Privacy Policy
Effective date: 23 October 2026 Controller: Softway Solutions SRL, Nicolae Filipescu 53-55, 4th floor, Cam 4, Bucharest, Romania Privacy contact: [email protected]
Two roles
- Account and website data: we are the controller.
- Contact data you put into OpenContact: you are the controller and we are your processor. The Data Processing Agreement applies. You decide which contacts and providers to connect and you need a lawful basis for them.
Data we process
- Account: name, email, password hash, two-factor settings, workspace and project settings, team members.
- Billing: plan and Stripe identifiers. Card details stay with Stripe.
- Connections: provider API keys, OAuth tokens and webhook secrets, stored encrypted.
- Contact data you send us: email, name, company, country, phone, tags, custom fields, consent data, source, subscription status, event history and sync results.
- Technical: logs, audit entries and webhook delivery records.
- Website: traffic data collected by Google Analytics and Clicky, and the name, email and message you send through the contact form. We use these only to reply, and send them to our support inbox through Mailjet.
Why we use it, and on what basis (GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Provide the service, authenticate users, run routing, imports and webhooks | Contract |
| Billing, tax and accounting records | Contract; legal obligation |
| Security, fraud prevention, diagnostics, support | Legitimate interests |
| Website analytics | Consent |
Who receives it
Providers listed on the Subprocessors page. When you connect a tool, we send and fetch data as you configure it, under that tool’s terms. We do not sell personal data.
Where it is stored
Application data is hosted by Hetzner in Germany. Website analytics data goes to Google Analytics and Clicky in the United States. For transfers outside the European Economic Area we rely on an EU adequacy decision, such as the EU–US Data Privacy Framework, or on Standard Contractual Clauses.
How long we keep it
| Data | Kept |
|---|---|
| Audit log | 730 days |
| Activity | 90 days |
| Successful sync operations and runs | 90 days |
| Failed sync operations and runs | 180 days |
| Deleted sync rules | 30 days |
| Contacts and connections | Until you delete them or close your account |
| Billing records | As long as tax law requires |
You can permanently erase a contact at any time. OpenContact also sends an erasure request to each email provider the contact was synced to.
Security
Credentials and webhook secrets are encrypted at rest. Access is project-scoped and role-based. See Security.
Your rights
Under the GDPR you can ask to access, correct, delete, restrict or object to the processing of your data, and to receive a copy of it. Write to [email protected]. If your data sits in a customer’s OpenContact project, we pass the request to that customer. You can also complain to the Romanian data protection authority (ANSPDCP) or your local authority.
Cookies
The app uses session cookies to keep you signed in. This website uses Google Tag Manager to load Google Analytics and Clicky. They load only if you accept in the cookie banner. You can change your choice any time with “Cookie settings” in the footer.
Changes
We post updates here with a new date and tell account owners about material changes.
Contact
Softway Solutions SRL, Nicolae Filipescu 53-55, 4th floor, Cam 4, Bucharest, Romania. Email: [email protected]. We have not appointed a data protection officer.