Supacontacts Privacy Policy

Last updated: October 9, 2026

The short version

We built Supacontacts to do one narrow, useful thing: read your Gmail and Google Calendar to find the contact details buried in them — phone numbers, titles, companies, addresses — clean those up, write the good ones back into your Google Contacts, and then help you understand your network. To do that, you connect your Google account and approve exactly what we can touch on Google's own consent screen.

Here is the whole promise in four lines:

• We read your email and calendar. We never change them. Gmail and Calendar access is read-only. We never send, reply to, delete, or move anything, and nothing on your calendar ever changes.
• We only write to Google Contacts. We create new contacts and add missing details to existing ones. We don't overwrite what you've set, and the only things we ever remove are contacts or details we added ourselves (for example, when you undo a change or merge two contacts).
• Your email content is never sold, never used for advertising, and never used to train or fine-tune AI models. We do send it to trusted AI providers to process it and deliver the service — under contracts that forbid them from training on it. Processing is not training. More on that distinction below.
• You're in control. Disconnect from Supacontacts or straight from your Google account anytime, revoke our access in one click on Google, and ask us to delete your data whenever you want. Your enriched contacts stay in Google Contacts, where they were always yours.

The rest of this document is the careful version. We've kept it as plain as we can.

Who we are

Supacontacts is operated by Supacontacts LLC ("Supacontacts," "we," "us," or "our"), a limited liability company based in California, United States. Our registered address is 2108 N St STE N, Sacramento, CA 95816.

If you have a privacy question, the fastest way to reach us is legal@supacontacts.com. Our data-protection contact is Vikas Gupta, our founder/CEO.

This policy explains what we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to our website, our waitlist, and — once it's available to you — the Supacontacts application. It does not cover Google's own handling of your data (see Google's Privacy Policy) or any third-party service you connect us to.

The two kinds of data we handle

This is the most important idea in this policy, so we'll put it up front. We treat two categories of data very differently.

1. Google User Data — your email, calendar, and contacts content. This is the message text, calendar events, and contact records we access through Google's APIs, plus everything we extract or derive from them (a phone number pulled from a signature, a company inferred from an email domain, a "last met" date read off your calendar). This data is locked down. We use it only to provide and improve the features you see in the product. We do not sell it, we do not use it for advertising, and we do not use it to train, fine-tune, or otherwise improve any AI model. This is both our own commitment and a requirement of Google's API rules, described in the Limited Use section below.

2. Account and Usage Data — how you sign up for and use Supacontacts. This is your account email, billing details, the analytics and device/log data we collect when you use the product, and support correspondence. We handle this like a normal software company does: we use it to run the service, bill you, keep things secure, improve the product, understand what's working, and market our own products to you. We reserve broader latitude here — but even here, we never use your Google User Data to target advertising, and we never "sell" your personal information as California law defines that term without giving you notice and a choice.

When this policy says "Google User Data" or "your email content," we mean category 1. When it says "Account and Usage Data," we mean category 2.

What you add yourself. Corrections, tags, notes, and other annotations you add to Supacontacts are content you provide. They are not Account and Usage Data: we never sell them, never use them for advertising or marketing, and use them only as described in How your corrections improve Supacontacts. The bare fact that you made a correction — how many and when, without what it said — is usage data.

Google User Data: what we access and why

Plain-language summary: You grant four Google permissions. Three are read-only. The only place we ever write is your Google Contacts. You approve each one on Google's consent screen and can revoke any of them there anytime.

When you connect your Google account, Supacontacts requests the following OAuth scopes. You see and approve these on Google's own consent screen.

Google Contacts is the one and only place Supacontacts writes. Gmail and Calendar are strictly read-only. If we ever need a new permission to add a feature, Google will ask you to approve it separately — we can't quietly widen our access.

How we use Google User Data — the complete list. We use it only to:

• Extract contact details (names, phone numbers, titles, companies, physical and email addresses) from your email signatures, message bodies, and calendar events.
• Clean and normalize those details — for example, checking an address against a real place, resolving a company from an email domain, or working out relationship signals like when you last corresponded.
• Keep short notes from each email about your relationships — what a conversation was about, how you met someone and who introduced you, the roles people have held over time, and who is waiting on whom — so you can recall a contact before you reply.
• De-duplicate and merge records so the same person across several of your accounts becomes one clean contact.
• Write the resulting enriched fields back to your Google Contacts, each field showing where it came from so you can trust it or correct it.
• Skip the noise — newsletters, receipts, no-reply and role addresses, automated senders — so we keep the people you actually correspond with.
• Show you the results in the product, keep the service working, improve the service, and support you when something goes wrong.

That's it. We don't use your Google User Data to build advertising profiles, to train AI models, or for any purpose you didn't come here for.

