Privacy, Data & Security

ContactID stores the minimum data required to run the service. Here is exactly what we collect, why, and how long we keep it.

1. Account Information

• Email address. For login and notifications.
• Password hash. Bcrypt-hashed (never plaintext).
• Full name. For invoices and profile display.
• Country and time zone. For localization and tax compliance.
• Sign-up date.

Retained for the life of your account. Deleted 30 days after account deletion.

2. Agents And Pitches

• Agent names. Your internal labels.
• Sender identities. Names, companies, emails used on forms.
• Pitch content. The messages you send.
• AI Personalization prompts.

Retained for the life of your account. Deleted immediately on account deletion.

3. Send History

• Every form submission. URL, agent used, timestamp, status, message sent.
• Failure reasons for failed sends.
• Screenshots (if screenshot capture is on).
• AI cost per send.

Retained for 12 months after send date. Automatically deleted after that. Deleted immediately on account deletion.

4. Payment Information

• Stripe customer ID. No card details.
• Payment history. Amount, date, plan, invoice.
• Subscription status.

Retained for 7 years for tax compliance. Not deleted on account deletion (legal retention).

5. Session Data

• Sign-in timestamps, device fingerprints, IP addresses.
• Active session tokens.

Retained for 12 months. Deleted 30 days after account deletion.

6. Import Files

• URL lists from CSV imports.
• Import job records.

Retained for 6 months after import. Deleted 30 days after account deletion.

7. What We Explicitly Don’t Store

• Your credit card number (Stripe stores this; we never see it).
• Personal emails from your inbox (unless you enabled Reply Tracking with limited scope).
• Browsing history outside of URLs you added to ContactID.
• Data from other browser tabs (extension only reads pages in your queue).

8. Aggregate Analytics

We store anonymized aggregate data (like “total form submissions this month across all users”) indefinitely. This data cannot be traced back to individual users.

9. Exporting Your Data

Under GDPR and similar laws, you have the right to export your data:

• Go to Account Settings > Export All Data.
• Get a downloadable archive with everything we have on you.
• Available within 24 hours of request.

10. Third-Party Data Sharing

ContactID shares data with:

• Stripe for payment processing (only what Stripe needs).
• AWS as our hosting provider (all data is encrypted at rest).
• AI providers (OpenAI, Groq, Google) for personalization (only pitch text and target URL; no personal data).
• Postmark for transactional email delivery.

Nothing is shared for marketing or sold to third parties.

Your pitch messages, agent data, and send history are private to your account. Here is exactly who can see what.

1. Pitch Content Storage

Your pitch messages are stored in ContactID’s database:

• Encrypted at rest on AWS-managed servers.
• Access-controlled: only your account can view them via the dashboard.
• Backed up with the same encryption.

Not readable by other ContactID users.

2. Who Has Access Internally

On the ContactID team:

• Support staff can view pitch content only when you share a specific record ID during a support ticket.
• Engineers can access production data only through emergency protocols requiring approval.
• Aggregate analytics team sees anonymized patterns, never individual messages.

Every internal access is logged and auditable.

3. AI Provider Access

When AI Personalization is used:

• Your pitch template + the target website’s public content is sent to the AI provider (OpenAI, Groq, Google).
• The AI provider returns the personalized version.
• Standard AI providers do not retain your prompts (per their published policies).

Sensitive pitches (with personal or confidential content) should not use AI Personalization; keep them plain.

4. Sent Content

Once submitted through a contact form:

• The content is transmitted directly from ContactID via your browser to the target website.
• The target site owns the content once received.
• ContactID has no control over what the target does with the content.

Treat every send as if it’s going to a public place; the recipient can share it or repost it.

5. Screenshots And Records

• Screenshots of filled forms are stored in your private account storage.
• Send records in Activity are yours only.
• Reply-tracked emails stay in your inbox; ContactID stores only sender + timestamp + first 200 chars.

6. Team Access (If Applicable)

Currently ContactID accounts are single-user. If enterprise multi-user access is enabled:

• Only users you explicitly grant access can see your pitches.
• Enterprise plans include audit logs for team access.

7. Data Requests From Law Enforcement

If ContactID receives a valid legal request for user data:

• We respond as required by law.
• We notify you (unless the law prevents notification).
• We provide only what’s specifically requested.

This is rare; usually less than 5 requests per year.

8. Encryption In Transit

• All connections to ContactID use HTTPS (TLS 1.3 where supported, 1.2 fallback).
• Database connections are TLS-encrypted.
• AI provider connections are TLS-encrypted.

Man-in-the-middle attacks on your pitch content are not feasible.

9. Deleting Pitch Content

• Delete an agent removes the pitch from your account.
• Delete individual sends in Activity removes those records.
• Delete your account removes all pitch content within 30 days.

Under GDPR (Europe) and equivalent laws (CCPA in California, LGPD in Brazil), you have specific rights over your data. ContactID complies with these rights globally, not just where required. Here is how.

