ContaplyPrivacy Policy
Last updated: 25 October 2026
Contaply is in beta and is operated by the Contaply team. This policy will name the registered operating company before paid plans begin.
Who we are
Contaply is an online contact-management (CRM) service for small businesses and non-profit organisations (“organisations”). In this policy, “we” and “us” mean the Contaply team. You can reach us at [email protected].
Two kinds of personal data
1. Data about our users. When you sign in, we receive your name, email address and, if you use Google, your profile picture. We keep which organisations you belong to and your role in each, when you last used the service, and an audit record of changes you make. For this data we decide how it is used (we are the “controller”).
2. Data an organisation keeps about its contacts. Organisations use Contaply to store details about the people they work with — for example names, phone numbers, email addresses, consent choices, group memberships and event replies. For this data the organisation is the controller and we process it only on its instructions, to provide the service (we are the “processor”). If you are a contact of an organisation that uses Contaply, please contact that organisation first about your data; we will help it respond.
What we use data for
- To run the service: signing you in, showing you your organisation’s data, sending the messages and invitations your organisation asks us to send.
- To keep it secure: detecting abuse, limiting requests, and keeping audit records.
- To tell you about the service: important notices about your account or changes to these terms. We do not send marketing email.
We do not sell personal data, use it for advertising, or share it with other organisations using Contaply.
Messages and consent
Contaply sends campaign messages only to contacts the organisation has recorded as having agreed to that channel. Every campaign message includes a link where the recipient can stop further messages; the link can only withdraw agreement, never give it. Invitation emails are sent only when an organisation’s administrator invites a named person.
Where data is stored and who helps us
Data is stored with Amazon Web Services in the EU (Ireland, eu-west-1), encrypted at rest and in transit. We use these service providers (“sub-processors”):
- Amazon Web Services — hosting, database, file storage and email delivery.
- Cloudflare — domain name service and forwarding of email sent to our contaply.com addresses.
- Google — sign-in, when you choose “Sign in with Google”.
- Messaging providers an organisation connects itself (for example WhatsApp Business or Twilio), when it chooses to.
How long we keep data
An organisation’s data is kept while the organisation uses Contaply. Administrators can erase individual contacts at any time; erasure removes the contact’s details, consent history and photo. When an organisation’s owner asks us to delete it, its data is removed within 30 days, except where we must keep records for legal reasons. Backups expire on a rolling basis.
Your rights
Depending on where you live (for example under the EU GDPR or Bahrain’s Personal Data Protection Law), you may have the right to access, correct, export or erase your personal data, to object to or restrict its use, and to complain to a data-protection authority. Email [email protected] and we will respond within 30 days.
Children
Contaply is meant for organisations and is not directed at children. Organisations are responsible for having a lawful basis for any contact data they store.
Changes
We will update this page when our practices change and, for significant changes, tell organisation owners by email before they take effect.