Google user data
This section describes how ContactZapp accesses, uses, stores and shares data it receives from your Google account (Google user data) when you connect Google Contacts.
1.1 What Google data we access
If you connect a Google account, you sign in with Google and approve access on Google’s own consent screen. Our application will access the following data in your Google account, through these permissions (scopes), and no others:
- Google Contacts (
https://www.googleapis.com/auth/contacts) — read and write access to your Google contacts and contact groups: names, email addresses, phone numbers, addresses, organizations, birthdays, notes, photos and any other fields in your contacts. - Your Google account email, basic profile and identity (
userinfo.email,userinfo.profile,openid) — your email address and name, and the identifier that associates you with your Google account, to identify which Google account you connected.
1.2 How we use Google user data
We will use your Google data to provide you with the services you requested: to show them to you, sync them with your other connected accounts, find and merge duplicates, and write your changes back to Google. Changes are written to your Google account only as the service is configured to do, and read-only accounts are never written to. We use the email and profile information only to identify the connected account. We do not use Google user data for any other purpose.
1.3 How we store, protect and share Google user data
We use encryption to protect your information. Google contacts are stored on our servers in the European Union (Hetzner), encrypted with a key unique to your account, and encrypted in transit (see section 7). The Google access tokens that let us reach your account are stored encrypted and never logged. We do not transfer or disclose your Google user data to third parties for purposes other than the ones provided, and we do not share it with anyone except (a) our infrastructure provider that hosts the service (Hetzner), which processes it on our instructions and cannot read it, (b) Google Drive, where we keep an off-site copy of our backups for 30 days: the copy is encrypted before it leaves our servers, and Google cannot read it, (c) where you ask us to, or (d) where the law requires it. Our other providers (Cloudflare, Resend, Freemius, Google Analytics) never receive your Google contacts.
1.4 How long we keep it, and how to delete it
Your Google contacts stay in ContactZapp for as long as your account is open and the Google account stays connected. When you disconnect the Google account in ContactZapp, we delete its access tokens, and you can also delete the contacts we hold, or your whole ContactZapp account, from within the service or by writing to the privacy contact in section 9. You can withdraw ContactZapp’s access at any time at myaccount.google.com/permissions. Deleting data in ContactZapp never deletes anything in your Google account. When a retention period expires, we delete or destroy the data. Retention periods are in section 5.
1.5 Limited Use
ContactZapp’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing contact sync, de-duplication and merge features you see in ContactZapp.
- We do not transfer Google user data to others except to provide those features, to comply with the law, or as part of a merger or sale of assets with notice to you.
- We do not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
- We do not sell Google user data, and we do not give it to data brokers or information resellers.
- We do not use or transfer Google user data to determine credit-worthiness or for lending purposes.
- We do not use Google user data to develop, improve or train generative AI or other machine-learning models.
- Our staff do not read your Google user data, except with your explicit consent for a specific request (for example, a support case you ask us to investigate), where needed for security purposes such as investigating abuse, or where the law requires it.
What we collect, and why
2.1 The service
ContactZapp helps you manage your contacts. It keeps them in sync across the accounts you use — Google, Microsoft, Apple iCloud and any CardDAV address book — finds duplicates, merges them, and writes the result back. To do this, we process the data described below.
- Your contact data — names, email addresses, phone numbers, and any other fields in your address books, read from the accounts you connect. Why: to sync your contacts, find duplicates across accounts, merge them, and write the result back. Legal basis: performance of a contract (Art. 6(1)(b)) — the service cannot do its job without these records.
- Account and authentication data — your email address, and the tokens or app-specific passwords needed to read and write to each account you connect. Google and Microsoft connect through their own sign-in, so we never see your password for them. iCloud connects with an app-specific password you create. Whatever credential is needed is encrypted before storage and kept out of logs, exports and error messages. Legal basis: performance of a contract.