1. Your Rights Summarized

• Right to access. See all data ContactID has on you.
• Right to rectification. Correct inaccurate data.
• Right to erasure (“right to be forgotten”). Delete your data.
• Right to portability. Export your data in a machine-readable format.
• Right to object. Stop specific processing (like marketing).
• Right to restrict processing. Pause data use pending investigation.

All available to every user regardless of location.

2. Exercising Right To Access

• Go to Account Settings > Data Export.
• Click Export All Data.
• Receive a downloadable archive within 24 hours.
• Archive contains everything ContactID has on you.

3. Right To Rectification

• Edit any incorrect data via the normal dashboard (profile, agents, etc.).
• For historical data (past sends, past invoices) that cannot be edited: contact support.

4. Right To Erasure

• Go to Account Settings > Delete Account.
• Confirm deletion.
• Data is deleted within 30 days.

Some data may be retained for legal reasons (see next section).

5. What ContactID Retains After Deletion

Deletion has exceptions dictated by law:

• Payment records retained for 7 years (tax law).
• Aggregate analytics retained forever (anonymized, cannot be re-identified).
• Legal hold data retained during active legal proceedings.

6. Right To Portability

Data Export (see step 2) is machine-readable and portable:

• JSON format for structured data.
• CSV for tabular data (Activity, sends).
• Standard formats for images (PNG for screenshots).

You can import this into your CRM, backup, or another tool.

7. Right To Object And Restrict

• Marketing objection: Toggle marketing emails off in Notifications.
• Restriction requests: Contact support with the specific processing you want restricted.

8. Response Time

GDPR requires response within 30 days for most requests. ContactID responds within:

• 24 hours for data export.
• 24 hours for deletion.
• 5 business days for other rights requests.

9. Age Verification

ContactID does not accept users under 16 (18 in some jurisdictions). If you learn a minor is using the service:

• Contact support with details.
• We suspend the account pending verification.
• Underage accounts are deleted.

10. Data Processing Contract (DPC)

Business customers processing personal data through ContactID can request a Data Processing Contract:

• Contact [email protected].
• We provide a standard DPC template.
• Required for many enterprise procurement processes.

ContactID uses cookies and browser storage for essential functions. Here is what each cookie does and how to control them.

1. Cookie Categories

• Essential. Required for the site to work (session, CSRF protection).
• Analytics. Anonymized usage patterns to improve the product.
• Functional. Preferences (language, timezone).
• Marketing. None on ContactID currently.

2. Essential Cookies (Cannot Be Disabled)

• Session cookie. Your sign-in.
• CSRF token. Prevents cross-site request forgery.
• Consent state. Remembers your cookie preferences.

Without these, the site doesn’t work.

3. Analytics Cookies (Toggleable)

• Anonymized page views. Which pages of the dashboard get used.
• Feature usage. Which buttons get clicked.
• Error tracking. Anonymized error reports.

We use these to prioritize product improvements. No individual user is identified.

Toggle in Account Settings > Privacy > Analytics.

4. Functional Cookies (Toggleable)

• Language preference.
• Timezone.
• Dashboard layout preferences.

Toggle off means you re-enter preferences each session.

5. No Cross-Site Tracking

ContactID does not:

• Set third-party tracking cookies.
• Sell data to advertisers.
• Include Google Analytics for external ad targeting.
• Include Facebook Pixel or similar.

Our analytics stay on our own infrastructure.

6. Extension Storage

The Chrome extension uses local storage instead of cookies:

• Sandboxed to ContactID by Chrome.
• Other extensions and websites cannot read it.
• Cleared when you uninstall the extension.

7. Third-Party Cookies From Integrations

When you use integrations:

• Stripe checkout sets cookies for payment security.
• Google sign-in sets cookies for the Google flow.

These are set by Stripe/Google directly, controlled by their policies.

8. Managing Cookies

Beyond our toggles:

• Browser settings let you block or delete cookies.
• Blocking essential cookies breaks ContactID; do not block.
• Blocking analytics is safe.

9. Do Not Track Signal

ContactID respects browser Do Not Track signals:

• If DNT is on, analytics is automatically disabled.
• Essential cookies still fire (required for function).

10. Cookie Retention

• Session cookie: Cleared when session expires (30-day sliding).
• Analytics cookies: 1 year.
• Functional cookies: 1 year.

ContactID’s design choices around bot protection and automation reflect a specific ethical stance. Here is the philosophy and how it affects your outreach.

1. Respecting Target Site Preferences

When a site has bot protection (Cloudflare, hCaptcha, reCAPTCHA), the site owner has expressed a preference:

• No automated submissions.
• Direct human interaction only.
• Or slower, more thoughtful outreach.

ContactID respects this preference by not bypassing bot protection. This is the ethical baseline.

2. Why We Don’t Bypass

Two reasons:

• Ethical. Respecting the site owner’s expressed preference is right.
• Practical. Bypassing gets your account/IP banned, damages long-term deliverability, and creates arms-race dynamics that make outreach worse for everyone.

