Privacy Policy

When you sign up and use ContactIQ we store:

• Email address — used to sign you in, send password resets and security notifications.
• Password — never stored in readable form; only a salted hash is kept by our authentication provider.
• Display name (optional profile field).
• Role (standard user or admin) and two-factor authentication enrolment status.
• Security events — timestamps and IP address of failed sign-in attempts, used only for brute-force lockout, plus an audit log of changes to your records.

ContactIQ stores the personal details you choose to enter about other people. That can include:

• Name, company, email address and phone number
• Free-text notes you write about the relationship
• A contact photo, if you upload one
• Colour-coded tags you assign
• Reminders (due date and note) and your interaction log — notes, calls, meetings, emails and their timestamps

You are the controller of this information. Only enter details you are entitled to keep, and only keep them for as long as you need them.

• To show you your contacts, reminders and history, and to power search.
• To send follow-up emails that you compose and explicitly choose to send.
• To answer your questions in the AI assistant. When you send a message, a read-only summary of your own contacts, tags and upcoming reminders is included so the assistant can answer usefully.
• To keep the service secure (rate limiting, lockouts, audit logging).

We never sell your data, never use it for advertising, and never use it to train AI models.

We use a small number of processors, each strictly to run the service:

• Cloud backend (Lovable Cloud, on Supabase) — hosting, database, file storage and authentication. Your database, contact photos and account records are stored in the United States (AWS US East, Ohio).
• AI provider (Lovable AI Gateway, Google Gemini) — receives only the message you type plus the read-only summary of your own records described above, and only when you use the assistant. Requests are processed on US infrastructure and are not used to train models.
• Email provider (Resend) — delivers the follow-up emails you send and transactional account emails; Resend processes and logs email metadata and content in the United States.
• Have I Been Pwned — during sign-up we check a partial, anonymised hash of your password against known breaches. Your password itself is never sent.

No other third parties receive your data, and we run no advertising or tracking SDKs.

All ContactIQ data — your account, your contacts and their personal details, notes, reminders, interactions and uploaded photos — is stored in the United States, in the AWS US East (Ohio, us-east-2) region. Our AI and email providers also process data in the United States. If you are outside the US, using ContactIQ involves an international transfer of your data, and of the personal data you store about your contacts, to the United States.

Data is transmitted over HTTPS and isolated per account with row-level security, so no other user can read your records. Contact photos live in a private bucket served through short-lived signed URLs. Admin access requires two-factor authentication.

Contacts, notes, reminders, interactions and photos are kept until you delete them. You can delete any contact — including its photo, tags, reminders and history — from its detail page at any time. From Account settings you can export a full copy of your data at any time, or permanently delete your account — this removes your profile, every contact and their personal details, photos, tags, reminders and history.

ContactIQ sets no advertising or analytics cookies by default. We use browser local storage for one strictly necessary purpose: keeping you signed in. This cannot be turned off without signing out, and is not used for tracking.

If non-essential cookies (for example product analytics) are ever enabled, we ask for your consent first with the banner shown on your first visit, and you can decline or change your mind at any time by clearing your browser storage for this site.

You can access, correct, export or delete your information at any time from within the app, or by contacting us. If you are in the EEA or UK you also have the right to object to processing and to lodge a complaint with your local data protection authority.

Questions about this policy or your data? Email privacy@contactiq.app.