Privacy & Data

Privacy, Data & Security

What data contactID stores, how your message content stays private, your GDPR rights, cookie controls, how we handle bot protection ethically, and the acceptable-use terms that govern your account.

Here is exactly what contactID keeps about you, and why.

1. Account Your email, name, optional phone, company details, your sign-in method (Google id or a password hash), your Google profile photo address when you sign in with Google, sessions (30-day sliding), and your plan and payment history through Stripe (we never see your card number). Each session also records the browser and IP address it was opened from, for security. If you save a card for automatic top-ups, contactID keeps only its brand, last four digits and expiry date. When you sign up, your email address is also sent to User.com, the customer messaging service contactID uses, and your name and country are sent there when you save your Profile.

2. Senders (Agents) Everything you enter on the Agent tab, including the message, so it syncs across your browsers. The answers you give once on the Send tab (listed on the Agent tab under Answers to form questions) are the exception: they stay in the browser where you gave them.

3. Websites And Results The websites you import, their category, and for every submission: the website, the time, the agent used, timings, the outcome with its reason (the reason for a skipped website can quote an answer you gave once), and the form fields with the values contactID typed into them (your own details, your message and the answers you gave once on the Send tab). This is what the Analytics page shows. For each import, contactID also keeps the personal message and extra columns your file gave each website. On Find websites, contactID keeps your searches, your lead lists (the businesses unlocked for you) and, for Enrich my file, the rows of the file you upload. When you use Search by AI, the sentence you type is sent to an AI provider only to turn it into a search; contactID records that a search ran, not the sentence.

4. AI Your prompts, and for every AI request the model, tokens and cost. What goes to the AI provider (your prompt or your AI writer brief, the website’s name and address, and your name, company and job title, never your full message) is used only to generate your message.

5. What We Do Not Keep Screenshots of websites, the content of websites you contact, or the replies you receive.

6. Deleting There is no delete button in the dashboard or the extension; to delete your account, email [email protected] from the account’s address (see GDPR And Data Deletion). Cleared websites on the Send tab are removed from the list only; Analytics keeps the record until the account is deleted, and single records cannot be deleted.

Related questions:

Your pitch messages, agent data, and send history are private to your account. Here is exactly who can see what.

1. Pitch Content Storage Your pitch messages are stored in contactID’s database:

Encrypted at rest with our cloud hosting provider.
Access-controlled: only your account can view them via the dashboard.
Backed up with the same encryption.

Not readable by other contactID users.

2. Who Has Access Internally On the contactID team:

Administrators can see account, billing and usage details, and your agents (including their messages), in contactID’s admin panel, to handle support, billing and abuse.
Administrators can sign in to your account, for example to look into a problem you reported. Every such sign-in is recorded in our audit log.
Nobody reviews your messages before they are sent. contactID does not review or moderate your content.

Changes the team makes to your credits and plan are also recorded in the audit log.

3. AI Provider Access When AI Personalization is used:

For each website, contactID sends the AI prompt you saved, the website’s name and address, the industry contactID guessed from its domain name, and your name, company and job title to the provider of the model you chose for the agent (OpenAI, Anthropic or Google). Your full message and the website’s pages are not sent.
The AI provider returns the personalized version.
Standard AI providers do not retain your prompts (per their published policies).

Sensitive pitches (with personal or confidential content) should not use AI Personalization; keep them plain.

4. Sent Content Once submitted through a contact form:

The content is transmitted directly from contactID via your browser to the target website.
The target site owns the content once received.
contactID has no control over what the target does with the content.

Treat every send as if it’s going to a public place; the recipient can share it or repost it.

5. Screenshots And Records

Screenshots: contactID does not take or keep screenshots of websites or forms.
Send records on the dashboard Analytics page are yours only. They include the values contactID typed into each form (your own details and your message).
Replies arrive in your own inbox. contactID does not read, track or store them.

6. Team Access contactID accounts are single-user. There is no team or multi-user access and no enterprise plan. Anyone you let use your sign-in sees everything in the account, and you are responsible for what they do.

7. Data Requests From Law Enforcement If contactID receives a valid legal request for user data:

We respond as required by law.
We notify you (unless the law prevents notification).
We provide only what’s specifically requested.

This is rare; usually less than 5 requests per year.

8. Encryption In Transit

All connections to contactID use HTTPS (TLS 1.3 where supported, 1.2 fallback).
AI provider connections are TLS-encrypted.

Man-in-the-middle attacks on your pitch content are not feasible.

9. Deleting Pitch Content

Delete an agent removes it from your agent lists and stops it from being used. The deleted agent, with its message, stays stored on your account, and messages already sent with it stay in your Analytics records.
Send records cannot be deleted one by one; the Analytics page has no delete option.
Delete your account by asking support (see GDPR And Data Deletion). Your data is then removed as the Privacy Policy describes: within 30 days, except records the law requires us to keep.