- Sync history and change history — what changed, when, and the ability to roll back to any earlier point. Legal basis: performance of a contract.
- Billing data — handled by our payment processor, Freemius (
freemius.com), not by us. We can see your email and name, but none of your billing data. We also receive the plan, its status, and your customer identifier.
Checkout and cookies. We sell our product(s) using Freemius secure checkout, which enables secure online payments, licensing, fulfillment, and more. Freemius automatically adds cookies when you open the checkout. Those are essential cookies for security, fraud detection & prevention, and completion of a purchase. There’s no way to check out without letting Freemius use cookies. See the Freemius privacy policy and its checkout cookie policy. If you wish to opt out of Freemius’ cookies setting, go to their cookie policy and follow their opt-out instructions.
For all the cookies used on this website and in the service, see our Cookie Policy.
2.2 This website
This website has no accounts, no login, and sets no cookies unless you accept them (section 4). It can collect two things:
- If you submit a form on this website: your email address, the page you submitted from, your IP address, a
sourcelabel identifying which form you used, and any subject or message you write. Depending on the form, this is stored in our database, emailed to us, or both. Legal basis: consent, given by submitting the form, when you sign up to hear from us; legitimate interest (Art. 6(1)(f)) when you write to us — responding to a message addressed to us. - Analytics: see section 4.
We do not use your contact data for advertising, profiling, or analytics, and we do not sell it or pass it to third parties, other than the service providers we use to run the service (see section 3).
2.3 Other information
- Providing data. To use the service you need to give us the contact data and account details described above; without them it cannot work. Filling in a form on this website is optional.
- Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
- Other people’s data. The address books you connect contain information about other people, such as your contacts. We receive it from you, through the accounts you connect, and process it only to provide the service.
- Data protection officer. We have not appointed a data protection officer. For any privacy question, use the privacy contact in section 9.
Where data is stored and who else sees it
Service data, including your contacts, is stored on servers in the European Union. As ContactZapp grows, storage may also open in other regions, so contacts for customers there sit closer to home, but we will never move the contact data of our European customers outside the EU.
We store and process it in compliance with the European General Data Protection Regulation (GDPR).
Website data (from the forms on this website) is stored in a Cloudflare database in the European Union. Our web pages themselves contain no customer data. Email content is transmitted to Resend (the email provider), which is based in the United States, when we email you.
Where personal data of people in the EU is transferred outside the EU, we rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
We do not sell personal data. The only people who receive it are us and the providers below, who process it on our instructions unless stated otherwise.
| Provider | What it handles | Where |
|---|---|---|
| Hetzner | The application, and the database holding your contacts | EU |
| Cloudflare | This website’s hosting, the database for website form submissions, and the form endpoints | Worldwide (personal data in the EU) |
| Resend | Transactional email — form confirmations, messages sent through website forms, error notices | Worldwide |
| Analytics on this website (section 4) and off-site backup storage. | Worldwide | |
| Freemius | Billing and subscription status | Worldwide |
Microsoft 365, Apple iCloud and Google Contacts are the accounts you connect, not our subprocessors. We only connect to your contacts there because you asked us to sync with them; they are governed by their own terms and privacy policies, and you can disconnect any of them at any time.
How long we keep it
- Your contacts: for as long as your account is open. Delete the account and they go with it. A free account that has not been signed in to for more than 3 months can be deleted, after we email you a warning at least 2 weeks before (see our Terms of Service).
- Sync history: up to 12 months. If you delete your account sooner, it goes with it.
- Customer account records: kept for 24 months after you close your account.
- Credentials (tokens, app-specific passwords): until you disconnect the account, then deleted. For a Google account this includes its Google access tokens.
- Website opt-ins: until you ask us to remove you, or 24 months after you sign up — whichever comes first
- Contact form messages: kept in email for as long as needed to deal with your question, and no more than 24 months.
- Analytics: Google Analytics data is kept for 14 months. The analytics cookies last up to 2 years (section 4).