Google API Services: Limited Use

Supacontacts's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Because Gmail is a restricted scope, we hold ourselves to these commitments explicitly:

1. User-facing features only. We limit our use of Google User Data to providing and improving the user-facing features described in this policy and visible in the Supacontacts product.
2. No selling. We do not sell Google User Data, and we do not transfer it to third parties except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets that you consent to in our Terms of Service (Section 21) and that we'll also tell you about — and never for other purposes without your consent.
3. No advertising. We do not use Google User Data — including your Gmail content, calendar content, or contact content — for serving advertisements of any kind, including personalized, retargeted, or interest-based advertising.
4. No training AI models. We do not use Google User Data to develop, train, fine-tune, or otherwise improve any artificial-intelligence or machine-learning model, whether run by us or anyone else, proprietary or open-weight. See the AI processing section for the full distinction between processing your data to deliver the service (which we do) and training models on it (which we don't).
5. Restricted human access. We do not allow humans to read your Google User Data, except: with your explicit consent (for example, when you ask us for support on a specific record); where necessary for security purposes such as investigating abuse or a bug; to comply with applicable law; or on data that has been aggregated and anonymized and is used for internal operations. Our engineers work against redacted and de-identified data wherever possible (see Security).

If we ever change how we use Google User Data, we'll ask for your consent where required and update this policy before the change takes effect.

AI processing and subprocessors

Plain-language summary: The whole product is AI reading your email to pull out contacts. That means your email content is processed by AI. It is never used to train AI.

Supacontacts is an AI product. To find the phone number in a signature or the company behind a domain, we send the relevant email, calendar, and contact content to AI models that read it and return structured contact data. Today we use three AI providers:

• Microsoft Azure AI Foundry, for contact extraction and content judging. It receives the text of your emails and calendar events, so it can pull out contact details and judge which people in them matter to you.
• Google Vertex AI (Gemini), for company enrichment, search query understanding, and some contact checks. It receives company names and web addresses, the questions you type into search, and short excerpts of emails.
• TypeSafe, for relationship summaries, sender classification, personhood checks (whether an address belongs to a real person), and search. It receives email text, sender names and addresses, and the contact details needed to answer your searches.

Under Google Cloud's terms, content you send to Vertex AI is not used to train Google's models. Under Microsoft's terms, content sent to Azure is not used to train any AI model and is not available to OpenAI. We may use other AI providers under terms that don't allow them to train on your data; the current list is in the subprocessors section.

Here's the distinction we want to be honest about:

• Processing (this is what we do). Your content is sent to an AI provider, the model reads it, extracts the contact details, and returns them. The content is used to deliver your result, in your account, for the feature you asked for — then it's done. Our providers are contractually prohibited from using it to train or improve their own models.
• Training (this is what we don't do). Using your content to train, fine-tune, or otherwise improve an AI model, which changes the model itself. We do not do this with your data, including your corrections. We do not do it ourselves, and our AI providers are not permitted to do it either.

No training, with no exceptions. We don't use your data, including your corrections, to train, fine-tune, or otherwise improve any AI or machine-learning model, whether it's run by us or anyone else, and whether it's proprietary or open-weight. Our AI providers aren't allowed to either. When we improve Supacontacts using your corrections (see How your corrections improve Supacontacts), we change our own rules, prompts, and checks, not any AI model. That's a promise, and it's also required of us by Google's rules above.

How your corrections improve Supacontacts

Plain-language summary: When you fix something, we use the fix to correct your own results and to make Supacontacts better for everyone. We never train AI models on it, and you can turn the improvement part off anytime in Settings.

When you correct a contact detail, add a tag or a note, or otherwise annotate your contacts, that's content you add to Supacontacts, and it stays yours (see Section 10 of our Terms of Service). We use it in two ways:

• To fix your own results. Your correction updates your contacts and the results we show you.
• To improve Supacontacts for everyone. We use automated tools, including AI, to study specific corrections and the results they fixed, so we can improve how Supacontacts works: our rules, prompts, checks, filters, gates, processing steps, and score thresholds. The improvements we make contain no email content or contact details.

Who sees a correction. A person on our team looks at a specific correction only if you ask us to, for security, or to comply with the law.

What we never do with them. We never sell your corrections, tags, or notes, never use them for advertising or marketing, and never use them to train, fine-tune, or otherwise improve any AI model (see AI processing).

You can turn this off. You can turn off the improvement use anytime in Settings. Your corrections will still fix your own results.

When you delete your account. Your corrections, tags, and notes are deleted with the rest of your data, on the schedule in Data retention. What remains is the improvements we've already made to our software, and aggregated or de-identified data that can't reasonably identify you or anyone in your contacts. We won't try to re-identify that data.