Related questions:

You can ask us to delete your account, and we honor data requests under GDPR.

1. Deleting Your Account There is no delete button in the dashboard or the extension. Email [email protected] from the account’s address and ask for the account to be deleted. Cancel any subscription first with Cancel subscription on the Plan & Billing page, because closing the account does not stop Stripe billing by itself. Credits, subscriptions and history are lost, and your personal data is removed as the Privacy Policy describes: within 30 days, except records the law requires us to keep.

2. Exporting Before You Delete Use Advanced Export in the extension for your websites and agents, Export… on the dashboard Analytics page for your send history, and Manage billing (Manage payment method when you have a plan) on the Plan & Billing page, which opens Stripe’s billing page, for your invoices.

3. Data Requests Email support from the account’s address to request a copy of your data or a correction. Requests are answered within 30 days.

4. What Stays Invoices and payment records are kept as long as accounting rules require; they hold your email and the amounts, not your website lists or messages.

Related questions:

contactID uses only essential browser storage, for your sign-in and a few settings, and no analytics or advertising cookies. Here is what is stored where, and which outside services are involved.

1. What contactID Keeps In Your Browser

Dashboard sign-in. The dashboard keeps your sign-in (a session token) and your name and email in the browser’s storage for the contactID site. A session lasts 30 days and is extended while you use contactID; signing out ends it on the server, in the dashboard and in the extension.
Dashboard preferences. Small settings, such as a notice you dismissed.
Extension data. The extension keeps your sign-in, your settings and your website list (with each website’s status) in Chrome’s extension storage on your computer.

2. No Analytics Or Advertising Cookies contactID does not:

Set analytics, advertising or cross-site tracking cookies.
Include Google Analytics, Facebook Pixel or similar trackers.
Sell data to advertisers.

There is no cookie banner and no analytics setting to switch off, because there are no optional cookies. A browser’s Do Not Track signal makes no difference for the same reason.

3. What Our Server Records

Sign-ins and account events, with the browser type and IP address, for security.
Your sends, imports and usage, which power your Analytics page and your balance.
When you sign up, your email address is also sent to User.com, the customer messaging service contactID uses. Your name and country are sent there when you save your Profile.

4. Extension Storage The Chrome extension uses its own storage instead of cookies:

Sandboxed to contactID by Chrome.
Other extensions and websites cannot read it. Only the contactID dashboard can ask the extension for your sign-in, which is how one sign-in covers both.
Cleared when you uninstall the extension.

5. Third-Party Services

Stripe runs checkout and its payment script on the billing pages, and sets its own cookies for payment security.
Google sign-in happens on Google’s own pages, under Google’s cookies.
Support chat in the dashboard is the Chatgram widget, a brandID product. Its script loads from the jsDelivr CDN, and what you write in the chat goes to Chatgram’s own server.
Fonts for the dashboard load from Google Fonts.

These are controlled by each provider’s own policies.

6. Managing Browser Storage

contactID keeps your dashboard sign-in in the browser’s site storage, not in a cookie. If you block all cookies and site data for the dashboard, it cannot keep you signed in. Stripe checkout and Google sign-in use their own cookies.
Clearing site data for the dashboard removes the saved sign-in there. If the extension is still signed in, the dashboard picks that sign-in up again; use Sign out to end both.
Removing the extension deletes what it stored on your computer. Your agents and your Analytics history stay on your account.

Related questions:

contactID’s design choices around bot protection and automation reflect a specific ethical stance. Here is the philosophy and how it affects your outreach.

1. Captchas And Bot Checks A captcha on a contact form is there to stop spam bots. contactID solves captchas on contact forms so that a relevant, personal business message can be delivered, and it keeps the rest of its behavior human:

Each website opens in a real Chrome tab and every field is typed at a natural pace.
A website that fails is reported with the reason; it is tried again only when you ask.
Full-page blocks that judge behavior (Akamai, PerimeterX, DataDome and similar) are not defeated.

2. Why We Stop There Two reasons:

Ethical. A site that blocks automated visitors entirely has made a choice; contactID reports it and moves on.
Practical. Forcing through those blocks gets IP addresses banned, damages long-term deliverability, and creates arms-race dynamics that make outreach worse for everyone.

3. Transparency Via Signature Accounts that have never made a purchase end every message with the line “Sent via contactID extension” (plain text, no link). This:

Tells recipients the message was sent through an automated tool.
Lets recipients make informed decisions about how to respond.

Any purchase (a credit pack, a plan, AI credits or lead credits) removes the line for good, unless that payment is refunded or charged back. A live subscription (gift plans included) or a signature waiver (earned through referrals or given by the contactID team) removes it while it lasts. With or without the line, you must never hide or misrepresent who is sending the message.