- Backups: 24 months
Your rights
Under the GDPR, you have the right to:
- Access — ask what personal data we hold about you, and get a copy.
- Rectification — have anything inaccurate corrected. Most of this you can do yourself in the service, at source, in the account it came from.
- Erasure — ask us to delete your data. The service has a permanent erasure and a “start over from scratch” reset for this, and support will run it for you on request. Erasure in ContactZapp never deletes anything in Google, Microsoft, iCloud or your own CardDAV server — those are your accounts, and your contacts are still yours.
- Portability — get your data in a structured, machine-readable format. The service exports vCard files and a full account backup.
- Objection and restriction — object to processing based on legitimate interest, or ask us to pause it. If you do, we may not be able to provide the service.
- Withdraw consent — at any time, for anything we do on the basis of it. Withdrawing does not affect what we did before you withdrew. Signing up through a website form and consenting to analytics are separate and separately withdrawn.
- Complain to your data protection authority. ContactZapp is established in Italy, so that is the Garante per la protezione dei dati personali — not the authority where you happen to live. You can still ask your own authority to act on your complaint, but the one with jurisdiction over us is the Garante. Address: Piazza Venezia 11, 00187 Roma (garanteprivacy.it).
To exercise any of these, email the privacy contact in section 9 with “privacy request” in the subject. We respond within 30 days. We do not require an account number, and we will not ask you to prove who you are beyond what is needed to find the right person — if you are asking about data you gave us, we will find it.
This is a rights notice, not a contract. It does not limit any right you have elsewhere, and where this policy is vaguer than the law, the law wins.
Security
- Contact data is encrypted with a key unique to your account, not one shared key. That key is itself protected by a master key which is never stored in the database. As a result, contact data in the database is unreadable without the key. The database would still hold non-identifying operational data such as counts, statuses and timestamps.
- Data is encrypted in transit.
- Credentials for your connected accounts (app-specific passwords and tokens) are stored encrypted, and are never logged, exported, or included in error messages.
Changes to this policy
We update this when the product changes, not on a schedule. The “Last updated” date at the top always reflects the current version. If a change materially affects how your data is handled, we will say so in the product before it takes effect.
Who we are / Contact
This policy covers two things: the ContactZapp service (the app at https://app.contactz.app) and this marketing site at https://contactz.app.
The controller of both is Silvia Pugi, of Via Etna 2, 20144 Milano, Italy.
Privacy contact: support+privacy (at) contactz (dot) app
Tracking pixels in our emails
A tracking pixel is a tiny, invisible image in an email. When your email program loads it, the sender learns that the email was opened, and usually when, from roughly where, and on what device.
We may use tracking pixels in some of our emails, such as marketing emails. If we do, this is how, in line with the Italian Data Protection Authority’s guidelines on tracking pixels in email (17 April 2026):
- Consent first. If a pixel follows what you personally do, for example to tailor our campaigns or how often we write to you, we will use it only if you have said yes (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). We ask when we collect your email address or before the first tracked email, and the request is separate from, and not a condition of, getting our emails.
- Anonymous statistics. We may count overall opens of a campaign without consent, but only with a pixel that is identical for every recipient and cannot tell one person from another.
- Account and service emails. We will not use pixels in emails about your account or the service to track you as an individual.
- Your choice, any time. Every marketing email will link to a preferences page. There you can stop receiving our emails, or keep receiving them without pixels. Saying no to tracking does not change what you can do with ContactZapp.
- What we record. We keep a record of your choice so we can show it. When we send a tracked email, the pixel carries a random identifier that is kept apart from your email address, so the address itself is never in the request.
Our email provider, Resend, sends these emails for us and processes any tracking data on our instructions (section 3). If we use tracking pixels, we will state here what we collect and how long we keep it, and we will tell you in the product or by email as described in section 8. Questions or requests: the privacy contact in section 9.