3. Transparency Via Signature

Every ContactID message includes the signature “Sent via ContactID extension”. This:

• Tells recipients the message was sent through an automated tool.
• Lets recipients make informed decisions about how to respond.
• Complies with automated-message disclosure laws in many jurisdictions.

4. Rate Limits On Sending

ContactID enforces:

• 60 submissions per minute maximum per account.
• Per-day caps on lower plans.

These limits prevent bad actors from overwhelming target sites and preserve the ecosystem’s health.

5. Content Restrictions

Certain use cases are prohibited:

• Sending spam, malware, phishing.
• Sending sexual content or harassment.
• Impersonating others.
• Sending to sites that have explicitly asked to be removed.

Violation results in account suspension and (for severe cases) legal action.

6. Duplicate Prevention

The 7-day recontact cooldown per domain:

• Protects target sites from repeated submissions.
• Encourages you to nurture responses instead of pounding.

7. Blocklist Of Sensitive Domains

ContactID does not send to:

• Government sites (federal, state, local).
• Consumer platforms (Facebook, Instagram, LinkedIn).
• Adult content sites.
• Sites that have explicitly requested to be removed.

These blocklists are maintained centrally and are not user-configurable.

8. Acceptable Use Enforcement

ContactID monitors for:

• Unusual send patterns (mass identical content, very high failure rates).
• Content flagged by AI moderation.
• Complaints from target sites.

Repeated violations lead to account suspension.

9. Contact Form Etiquette

Beyond ContactID’s rules, best outreach etiquette:

• Personalize at least the first sentence.
• Be specific about what you want.
• Don’t follow up more than once or twice.
• Respect “no” responses.
• Don’t harass.

Following these keeps your reply rate high and your sending reputation clean.

10. When To Not Use ContactID

Not every use case is right for automated outreach:

• Existing relationships. Use email or phone directly.
• Referred introductions. A warm intro is more valuable than automation.
• Personal contact forms (like a musician’s fan contact). Manual reachout is more appropriate.
• Very high-value pitches. Custom work deserves custom outreach.

Use ContactID where the volume + personalization tradeoff makes sense.

The full ContactID Terms of Service are at contactid.app/terms. This article summarizes the acceptable use rules that most affect your day-to-day.

1. Acceptable Uses

ContactID is designed for legitimate B2B outreach:

• Sales prospecting.
• Partnership pitches.
• Recruiting outreach.
• PR and link-building.
• Business development.
• Cold outreach for any legitimate business purpose.

2. Prohibited Uses

Absolutely not allowed:

• Spam. Sending irrelevant, unsolicited commercial content at scale to random recipients.
• Malware or phishing. Content designed to deceive or harm.
• Sexual content or harassment. Any inappropriate content directed at recipients.
• Impersonation. Pretending to be someone you’re not.
• Terms-of-service violations of target sites. Bypassing bot protection, evading blocklists.
• Illegal activity. Anything violating applicable laws.

3. Content Moderation

ContactID has content moderation in place:

• AI checks message content for prohibited categories.
• Human review for flagged content.
• Automated flagging of suspicious patterns.

Flagged content pauses your batch pending review.

4. Complaints From Target Sites

If target sites complain to us about your outreach:

• We investigate the specific complaint.
• Legitimate complaints result in warnings or account suspension.
• Frivolous complaints (from sites that just don’t want any outreach) result in domain-level blocklisting.

5. Consequences For Violations

• First warning. Notice via email; batch stopped.
• Second violation. Temporary suspension (7-30 days).
• Severe or repeated violations. Permanent account termination.
• Illegal content. Immediate termination + potential legal action.

6. Age Restrictions

• Must be 16+ (18+ in some jurisdictions) to use ContactID.
• Under-18 accounts are suspended when detected.
• Corporate accounts must be created by authorized representatives.

7. Account Sharing

• One person per account.
• Team access requires enterprise plan.
• Sharing credentials for cost reasons violates terms.

8. Data You Send To Recipients

• You are responsible for the legality and accuracy of content you send.
• ContactID facilitates delivery but is not the sender of record.
• Comply with anti-spam laws in your and the recipient’s jurisdiction.

9. Refund Rights

Terms of Use includes:

• 30-day money-back guarantee for credit packages.
• 7-day money-back guarantee for annual plans.
• No refund guarantees for monthly subscriptions past initial purchase.

10. Changes To Terms

• We may update terms periodically.
• Material changes get email notice with 30-day advance warning.
• Continued use after change constitutes acceptance.

11. Governing Law

• ContactID operates from Toronto, Canada.
• Disputes governed by Ontario law.
• Enterprise contracts may specify different governing law.

12. Full Terms

The summary above is not comprehensive. For complete details:

• Read contactid.app/terms
• Consult a lawyer if you have specific questions.
• Contact support for interpretation of specific clauses.