Privacy Policy

ContactStar is a service that helps you find professionals who offer what you need (such as therapists, doctors, or teachers), send each of them a personal inquiry by email, and keep track of who you asked. Because contacting other people is central to what ContactStar does, we handle personal data with care. This policy explains what we collect, why, who we share it with, and the rights you have. A single round of this — one shortlist, one message, one send — is called an inquiry here, and appears as a “inquiry” in the application interface.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

The controller responsible for the processing of your personal data is the operator of ContactStar named in our Impressum. You can reach us at any time at hello@contactstar.app.

We collect and process the following categories of data:

• Account data. When you sign up, we store your email address and authentication credentials. Authentication is handled by our infrastructure provider (see “Service providers” below).
• Inquiry data. The information you enter to put an inquiry together — what you are looking for (your search description), the sender name you choose, and the message template you write.
• Contact data. The professionals shortlisted for your inquiry or added by you — typically names, email addresses, and a suitable salutation. This may be personal data of third parties (the people you wish to contact).
• Inquiry records. The personalized messages that are generated from your template and, once you approve sending, a record of what was sent.
• Payment data. Unlocking an inquiry is a one-time purchase, sold to you by Link as merchant of record (see “Payments” below): your payment details are entered in Link’s checkout and never reach our servers. What we store is only whether an inquiry has been unlocked, when, and an opaque payment reference we can use to match a purchase to an inquiry. To start a checkout we pass your email address and the inquiry identifier to Link.
• Technical data. Standard technical information (such as log data) necessary to operate the service securely and reliably.

We use your data for the following purposes:

• To provide the service — creating your account, finding contacts, drafting personalized emails, and sending the emails you approve (Art. 6(1)(b) GDPR, performance of a contract).
• To operate and secure the service, prevent abuse, and comply with our legal obligations (Art. 6(1)(f) and (c) GDPR).
• To unlock and account for paid inquiries (Art. 6(1)(b) GDPR).

Important: emails you send through ContactStar are sent on your behalf. You are responsible for ensuring you have a legitimate reason to contact the recipients you choose and for the content you send.

ContactStar uses AI to find relevant contacts based on your description and to draft personalized emails from your template. To do this, the relevant input (such as your search description, sender name, and template) is sent to our AI service provider for processing. AI output is always shown to you for review — no email is sent without your explicit approval.

This section is for people who never signed up for ContactStar: the professionals whose published contact details a search surfaced, and anyone who received an email sent through our service (these arrive from a ContactStar address, shown as “Name via ContactStar”). Because we did not obtain your details from you, Art. 14 GDPR requires us to tell you what we hold, where it came from, and what you can do about it.

What we hold, and where it came from. Our AI search looks for professionals matching a user’s description (for example “therapists in Berlin”) using publicly accessible sources on the open internet — typically a practice website or a public professional directory. We store the professional contact information published there: name and email address, and where available a postal address, phone number and website, together with a salutation generated for the inquiry. ContactStar is built to find professionals in their professional capacity; we do not seek out special categories of data.

Why, and on what legal basis. We process these details so that a user can find a professional able to help them and get in touch directly — for example a patient looking for a therapist with an available appointment. The legal basis is the legitimate interest of that user and of ourselves in making such contact possible (Art. 6(1)(f) GDPR). We consider this to be within the reasonable expectations of a professional who publishes contact details in order to be reached by prospective clients or patients. Emails are sent on the user’s behalf: the user decides whom to contact and approves every message before it goes out.

Who receives it. Your details are visible only to the individual user whose inquiry surfaced them. They are never sold, licensed, published, shared between users, or made available as a list, and they are not used for advertising or profiling. ContactStar offers no facility to export, download or transfer them: they can be used only to write the one inquiry they were found for. Our service providers process them on our behalf as described under “Service providers” below.

How long we keep it. Contact details are stored as part of the inquiry they were found for. They are erased when that inquiry is deleted or the user’s account is closed, and we will erase them sooner at your request.

If you never want to be contacted through ContactStar again. Write to us at hello@contactstar.app and we will erase the details we hold about you and make sure your email address is excluded from future searches, so that it can no longer be contacted through the service. To be able to honour that, we keep the one piece of information needed to enforce the exclusion — your email address — for that single purpose and for no other.

Your rights. You can ask us for a copy of the data we hold about you, have it corrected or erased, restrict or object to the processing, and lodge a complaint with a supervisory authority. These are set out under “Your rights” below, and apply to you in exactly the same way as to our own users. Write to us at the address above and we will respond within the time limits data protection law sets.

We rely on carefully selected providers who process data on our behalf under data processing agreements. These include:

• Supabase(hosting, database & authentication) — for storing your account and inquiry data and managing sign-in.
• OpenAI (AI provider) — for finding contacts and drafting emails. Input sent for processing is not used to train its models.
• Resend (email delivery) — for delivering the emails you approve to their recipients.

Our payment provider is a separate case, described in “Payments” below: for the payment itself it decides on its own purposes rather than acting on our instructions.

Some of these providers may process data outside the EU/EEA. In such cases we ensure an appropriate level of protection through suitable safeguards (such as EU Standard Contractual Clauses). We are happy to provide details of the specific providers on request at hello@contactstar.app.

Purchases are handled by Sold through Link, LLC as our merchant of record: Link is the seller of the inquiry unlock in its own name, invoicing you for it under its own tax registration, so the purchase contract is between you and Link. Link is responsible for the checkout, the payment transaction, the applicable sales tax/VAT, invoicing, payment disputes, refunds and transaction-level payment support. Your bank or card statement will show Sold through Link rather than ContactStar.

This means the payment details you enter (such as card data and billing information) are collected by Link in its own checkout and are governed by Link’s privacy policy. For that payment data Link decides on its own purposes and means — tax, fraud prevention, disputes and its own legal obligations — and so acts as an independent controller, not as a processor working on our instructions. We never see or store your payment details. We pass Link your email address and the inquiry you are unlocking so the purchase can be matched back to your account, and we receive back only the confirmation that payment succeeded together with a payment reference.

Your data is stored securely. Access is protected so that only you can access your own inquiries and contacts, using measures such as encryption in transit and strict per-user access controls (row-level security) at the database level.

We retain your account and inquiry data for as long as your account is active. When you delete an inquiry, its content (including its contacts and drafted messages) is erased; when you delete your account, your personal data is deleted. We may retain limited records where a legal obligation requires it — for example, information relating to a purchase may be kept for the statutory tax and commercial retention periods (generally up to 10 years) even after account deletion.

The same applies to the contact details of the people an inquiry found: they live with that inquiry and are erased with it. If you are one of those people, see “If you were found or contacted through ContactStar” above for how to have your details erased sooner or excluded from future searches altogether.

ContactStar uses only cookies that are strictly necessary to operate the service — in particular to keep you signed in (authentication/session cookies). We do not use advertising or cross-site tracking cookies and we do not build profiles of you. Your payment provider may set its own cookies on its checkout pages, governed by its own policy (see “Payments”).

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• lodge a complaint with a supervisory authority (in Germany, the data protection authority of your federal state).

You can request a copy of the data we hold about you, or request the deletion of your data and/or your entire account, at any time. Simply send an email to hello@contactstar.app. We will process your request within the timeframes required by applicable data protection law.

We may update this Privacy Policy from time to time to reflect changes in the service or in legal requirements. The current version always applies and is available on this page.