← Back to Contactd

Privacy Policy

Last updated: March 17, 2026

This Privacy Policy describes how Contactd ("the Service", "Platform", "we", "us") collects, uses, stores, and protects your personal information when you use the Platform. By using the Service, you consent to the practices described herein.

1. Information We Collect

1.1 Account Information

When you register, we collect:

• Email address — used for authentication, account recovery, and service notifications;
• Display name (optional) — used for personalization within the Platform;
• Password — stored in a securely hashed format (bcrypt). We never store or have access to your plaintext password.

1.2 Messenger Account Data

When you connect Telegram or WhatsApp accounts to the Service, we store:

• Telegram: Encrypted session strings (Fernet encryption), phone number, and account display name. We do not store your Telegram password or 2FA code;
• WhatsApp: Session identifiers managed by the Baileys service layer. Authentication credentials (QR-code pairing data) are stored in encrypted form;
• Proxy configuration (if provided): proxy type, host, port, and authentication credentials for routing messenger connections.

1.3 Contacts and Campaign Data

You may upload or create contact records containing names, usernames, phone numbers, email addresses, company names, positions, countries, and cities. You may also create campaigns with message templates and scheduling configurations. You are the data controller for all contact data you input. We process this data solely on your behalf to provide the Service.

1.4 Message Data

We store records of messages sent through the Service, including recipient identifiers, message status (sent, failed, replied), timestamps, and error information. We may temporarily store message content for delivery processing and retry purposes. Message content is not used for any purpose other than facilitating delivery.

1.5 Usage and Technical Data

We automatically collect:

• Server access logs (IP addresses, request timestamps, user agent strings);
• Feature usage patterns and campaign analytics (aggregated);
• Error logs for debugging and service improvement.

1.6 Cookies

The Service uses essential cookies strictly for authentication (session tokens). We do not use third-party advertising cookies, tracking pixels, or analytics services that profile individual users.

2. How We Use Your Information

We use collected information for the following purposes:

• Service provision: authenticating your identity, connecting your messenger accounts, sending messages on your behalf, and displaying campaign analytics;
• Account management: processing registrations, managing subscriptions, and handling access keys;
• Security: detecting unauthorized access, preventing abuse, and enforcing our Terms of Service;
• Service improvement: identifying bugs, optimizing performance, and developing new features (using aggregated, non-personally-identifiable data);
• Communication: sending service-related notifications (e.g., account alerts, security warnings). We do not send marketing emails.

3. Data Sharing

We do not sell, rent, or trade your personal information to third parties. We may share data only in the following limited circumstances:

• Infrastructure providers: the Service runs on cloud infrastructure. Hosting providers may have physical access to servers but are bound by their own data protection obligations;
• Legal requirements: we may disclose information if required to do so by law or in response to valid legal process (court order, subpoena, regulatory request);
• Service protection: to enforce our Terms, protect the rights, property, or safety of the Service, its users, or the public;
• Business transfer: in the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy commitments.

4. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit;
• Fernet symmetric encryption for stored messenger session credentials;
• Bcrypt hashing for passwords;
• Database access restricted to application services only (no public exposure);
• Regular software updates and dependency patching.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

Data Type	Retention Period
Account information	Duration of active account. Deleted upon account deletion.
Messenger session credentials	Deleted immediately when account is disconnected or user account is deleted.
Contact data	Duration of active account. Deleted upon account deletion.
Message records	Duration of active account. Deleted upon account deletion.
Campaign data	Duration of active account. Deleted upon account deletion.
Server logs	Up to 90 days, then automatically purged.

Upon account deletion (initiated by the User or by an administrator), all associated data — including contacts, campaigns, message history, and messenger credentials — is permanently and irreversibly removed from the database.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you;
• Correction: request correction of inaccurate or incomplete data;
• Deletion: request deletion of your account and all associated data. You can do this directly from the Settings page;
• Data portability: export your contacts in CSV format via the Platform interface;
• Restriction: request that we limit the processing of your data under certain circumstances;
• Objection: object to processing of your data where we rely on legitimate interests;
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us through the support channels provided within the Platform. We will respond within 30 days.

7. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will take steps to delete it promptly.

8. International Data

The Service infrastructure is hosted on cloud servers. Your data may be stored and processed in jurisdictions different from your own. By using the Service, you consent to such transfer and processing.

9. Third-Party Platforms

The Service interacts with third-party messaging platforms (Telegram, WhatsApp). These platforms have their own privacy policies and data practices over which we have no control. We encourage you to review the privacy policies of any third-party platform you connect to the Service. We are not responsible for the privacy practices of these platforms.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform interface. Your continued use of the Service after changes are posted constitutes acceptance of the updated Policy. We encourage you to review this page periodically.

11. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through the support channels provided within the Platform.