address) via third-party payment processors (e.g., Stripe) under data processing agreements compliant with GDPR Article 28 and the CCPA. We do not store payment card details.
• Communication Information: when you contact us (e.g., via email, phone, or support requests), we collect your name, email address, phone number, and any content you provide. With your explicit consent (GDPR Article 6(1)(a)), we may record customer-support conversations to improve service quality. We also collect event logs and survey responses to diagnose issues and enhance support, processed under GDPR Article 6(1)(f) (legitimate interests).
• Additional Information: you may provide information through forms, searches, Account updates, surveys, feedback, forums, or promotions. We collect such information only when clearly indicated at the point of collection, per GDPR Article 13 and CCPA Section 1798.130.

2.3 Information We Collect from Your Use of Our Services

2.3.1 Contacts (End User Contact Data). Our Services enable you to manage contact information (“Contacts” or “End User Contact Data”), including names, email addresses, phone numbers, URLs, social handles, online identifiers, physical addresses, organizational affiliations, job titles, birthdays, key dates, gender, general location, relationships, skills, interests, preferences, notes, photos, tags, or other categorizations. Sensitive data (e.g., gender) is processed only with your explicit consent (GDPR Article 6(1)(a)). Contacts are collected via connected services you authorize (e.g., email providers, social networks, calendars), direct entry or edits via the Site or App (including voice interfaces), our APIs, uploaded files, third-party applications, contact extraction features (e.g., business-card scanning or email-signature extraction), contacts shared by other Users, and — on Android only — call-log data for caller identification, collected with your consent (CCPA: opt-out available).

2.3.2 Relationship Information. We collect data to manage relationships, inferred from your Contacts (e.g., relationships indicated by shared details or interaction frequency, under legitimate interests), connected services (e.g., social-network connections, under contract performance), communication metadata (e.g., contact identity, time, and duration — content is not processed without explicit consent), and appointment data (e.g., calendar time, location, participants from connected services).

2.3.3 Location Information. We collect approximate or precise location from IP addresses or device GPS, with your consent (CCPA: opt-out available); you may disable location services in your device settings. Use of map services (e.g., Google Maps, Apple Maps) is subject to their terms and privacy policies.

2.3.4 Usage and Device Information. We collect usage information (e.g., logins, page visits, button clicks) and log/device data (e.g., IP address, access times, hardware/software details, device identifiers, crash data, cookie data), processed under GDPR Article 6(1)(f) (legitimate interests). We also use cookies, pixels, and mobile identifiers for functionality and analytics — with EU/EEA consent via our cookie tool (ePrivacy Directive) and CCPA opt-out via contactsplus.com/privacy. Disabling cookies may affect functionality. We do not respond to “Do Not Track” signals due to the lack of a standard.

2.4 Information We Receive from Third Parties

We may receive Personal Information about you from third parties and combine it with data collected via the Services:

• Shared Contacts: information provided by other Users (e.g., via shared Contacts), excluding minors under 13.
• Public Data: information from public or licensed APIs, processed under legitimate interests. We do not control third-party processing practices.
• Analytics Providers: data from providers like Google Analytics for usage statistics and demographics, under data processing agreements (GDPR Article 28) and with consent (CCPA: opt-out available).
• Third-Party Services: registration or profile data from authorized services (e.g., Google), per GDPR Article 6(1)(b) and Google API Limited Use requirements.
• Other Sources: demographic or interest data from partners, processed under legitimate interests or with consent, as permitted by law.

You may opt out of third-party data sharing via contactsplus.com/privacy.

3. How We Use Your Information

We use, store, and process your Personal Information — including End User Contact Data and Completed Contact Data — to provide, improve, and secure our Services, comply with legal obligations, and, where applicable, conduct marketing with your consent. No automated decision-making or profiling producing legal effects occurs, per GDPR Article 22.

3.1 Provide, Maintain, and Support the Services

We process Personal Information to deliver the Services, including contact management (storage, backup, editing, synchronization, deduplication, search, tagging, sharing, and grouping), relationship management, Account creation and security (e.g., verifying ownership via email or SMS, sending service and security notifications), fraud prevention, and technical support — under contract performance (GDPR Article 6(1)(b)) or legitimate interests (Article 6(1)(f)).

