Contatta (“Contatta”, “we”, “us”) is a contact management platform offered as a web and mobile application by Contatta, Inc. This policy explains what information we collect, how we use it, and the choices you have. Questions: support@contatta.com.
1. Information we collect
Account information. Name, email address, and authentication details, managed through our sign-in provider (Clerk). Subscription and billing are handled by Clerk and its payment processor; we do not store your card details.
Contacts. Contact records you create in Contatta, contacts you choose to import or sync from connected accounts (Google, Microsoft, or device contacts), and contacts other Contatta users share with you and you accept, including names, email addresses, phone numbers, companies, titles, addresses, social profiles, photos, and custom fields you add.
Email. If you connect an email account, we sync message content (subjects, bodies, attachments, sender and recipient addresses, timestamps) so you can read your correspondence inside Contatta linked to the right contact, and send messages from your own address. When you connect, we import roughly the last 30 days of mail. Then, in the background, we import the mail you sent over the past year and the other messages in those same conversations, and keep syncing new mail from then on. People you have emailed who are not yet in your contacts may be suggested to you as possible contacts.
Calendar. If you connect a calendar, we sync event details (titles, times, participants) to show and schedule activities.
Content you create. Notes, timeline posts, activities, expenses and expense attachments, uploaded files, email you write in Contatta, in-app chat messages, and voice recordings when you speak to the assistant.
Usage and diagnostics. Log data, device and browser information, and error reports (via Sentry) used to keep the service working.
2. Google user data
Contatta requests the following Google permissions. We only use Google data to provide the features described here.
- Basic profile (email, profile): your name, email address, and profile photo, used to identify your connected account in the app.
- Contacts: your Google Contacts, used for import and two-way sync. Contacts you import appear in Contatta, and contacts in Contatta are created or updated in your Google Contacts. Two-way sync is on by default for a connected account and can be turned off.
- Gmail, read (gmail.readonly): your Gmail messages (subjects, bodies, attachments, sender and recipient addresses, dates), used to read your email inside Contatta linked to the right contact, including the past three years of mail you sent and the conversations it belongs to; to screen mail from unknown senders; and, if you turn on signature capture, to fill in contact details and photos from the signatures and attachments in that mail (Section 3). We do not modify, label, archive, or delete anything in your mailbox.
- Gmail, send (gmail.send): sending email from your own address, used to send the email you write in Contatta: a reply or reply all, a new message to a contact, one message to the contacts you check in a group (they are added as Bcc, so they do not see each other’s addresses), and a calendar invitation when you schedule an activity and choose to send one. Each message is sent only when you click Send.
Email sync runs through EmailEngine, software we host inside our own infrastructure; your mailbox is not shared with an outside email service.
Limited Use disclosure. Contatta’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
In line with that policy, we do not:
- use Google user data for advertising, or sell it to anyone;
- transfer Google user data to anyone except to provide or improve user-facing features that are visible and prominent in Contatta and only with your consent (including through the service providers listed in Section 5, which process it on our behalf under contract), for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent;
- allow humans to read your email, except with your explicit permission, where necessary for security or abuse investigation, to comply with law, or when the data is aggregated and anonymized for internal operations;
- use Google user data to train generalized artificial intelligence or machine learning models. The AI features described below use it only to produce the result described for each feature.
3. AI features
Some Contatta features are powered by third-party AI services (Anthropic and OpenAI). For each feature below, the specific content described is sent to the provider to produce the result, which is returned to us. Most of these run when you use them; inbound email screening runs automatically on the mail in any mailbox you connect, signature capture runs on your mail only after you turn it on, and calendar contact suggestions run automatically on the calendars you connect.
- Assistant (Primo). When you ask the assistant something, it can look up your contacts, calendar, expenses, notes, and recent communication summaries (including email subjects and short summaries) to answer you. Powered by Anthropic’s Claude.
- Voice input. When you speak to the assistant, your audio recording is sent to OpenAI to convert your speech to text.
- Contact AI profiles. When a contact briefing is generated, that contact’s details are processed to write the summary. Powered by Anthropic’s Claude.