Account and Usage Data: what we collect and how we use it

Plain-language summary: The normal running of a software business. We use this data to operate, bill, secure, improve, and market Supacontacts. We reserve latitude to grow the business here — but we ring-fence your Google User Data, and the corrections, tags, and notes you add, out of all of it.

Separately from your Google User Data, we collect and use the following to run Supacontacts as a business:

• Account data — your name and email when you join the waitlist or create an account, and your authentication details (we use Google sign-in and never see your Google password).
• Billing data — when paid plans launch, the subscription and payment details needed to charge you, handled through our payment processor. We don't store full card numbers ourselves.
• Usage and analytics data — how you interact with the product and site: pages and features used, actions taken (including the fact that you made a correction, but not what it said), and aggregate performance. We use privacy-hardened analytics that are configured not to capture the contents of your contacts (see Cookies and analytics).
• Device and log data — IP address, browser and device type, timestamps, and diagnostic logs, used to keep the service secure and working.
• Communications — messages you send us and our replies, and your preferences about marketing email.

We use Account and Usage Data to: provide, operate, and secure the service; create and manage your account; process payments and manage subscriptions; understand how the product is used and improve it; detect, prevent, and investigate fraud and abuse; comply with legal obligations; and communicate with you, including sending you product updates, offers, and marketing about Supacontacts and our own related products.

Our latitude here — and its hard limits. As Supacontacts grows, we may introduce paid tiers, run advertising and marketing campaigns for our own products, work with analytics and marketing vendors, use aggregated and de-identified data to understand and improve the business, and otherwise evolve how the company operates. We reserve the right to do these things with Account and Usage Data. But two limits never move:

1. We never use your Google User Data — your Gmail, Calendar, or Contacts content — or the corrections, tags, and notes you add, to target or serve advertising. Any advertising we do is based on Account and Usage Data and general audience information, never on the contents of your email or the contacts we extract.
2. We never "sell" your personal information as the California Consumer Privacy Act defines that term without first giving you notice and the choices the law requires. If our business model ever changes in a way that would involve selling or sharing personal information for cross-context behavioral advertising, we will update this policy, tell you, and honor your right to opt out.

Who we share data with

Plain-language summary: We don't sell your data. We do use a short list of vetted vendors to run the service. Your Gmail/Calendar/Contacts content is redacted or minimized before it reaches the ones that don't strictly need it.

We share data only in these situations:

• With service providers (subprocessors) who help us run Supacontacts, under contracts that require them to protect your data and use it only to provide services to us. The current list:

  Provider	What they do	What data reaches them
  Supabase	Application database and authentication	Synced email and calendar content, your contacts and the contact data we extract and enrich, and your account data, stored securely
  Google Cloud — Vertex AI (Gemini)	AI for company enrichment, search query understanding, and some contact checks	Company names and web addresses, your search questions, and short email excerpts sent for processing; not used to train Google's models
  Microsoft Azure AI Foundry	AI for contact extraction and content judging	Email and calendar content sent for processing, which Microsoft may carry out in any Azure region; not used to train any model and not available to OpenAI
  TypeSafe	AI for relationship summaries, sender classification, personhood checks, and search	Email text, sender names and addresses, and the contact details needed to answer your searches, sent for processing
  Google Maps Platform	Checks that addresses we find are real places	Only the address text found in your email or calendar, like an address in a signature or a meeting location. No names or email addresses
  Trigger.dev	Runs our background jobs (syncing, extraction pipeline)	Sync and extraction jobs run on Trigger.dev's machines, so your email and calendar content is processed in memory there. Job inputs and dashboards are redacted — see Security
  Resend	Sends transactional and product email	Your name, your email address, and the emails we send you. Our weekly digest names some of your contacts and what we updated, like a new job title or company
  PostHog	Product analytics	Usage events; configured to exclude contact contents (autocapture and session recording off)
  Google Analytics 4	Website and product analytics	Usage events, engineered to carry no personal contact data
  Vercel	Application hosting and delivery	Request/response and log data needed to serve the app
  Axiom	Application logs	Logs about how the app and its background jobs are running. We strip email content and contact details from the fields we log, and mask email addresses and US-format phone numbers and street addresses in log text, before logs are sent
  Stripe	Subscription billing	Billing and payment details

  A current, itemized subprocessor list is available on request.

• For legal reasons — to comply with a law, regulation, legal process, or enforceable governmental request; to enforce our terms; or to protect the rights, property, or safety of our users, the public, or us.

• In a business transfer — if we're involved in a merger, acquisition, financing, or sale of assets, your data may transfer as part of that deal. You consent to that transfer in our Terms of Service (Section 21), and we'll also give you notice. Whoever receives your data must honor this policy's commitments for the data it receives, including the Google Limited Use commitments.