4. Pacing On Sending contactID has no per-minute or per-day send cap. The pace comes from how a run works:

Up to 5 websites are filled at the same time by default (Form Filling Concurrency in Settings).
The same website gets at most one new form every 45 seconds during a run.

Keep your volume to what you can follow up on, and to what the websites you contact will welcome.

5. Content Restrictions Certain use cases are prohibited:

Sending spam, malware, phishing.
Sending sexual content or harassment.
Impersonating others.
Sending to sites that have explicitly asked to be removed.

Violation results in account suspension and (for severe cases) legal action.

6. Duplicate Prevention The Contacted before guard shows every website this account already submitted to before a run, so you can skip it. There is no automatic waiting period; the decision stays with you.

Protects target sites from repeated submissions.
Encourages you to nurture responses instead of pounding.

7. Sites You Must Not Target contactID does not block any website for you; what you send to is your responsibility. The Terms of Service do not allow sending to:

Government portals and emergency services.
Healthcare intake forms, complaint systems, support ticket systems, or any form meant for something other than business inquiries.
Websites whose terms forbid automated submissions.
Anyone who asked you to stop.

Remove these from your list before you start a run.

8. Acceptable Use Enforcement contactID monitors for:

Patterns that look like prohibited use.
Complaints and abuse reports from the websites you contact.

contactID does not read or moderate your messages before they are sent.

Repeated violations lead to account suspension.

9. Contact Form Etiquette Beyond contactID’s rules, best outreach etiquette:

Personalize at least the first sentence.
Be specific about what you want.
Don’t follow up more than once or twice.
Respect “no” responses.
Don’t harass.

Following these keeps your reply rate high and your sending reputation clean.

10. When To Not Use contactID Not every use case is right for automated outreach:

Existing relationships. Use email or phone directly.
Referred introductions. A warm intro is more valuable than automation.
Personal contact forms (like a musician’s fan contact). Manual reachout is more appropriate.
Very high-value pitches. Custom work deserves custom outreach.

Use contactID where the volume + personalization tradeoff makes sense.

Related questions:

The full contactID Terms of Service are at https://contactid.brandid.app/terms. This article summarizes the acceptable use rules that most affect your day-to-day.

1. Acceptable Uses contactID is designed for legitimate B2B outreach:

Sales prospecting.
Partnership pitches.
Recruiting outreach.
PR and link-building.
Business development.
Cold outreach for any legitimate business purpose.

2. Prohibited Uses Absolutely not allowed:

Spam. Sending irrelevant, unsolicited commercial content at scale to random recipients.
Malware or phishing. Content designed to deceive or harm.
Sexual content or harassment. Any inappropriate content directed at recipients.
Impersonation. Pretending to be someone you’re not.
Terms-of-service violations of target sites. Submitting to websites that forbid automated submissions, or to government portals, emergency services, healthcare intake forms, complaint systems and support ticket systems.
Illegal activity. Anything violating applicable laws.

3. Content Review contactID does not read, review or moderate your messages or your lists before they are sent. You are the sender and you are responsible for every message. contactID acts on credible abuse reports and on patterns that look like prohibited use.

4. Complaints From Target Sites If target sites complain to us about your outreach:

We investigate the specific complaint.
Credible complaints can lead to throttling, suspension or termination of the account.
contactID does not block websites for you. When a site asks not to be contacted, remove it from your own lists.

5. Consequences For Violations

Suspension. The account is signed out of the extension and the dashboard at once and cannot be used until the contactID team lifts the suspension.
Termination. Serious or repeated breaches can close the account, with or without notice depending on severity. Unused credits are forfeited when termination follows a breach.
Illegal content. Immediate termination + potential legal action.

6. Age Restrictions

You must be at least 18 years old and able to enter a binding contract.
Under-18 accounts are suspended when detected.
Corporate accounts must be created by authorized representatives.

7. Account Sharing

One person or organization per account.
There is no team access. You are responsible for everything done under your account, including by anyone you let use it.
Extra accounts to get more free credits, trials or gift access are not allowed, and credits cannot be shared or transferred.

8. Data You Send To Recipients

You are responsible for the legality and accuracy of content you send.
contactID facilitates delivery but is not the sender of record.
Comply with anti-spam laws in your and the recipient’s jurisdiction.

9. Refund Rights Terms of Use (section 8) says:

Credits already used are not refundable.
Subscription fees for a period that has already started are not refunded automatically.
Charges made in error, duplicated, or caused by a failure on our side are investigated and corrected.
Other refunds are decided case by case. Write to [email protected] with your account email and the transaction details.

10. Changes To Terms

We may update terms periodically.
Material changes are announced by email, in the product, or both, before they take effect.
Continued use after change constitutes acceptance.

11. Governing Law

contactID is operated by WATCHTHEMLIVE, Ontario, Canada.
Disputes governed by Ontario law.
Consumers keep any right their local law gives them to bring proceedings where they live.

12. Full Terms The summary above is not comprehensive. For complete details: