Privacy Policy

1. Who we are

GullyContacts is a contact management service operated by Gully System Private Limited, #257, 3rd Floor, Sri Nanjundeshwara Complex, Nagarbhavi 8th Block, Outer Ring Road, Bengaluru – 560072, Karnataka, India.

In this policy, “we” means Gully System Private Limited and “you” means the person using GullyContacts. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below.

2. What we collect

Data	When	Why
Email address	When you create an account	To identify your account and send verification and password reset codes
Password	When you create an account or reset it	Stored only as a salted hash. We never store or see your actual password
Verification codes	At signup and password reset	To confirm you control the email address. Short-lived
Session tokens	While signed in	To keep you signed in without re-entering your password
Server logs	On each request to our API	Diagnosing errors and abuse. May include IP address, timestamp and which endpoint was called

We do not use advertising identifiers, we do not build behavioural profiles, and this website loads no third-party analytics, scripts or fonts.

3. Your contacts stay on your device

This is the part most people care about, so we will be precise.

The contact records you create or import — names, phone numbers, email addresses, addresses, notes and tags — are stored locally on the device you are using. On the web that means your browser’s local storage; in the mobile and desktop apps it means a file in the application’s own storage. They are not uploaded to our servers, and we cannot read them.

Two consequences worth understanding:

• Your contacts do not currently follow you between devices. What you see on your laptop is not what you see on your phone.
• If you clear your browser’s site data, uninstall the app, or lose the device, those contacts are gone. We hold no copy to restore from. Use the export feature to keep your own backup.

If we later introduce syncing across devices, contacts would necessarily be stored on our servers to make that work. We will update this policy and tell you before that happens, rather than changing it quietly.

4. Why we process it

We process the data in section 2 to provide the service you asked for: creating and securing your account, verifying your email address, letting you sign in, keeping the service running, and preventing abuse. Where the law requires a lawful basis, ours is the performance of our contract with you and our legitimate interest in operating a secure service.

5. Who else sees it

We do not sell your personal data, and we do not share it for anyone else’s marketing. We use a small number of service providers who process data strictly on our instructions:

Provider	What they handle
DigitalOcean	Hosting for our servers and the database holding account records
Brevo (Sendinblue)	Sending verification and password reset emails. Receives your email address and the message content

We may disclose data where we are legally required to, for example in response to a valid order from a court or authority of competent jurisdiction.

6. How long we keep it

• Account data — for as long as your account exists.
• Verification codes — minutes; they expire quickly by design.
• Server logs — a limited period for diagnostics, after which they are rotated out.
• Contacts — we never hold these, so there is nothing for us to delete. They live and die with your device.

Ask us to delete your account and we will remove your account record. Because your contacts are on your device, deleting your account does not remove them; clear the app’s data or uninstall it to do that.

7. Your rights

Subject to applicable law, you may ask us to:

• confirm what personal data of yours we hold, and get a copy of it;
• correct it if it is wrong or incomplete;
• delete your account and the data associated with it;
• withdraw consent where we relied on it, without affecting past processing.

Write to us using the details in section 11 and we will respond within the period the law allows. We may need to verify your identity first, which protects you from someone else making a request in your name.

8. Security

Traffic between your device and our servers is encrypted in transit with TLS. Passwords are stored as salted hashes, never in readable form. Our database requires encrypted connections and is not reachable from the public internet without authorisation.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the relevant authority as required by law. If you believe you have found a security problem, please write to us before disclosing it publicly — see Contact.

9. Children

GullyContacts is not directed at children, and we do not knowingly create accounts for anyone under 18 without verifiable parental consent as required under the Digital Personal Data Protection Act, 2023. If you believe a child has created an account, tell us and we will remove it.

10. Changes to this policy

If we change this policy we will update the date at the top of the page. Where a change materially affects how we handle your data — for example if contacts began to be stored on our servers — we will make that clear rather than relying on you noticing a new date.

11. Contact and grievances

For any question about this policy, or to exercise the rights in section 7, write to hello@gullycontacts.com or to Gully System Private Limited at the address in section 1.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.