• With your direction or consent — when you ask us to share something, or agree to it.

We do not sell your personal information, and we do not share your Google User Data with advertisers.

Data retention

Plain-language summary: We keep your data while your account is active and delete it when you ask or when you close your account, aside from short encrypted backups and anything the law requires us to keep.

We keep Google User Data and the contacts we derive from it for as long as you use Supacontacts, so the product can keep your contacts current. You can ask us to delete your data at any time. When you delete your account or ask us to erase your data:

• We delete your personal data from our active systems within 30 days.
• Residual copies may persist in encrypted backups for up to 90 days before they're overwritten.
• We may retain a limited amount of data where the law requires it, or to resolve disputes, prevent fraud and abuse, or enforce our agreements.

Your enriched contacts remain in your Google Contacts regardless — deleting your Supacontacts account doesn't remove the fields we already wrote there, because those live in your Google account, where they were always yours. You can edit or remove them in Google Contacts directly.

Account and Usage Data is retained for as long as needed for the purposes described above and then deleted or de-identified.

Security

Plain-language summary: We minimize where your email content travels, redact it before it hits systems that don't need it, and keep engineers working against de-identified data by default.

We take practical, layered steps to protect your data:

• Redaction before background processing. Before we hand a job to our background-processing provider (Trigger.dev), we run it through a redaction step that strips personally identifying content — raw email bodies, names, and email addresses — and only lets internal record identifiers through. Your email content doesn't sit in that vendor's dashboards.
• Analytics built to exclude your contacts. Our product analytics are deliberately configured for privacy: automatic event capture is off, session recording is off, text and element attributes are masked, and our website analytics are engineered so no personal contact data is attached to events.
• Encryption in transit, access controls and least-privilege for our team, and restricted human access to Google User Data as described in the Limited Use section.
• OAuth, not passwords. We authenticate with Google through OAuth and never see or store your Google password.

No system is perfectly secure, and we can't guarantee absolute security. If we ever suffer a breach affecting your data, we'll notify you and the authorities as the law requires.

Your rights and choices

Plain-language summary: Access it, delete it, disconnect anytime, and revoke us on Google in one click.

No matter where you live, you can:

• Access and export the personal data we hold about you — email legal@supacontacts.com.
• Delete your data anytime, by closing your account or emailing us. See Retention for what happens.
• Disconnect Supacontacts anytime, from within the product or straight from your Google account.
• Revoke our access on Google in one click — visit your Google Account permissions and remove Supacontacts. That cuts off all further access to your Gmail, Calendar, and Contacts.
• Correct inaccurate account information.
• Opt out of marketing email using the unsubscribe link in any marketing message, or by emailing us. We'll still send essential service messages (like billing or security notices).

We won't discriminate against you for exercising any of these rights. To protect your account, we may need to verify your identity before acting on a request.

California privacy rights (CCPA/CPRA)

Supacontacts is based in California, and we extend these rights to our users. If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to:

• Know what personal information we collect, use, and disclose, and to access it.
• Delete the personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If that ever changes, we'll provide a clear "Do Not Sell or Share My Personal Information" choice and honor opt-out preference signals such as Global Privacy Control.
• Limit the use of sensitive personal information. We use the sensitive information we access (your email and communications content) only to provide the service, not to infer characteristics about you.
• Be free from discrimination for exercising these rights.

To exercise any of these, email legal@supacontacts.com. You may use an authorized agent, and we'll verify requests as the law allows. We'll respond within the timeframes California law requires.

The categories of personal information we collect, the purposes, and the parties we disclose to are described throughout this policy.

Outside the United States

Supacontacts is operated from the United States. Your data may be processed globally, including in the United States; some of our service providers, such as our AI providers, may process it in other countries. If you access Supacontacts from outside the U.S., you understand your data will be transferred to and processed in the U.S. and possibly other countries, where privacy laws may differ from your own.

Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the service secure, and understand how our site and product are used. Our analytics are configured for privacy: automatic capture and session recording are turned off, and event data is engineered to exclude your contact contents.

You can control cookies through your browser settings. Blocking some cookies may affect how the site works.

Children

Supacontacts is a professional tool built for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, email legal@supacontacts.com and we'll delete it.

Changes to this policy

We may update this policy as the product, our business, and the law evolve — for example, when we add features, launch paid plans, or change how the business operates. When we make material changes, we'll update the "Last updated" date above and, where appropriate or legally required, notify you (for instance, by email or an in-product notice). For changes to how we use your Google User Data, we'll seek your consent where required before the change takes effect. Your continued use of Supacontacts after an update means you accept the revised policy.

Contact us

Questions, requests, or concerns about privacy? Email us at legal@supacontacts.com.