- Inbound email screening. To sort real correspondence from automated noise, messages from senders who are not already in your contacts are screened automatically. The sender’s address and name, the subject line, and a few signals we compute ourselves (for example, whether the message carries unsubscribe text) are processed; the message body is not sent. Powered by Anthropic’s Claude.
- Signature capture (optional). This fills in your contacts’ details from the email signatures in your connected mail. It is off until you turn on “Fill in contacts from email signatures” in Settings. Once it is on, it runs in the background after the three-year import of your sent mail finishes (Section 1), and then once a day. Each run covers up to 25 of the contacts you have emailed. For each of those contacts we send Anthropic’s Claude up to 10 excerpts from that contact’s email (messages the contact sent you in conversations you took part in, and earlier messages from the contact quoted in your replies; each excerpt is the last 2,000 characters of the message, where a signature sits, and shorter messages are sent whole), along with the contact’s name and email addresses and your name and up to 5 of your email addresses, so your own signature is not mistaken for theirs.
Claude returns the contact’s job title, company, phone number, website, LinkedIn address, postal address, and other email addresses where a signature shows them. Separately, image attachments (JPEG or PNG, up to 3 per contact and 25 per run) on messages the contact sent you are sent to Claude to check whether an image is a photo of that person or their company’s logo; one that passes becomes the contact’s profile picture if the contact has none. The details are added to the contact automatically, only into fields that are empty (your own entries are never overwritten), and a note of the change is added to the contact’s history. Other email addresses, and earlier job titles and companies seen in older signatures, are only ever stored by us; they are never added to the contact automatically. If a signature in that mail belongs to someone who is not in your contacts, that person may be suggested to you as a possible contact.
Details and photos added this way become part of the contact, so people you collaborate on or share that contact with can see them (Section 5). You can turn signature capture off in Settings at any time, which stops future runs. Disconnecting a mailbox deletes the messages we stored from it, which also stops this processing for that mailbox. Details already added stay on the contact, and you can edit or remove them like any other detail; details we stored without adding stay with the contact until you delete it or your account.
- Calendar contact suggestions. When an event synced from a connected calendar has no other attendees and our own rules cannot tell from its title who the event is with, the event title (and nothing else from the event) is sent to Anthropic’s Claude to find that person’s name, so we can link the event to that contact or suggest adding them.
- Group images. If you generate a cover image for a group, the description you type is sent to OpenAI to create it.
This processing is inference only. We do not use your data to train AI models, these providers process it to return the result to us and not to train their models, and it is not used for advertising.
4. Contact enrichment
If you use the enrich feature on a contact, we send some of that contact’s identifiers to data providers to find additional public professional information, and you review the results before anything is saved:
- FullContact: email address and phone number (whichever the contact has), to find the person’s public LinkedIn profile.
- Crustdata: name and company; the contact’s business email addresses and their domain, or, if there is none, one of their other email addresses (which may be a personal address); and the LinkedIn profile address if known.
- Perplexity: name, company, and title, to find the person’s public LinkedIn profile. To build a profile briefing, or when other sources find no match: name, email address, phone number, LinkedIn profile address, and location.
The identifiers we send are taken from the contact as it is stored in Contatta, so they may have come from your connected Google account: for example an email address from your Google Contacts or your Gmail, or a phone number or LinkedIn address filled in from an email signature (Section 3).
What these providers return is cached and reused across Contatta accounts: if another user has already looked up the same person, you may be shown that stored result without a new request to the provider. The cache holds the identifier that was looked up (an email address, phone number, name and company, or LinkedIn address) together with the provider’s result. Results that found someone are kept indefinitely; lookups that found nothing are kept for a limited time. Deleting your account does not remove these cache entries (Section 7).
Enrichment runs when you choose to enrich a contact. We do not send contacts to these providers automatically, except that some earlier versions of our mobile app, if still installed, run the FullContact lookup automatically when you open a contact that has no LinkedIn profile.
5. How we share information
We never sell your personal information and never share it for advertising.
With other people you choose. Some features put parts of your data in front of other people, only when you use them:
- Send a contact. You can send a copy of a contact to another Contatta user, choosing which details go. Nothing reaches their account until they accept, and the copy is theirs afterwards.