3.2 Improve and Personalize the Services

We use Personal Information to troubleshoot errors, perform data analysis and testing, conduct research and surveys (with consent), and develop new features and services, under legitimate interests or consent as applicable.

3.3 Marketing and Referrals

With your consent, we may send promotional communications about our Services or partner campaigns, administer referral programs, rewards, surveys, or promotions, and suggest contacts for referral invitations based on your Contacts. You may opt out of marketing via unsubscribe instructions, Account settings, or contactsplus.com/privacy. We do not discriminate against users exercising opt-out rights, per CCPA Section 1798.125.

3.4 Enhanced Features (Deduplication and Contact Enrichment)

We combine your Contacts and relationship information with other Users’ data and public sources to create Completed Contact Data for enhanced features: deduplication (merging duplicate records by matching elements such as phone number or email; limited data such as business emails or public social handles may be shared with other Users with your consent or via pseudonymization), contact enrichment (matching your Contacts to Completed Contact Data to add details such as job titles or public social handles, with your consent), and contact search (retrieving Completed Contact Data using only non-private elements unless you authorize sharing). Private data (e.g., personal phone numbers, emails, notes) is not shared without your explicit consent. You may opt out via contactsplus.com/privacy.

3.5 Anonymized Data

We create Anonymized Data by excluding identifiable information so it cannot be re-identified, per GDPR Recital 26. We use it to analyze usage patterns, enhance the Services, and improve Site navigation, and may share it with third parties at our discretion.

3.6 Google API Services User Data Policy

ContactsPlus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We affirm that our application: only uses access to Google user data to provide user-facing features; does not transfer user data to others except as necessary to provide or improve features, comply with law, or as part of a merger, acquisition, or sale of assets with user consent; does not use Google user data for advertising; does not allow humans to read user data except with your affirmative consent, for security, to comply with law, or for internal operations consistent with this policy; and does not use Google Workspace API data to develop, improve, or train generalized AI or machine-learning models.

4. How We Share Your Information

We may share your Personal Information — including End User Contact Data and Completed Contact Data — as described below. You may exercise your rights over shared data (e.g., opt-out, deletion) as outlined in Section 10. We do not share information of minors under 13.

4.1 With Your Consent

We share Personal Information when you explicitly authorize us — for example, connecting third-party applications or websites to your Account (e.g., Google login), participating in promotional activities with partners, or authorizing sharing through Service features (e.g., contact sharing). You may withdraw consent at any time via support@contactsplus.com or contactsplus.com/privacy.

4.2 With Other Users

To provide the Services, we may share limited Personal Information with other Users (e.g., for Teams products, deduplication, or contact enrichment), as necessary for contract performance or our legitimate interests. Private data (e.g., personal phone numbers, notes) is not shared without your explicit consent. You may opt out via contactsplus.com/privacy.

4.3 For Legal Compliance and Protection

We may disclose Personal Information in good faith to comply with legal obligations or investigations, respond to requests from public or government authorities (including outside your country of residence) or to subpoenas/warrants, protect our rights, property, or safety or that of Users, and investigate or prevent violations of law, this Privacy Policy, or our Terms of Use.

4.4 With Service Providers

We share Personal Information with third-party service providers (e.g., hosting, analytics, payment processors like Stripe) to deliver the Services. Providers are bound by data processing agreements compliant with GDPR Article 28 and the CCPA, ensuring use only for disclosed purposes. Transfers to providers in regions such as Europe, India, or the Americas are protected by Standard Contractual Clauses or Standard Contractual Clauses, per GDPR Article 46 (see Section 8).

4.5 With Corporate Affiliates

We may share Personal Information with our subsidiaries or parent companies to support Service provision (e.g., technical infrastructure, customer support), complying with GDPR Article 28 and local data protection laws using appropriate transfer mechanisms.

4.6 With Social Media Platforms

With your consent, we may share pseudonymized data (e.g., cryptographically hashed emails) with social media platforms (e.g., Google) to generate leads or promote the Services. No profiling occurs. You may opt out via contactsplus.com/privacy or support@contactsplus.com.

