Privacy Policy

Last updated: 14 June 2026

1. Who we are

Kontax is operated by Vexon. Our registered address is [ADDRESS]. For privacy enquiries, contact us at [email protected].

2. What data we collect

Account data: your name, email address, hashed password, username, and subscription plan.
Contact data: all contacts you store — names, emails, phone numbers, addresses, notes, and labels. This is the core service data and belongs to you.
Sync credentials: CardDAV app passwords (hashed) and Google and Outlook OAuth tokens (encrypted). Stored solely to provide the sync service.
Activity data: timestamps of when contacts were created, updated, or deleted. Retained for 30 days (Free plan) or indefinitely (Pro and above) for the activity history feature.
Payment data: your payment method, billing address, and transaction history are processed and stored by Stripe. Kontax stores only your Stripe customer ID and subscription status.
Session data: session token (HTTPOnly cookie), IP address, browser user agent, and last-seen timestamp. Used for authentication and fraud prevention.
Contact form submissions: your name, email address, subject, and message. Used only to respond to your enquiry; not retained beyond 90 days.

3. Why we collect it (lawful basis)

Account and contact data: contract — necessary to provide the service you signed up for.
Payment data: contract — processing your subscription.
Session data: legitimate interest — securing your account against unauthorised access.
Activity data: contract — powering the activity history feature included in your plan.
Contact form data: legitimate interest — responding to your enquiry.

4. Data retention

Account and contact data: retained while your account is active and deleted within 30 days of account deletion.
Payment data: Stripe retains payment data per their own policy. Kontax retains subscription status for tax and accounting purposes for 7 years.
Session data: expires after 30 days of inactivity.
Activity data: 30 days (Free plan) or indefinitely (Pro and above).
Contact form submissions: deleted after 90 days.

5. Who we share data with

We do not sell your data to third parties. We do not use your contact data for advertising. We share data only with the sub-processors below, and only to the extent necessary to provide the service:

Stripe — payment processing. stripe.com/privacy
Amazon Web Services (SES) — transactional email. Emails are sent from [email protected] via AWS SES (us-east-1).
Google LLC — only when you connect a Google Contacts account. Your contacts are sent to Google's Contacts API on your behalf, governed by your Google account's privacy policy.
Microsoft Corporation — only when you connect an Outlook account, under the same conditions.

6. Your rights

Under GDPR you have the right to:

Access: request a copy of your data (Settings → Privacy → Export data).
Rectification: update your account details in Settings.
Erasure: delete your account from Settings → Account → Delete account.
Data portability: export all contacts as vCard or CSV at any time, on any plan.
Restriction and objection: contact [email protected].
Lodge a complaint: with the ICO (ico.org.uk) if you are in the UK, or your national supervisory authority if you are in the EU.

7. Cookies

We use one session cookie (next-auth.session-token) to keep you logged in. This is a strictly necessary cookie — no consent is required. We do not use advertising, tracking, or analytics cookies.

If analytics are added in future, this policy will be updated and consent obtained where required.

8. Changes to this policy

Material changes will be communicated via email to account holders. The “last updated” date at the top of this page reflects the most recent revision.