- Share links. You can create a link to a contact card showing the details you pick. Anyone with the link can view it and download the card; a street address is included only in the download. Links expire, and you can revoke one at any time.
- Collaborate on a contact. When you invite someone to collaborate on a contact, the invitation shows them the contact’s name, title, and company. Once they join, the contact’s details, notes, meetings, calls, and todos (including events synced from a connected calendar, with their description, location, notes, and the names of the other people on them), and the files any of you upload to it are copied into each member’s own account, attributed to whoever added them. Each member chooses whether their earlier history with the contact is shared or only what they add after joining. Anyone can leave, and keeps what they already have.
- Orbits. When you invite collaborators to an orbit, they can see and edit the contacts in it and the notes, activities, files, comments, and expenses attached to them.
Email from your connected inboxes, including its attachments, is not shared through these features: it stays in your own account. Contact details and photos filled in from email signatures (Section 3) are the exception, because they become part of the contact and are shared along with it.
With service providers. We share data only with service providers that help us run Contatta:
- Amazon Web Services: hosting, storage, and infrastructure (all service data).
- Clerk: sign-in, account management, and billing (name, email, authentication and subscription data).
- Anthropic: AI features in Section 3 (the specific content described there, including email excerpts and image attachments for signature capture, and calendar event titles for calendar contact suggestions).
- OpenAI: voice transcription and image generation in Section 3 (voice recordings you make and image descriptions you type).
- FullContact: contact enrichment in Section 4 (email address and phone number of the contact, whichever it has).
- Crustdata: contact enrichment you request in Section 4 (name, company, email domain, an email address that is a business address or otherwise may be personal, and LinkedIn address of the contact you enrich).
- Perplexity: contact enrichment you request in Section 4 (name, company, and title of the contact you enrich; for a briefing or when other sources find no match, also their email address, phone number, LinkedIn address, and location).
- SendGrid: service emails such as invitations and notifications (recipient names and email addresses).
- Cronofy: calendar connection and scheduling (calendar credentials and event data for calendars you connect).
- TalkJS: in-app chat (chat messages and participant identifiers).
- Sentry: error monitoring (diagnostic and device data from crashes and errors).
- Google / Microsoft: the accounts you connect (data synced to and from those accounts at your direction).
We may also disclose information if required by law, to protect the safety and security of the service, or in connection with a merger, acquisition, or sale of assets (with notice to you; Google user data moves this way only after we obtain your explicit prior consent).
6. Storage and security
Your data is stored on Amazon Web Services infrastructure in the United States. Data is encrypted in transit using TLS. Access to production systems is restricted to authorized personnel. Contatta undergoes independent security assessment as part of Google’s API verification program, repeated annually.
7. Retention and deletion
We keep your data while your account is active.
- Disconnect a provider. You can disconnect Google, Microsoft, or calendar accounts in Settings at any time, which stops all syncing. Disconnecting a mailbox also deletes the messages we stored from it. Attachments from that mailbox that were saved to a contact’s Files, and contact details captured from its signatures (Section 3), stay until you delete them or your account. You can also revoke Contatta’s access directly at https://myaccount.google.com/permissions.
- Stop sharing. You can revoke a share link, leave a collaboration, or remove a collaborator from an orbit at any time. Copies another user has already accepted stay in their account.
- Delete your account. Deleting your account permanently deletes your data from our systems, including data obtained from Google, except the shared enrichment cache described in Section 4, which keeps the identifiers that were looked up and the providers’ results.
- Export. You can export your data from Settings.
To request deletion or a copy of your data, you can also email support@contatta.com.
8. Your choices
You choose which accounts to connect, which contacts to import or push, which contacts to enrich, what you share with other people and with whom, and whether to use the AI features you start yourself. Signature capture runs only if you turn it on, and you can turn it off at any time. Inbound email screening runs on the mail in any mailbox you connect, and calendar contact suggestions run on any calendar you connect; if you do not want them, do not connect that mailbox or calendar, or disconnect it. Core features of Contatta work without connecting any external account.
9. Children
Contatta is not directed to children under 13, and we do not knowingly collect their information.
10. Changes to this policy
We will post any changes here and update the date above. For material changes we will notify you in the app or by email.
11. Contact us
Contatta, Inc. | support@contatta.com