4.7 For Business Transfers

In the event of a merger, acquisition, reorganization, asset sale, bankruptcy, or insolvency, we may transfer Personal Information as part of our assets, including during due diligence.

4.8 Anonymized Data

We may share Anonymized Data, which cannot be re-identified (GDPR Recital 26), for purposes such as analytics, marketing, or compliance. Anonymized Data is not Personal Information under GDPR or the CCPA.

5. Data Retention

We retain your Personal Information — including End User Contact Data and Completed Contact Data — only as long as necessary to provide the Services, improve our database for enhanced features, or comply with legal obligations (e.g., tax, auditing, legal reporting), per GDPR Article 5(1)(c) and CCPA Section 1798.105. Typically, data is retained for up to 5 years after last update or use, unless you request deletion. We do not retain information of minors under 13.

You may request deletion of your End User Contact Data or closure of your Account via the Site, App, or by contacting support@contactsplus.com. We process deletion requests within one month (GDPR Article 12(3)) or 45 days (CCPA Section 1798.130), extendable as permitted by law. We do not discriminate against users exercising deletion rights, per CCPA Section 1798.125. Please note:

• Fraud prevention: we may retain limited information for fraud detection and prevention (e.g., to prevent a suspended Account from creating a new one).
• Legal obligations: we may retain information as required for tax, legal reporting, or auditing.
• Third-party systems: data shared with third-party systems (e.g., Google, social networks) may persist there; contact those providers directly to request deletion.
• Database and logs: copies of your information (e.g., log records) may remain but are disassociated from personal identifiers per GDPR Recital 26.
• Backups: residual copies may remain in secure backups to protect against data loss, retained for up to 12 months and anonymized to prevent re-identification.

6. Third-Party Websites

When you click a link to a third-party website or service (e.g., Google Maps, social networks) from our Site, App, or Services, you leave our Services, and a third party may collect Personal Information or Anonymized Data. We do not control, review, or assume responsibility for the data practices of third-party websites or services, and this Privacy Policy does not apply to them. We do not share information of minors under 13 with third parties. Third-party data collection is not a “sale” or “sharing” of Personal Information by Contacts Plus LLC under CCPA Section 1798.120. To exercise your rights over data collected by third parties, review their privacy policies and contact them directly.

7. Children’s Privacy

Our Services are not intended for or designed to attract individuals under 13, per the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. § 6502). We do not knowingly collect Personal Information from children under 13. For users in the EU/EEA aged 13–16, we require verifiable parental consent to process Personal Information, per GDPR Article 8. If a parent or guardian becomes aware that their child has provided Personal Information without consent, they should contact us at support@contactsplus.com; we will delete such information within one month (GDPR Article 12(3)) or 45 days (CCPA Section 1798.130), extendable as permitted by law. We also comply with other applicable child-privacy laws (e.g., Canada’s PIPEDA).

8. Data Security and International Transfers

8.1 Data Security

We implement and regularly update technical and organizational measures to protect your Personal Information — including End User Contact Data and Completed Contact Data — against unauthorized access, loss, destruction, or alteration, per GDPR Article 32 and CCPA Section 1798.81.5. These measures include encryption of data in transit and at rest (e.g., AES-256), firewalls and secure server environments, access controls limiting data access to authorized personnel, and regular security audits and vulnerability assessments. If you suspect your Account credentials have been lost, stolen, or compromised, or you detect unauthorized use of your Account, contact us immediately at support@contactsplus.com. For more detail, see our Security page.

8.2 Data Breach Notification

In the event of a personal data breach, we will notify affected users and relevant authorities (e.g., EU/EEA supervisory authorities) within 72 hours, as required by GDPR Article 33, or promptly, per CCPA Section 1798.82. Notifications will include details of the breach and steps to mitigate risks, where applicable.

8.3 International Data Transfers

To provide the Services, we may transfer, store, and process your Personal Information within our corporate affiliates or with service providers in regions such as Europe, India, Asia, and the Americas. For EU/EEA residents, transfers outside the European Economic Area are protected by Standard Contractual Clauses, per GDPR Article 46. We also comply with other applicable transfer laws (e.g., Canada’s PIPEDA). For details, contact our Data Protection Officer at dpo@contactsplus.com.

9. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to enhance functionality, analyze usage, and personalize the Services. Essential cookies enable core features, while analytics cookies (e.g., Google Analytics) track usage patterns under data processing agreements (GDPR Article 28). EU/EEA users are prompted for consent via our cookie tool, per GDPR Article 7 and the ePrivacy Directive. California residents may opt out of non-essential cookies via contactsplus.com/privacy (CCPA Section 1798.120). Non-EU users may opt out via browser settings or contactsplus.com/privacy. Disabling cookies may affect functionality. We do not respond to “Do Not Track” signals due to the lack of a standard. For full detail, see our Cookie Policy.

10. Your Privacy Rights

Contacts Plus LLC is the data controller for Personal Information processed under our Services, per GDPR Article 4(7) and CCPA Section 1798.140. We do not discriminate against users exercising these rights, per CCPA Section 1798.125. No automated decision-making or profiling producing legal effects occurs, per GDPR Article 22.

10.1 Communication Choices

With your consent (GDPR Article 6(1)(a)), we may send newsletters or promotional emails about our Services or third-party products. You may opt out via unsubscribe instructions, Account settings, or contactsplus.com/privacy. Service-related communications (e.g., Terms or Privacy Policy updates, security alerts) are not subject to opt-out.

10.2 Data Subject Rights

You may exercise the following rights over your Personal Information via support@contactsplus.com, our Own Your Data page, or the Site/App:

• Access: request details of the Personal Information we hold (GDPR Article 15, CCPA Section 1798.110).
• Rectification: correct inaccurate or incomplete Personal Information (GDPR Article 16, CCPA Section 1798.110).
• Deletion: request deletion, subject to exemptions (e.g., legal obligations, GDPR Article 17(3), CCPA Section 1798.105).
• Portability: request your Personal Information in a structured, commonly used, machine-readable format (e.g., CSV), or transmission to another controller where feasible (GDPR Article 20, CCPA Section 1798.100).
• Restriction: restrict processing in cases such as contested accuracy (GDPR Article 18).

Further information is available in our Privacy Notice.

11. Complaints and Dispute Resolution

If you have concerns about our data practices, contact us at support@contactsplus.com or dpo@contactsplus.com. We respond within one month (GDPR Article 12(3)) or 45 days (CCPA Section 1798.130). EU/EEA residents may lodge complaints with their local data protection authority (GDPR Article 77) or seek a judicial remedy (Article 79). California residents may contact the California Privacy Protection Agency (CCPA Section 1798.199).

12. Do Not Sell or Share My Personal Information

California residents may opt out of the “sale” or “sharing” of Personal Information (e.g., for analytics, contact enrichment, or social media platforms) via contactsplus.com/privacy, per CCPA Section 1798.120. Submit requests at support@contactsplus.com. We process opt-outs within 15 business days and do not discriminate against users exercising this right (Section 1798.125).

13. Financial Incentives

If you subscribe to paid tiers (e.g., Premium accounts), we may offer enhanced features valued based on subscription fees. Participation is optional, and you may opt out of data sharing without losing access to core Services, per CCPA Section 1798.125. Contact support@contactsplus.com for details.

14. Changes to This Privacy Policy

We may revise this Privacy Policy to reflect changes in our Services, legal requirements, or data-processing practices. For material changes (e.g., new data uses or sharing practices), we will notify you at least 30 days in advance by emailing the address associated with your Account and posting a prominent notice on contactsplus.com. EU/EEA users must provide affirmative consent (e.g., via Account settings) for material changes affecting Personal Information processing, per GDPR Article 7. Continued use of the Services after non-material changes indicates acknowledgment of the updated policy.

15. How to Contact Us

For questions, complaints, or to exercise your rights (Section 10), contact us at:

• Email: support@contactsplus.com
• Data Protection Officer: dpo@contactsplus.com (for GDPR inquiries and complaints)
• Organization: Contacts Plus LLC, 3636 S. Geyer Road, Suite 100, Saint Louis, MO 63127
• Toll-free (California residents): 800-430-4095

We respond to inquiries within one month (GDPR Article 12(3)) or 45 days (CCPA Section 1798.130), extendable as permitted by law. Additional information is available in our Privacy Notice.