Privacy Policy
PrimeContact · Effective and last updated: October 21, 2026 · Türkçe
This policy explains how personal data is processed in the PrimeContact mobile app (“App”), the PrimeContact admin panel (“Panel”) and our websites (“Site”). It is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
- The contacts in your address book (names, numbers, e-mails, etc.) are never sent to any server. Importing, matching and deleting all happen on your phone.
- No ads, analytics, tracking or profiling. Your data is never sold or used for marketing.
- The Tasks feature is off by default. Until you turn it on, the App does not connect to any server. If you turn it on, only a random user ID and technical data are processed. You can turn it off at any time, which deletes your record from our server.
- Our websites use no cookies.
1. Controller
The controller is PrimeContact. Contact: support@primecontact.app.
For contact lists that an organization uploads to the Panel, that organization is the controller. We act as its processor (see section 4).
2. Data processed only on your device
The following data stays on your phone. It is not transferred to us or anyone else, and we have no access to it.
- Contacts: processed only with your permission. The App uses it to list and search contacts, save contacts from VCF files, match contacts, delete the contacts you select, and export contacts. You can revoke the permission at any time in your phone’s settings.
- Imported VCF files: kept on the device for 60 days so that you can match them later, then deleted automatically.
- Import history and settings: which contact came from which file, your preferences and the app language.
When you use “Export” or “Back up and delete”, the VCF file is sent only to the destination you pick in the share sheet. Deleting the App removes all of this data from your device.
3. Tasks feature (optional)
Tasks let your organization’s administrator send you contact updates, which are lists of contacts to delete and to add. The feature is activated only when you tap “Turn on tasks”. Once it is on, the following data is processed on the PrimeContact server:
| Data | Purpose | Legal basis |
|---|---|---|
| Random user ID (e.g. PC-7K3M-9Q2X) and a hash of this device’s secret key | Delivering tasks to the right device; authentication | Performance of the service you requested (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Push notification token (if you allowed notifications) | Notifying you when a new task arrives | Art. 6(1)(b) |
| Platform, app version and language; registration and last-seen time | Compatibility, notifications in your language, removal of unused records | Art. 6(1)(b) and (f) |
| Task records: title, note, status, timestamps, result counts (deleted/added/skipped), any error or rejection reason | Letting the administrator see the outcome | Art. 6(1)(b) and (f) |
| IP address while connected (kept briefly in memory only, for rate limiting) | Preventing attacks and abuse | Legitimate interest in security (Art. 6(1)(f)) |
Your user ID is not automatically linked to your name, phone number or e-mail. Your administrator may add a label, such as your name, to your ID in their panel.
Your contacts are never uploaded. When you apply a task, only the result counts are sent. Notifications contain no task title or contact data. Task details are fetched over an encrypted connection only when you open the App.
To turn the feature off, go to Tasks → “Turn off tasks and delete my data”. This permanently deletes your device record, your tasks and your assignments from the server, and renews the ID on your phone.
4. Contact lists uploaded by organizations
An organization sending tasks uploads VCF files to the Panel. These files contain third parties’ contact details, such as names, phone numbers, e-mails and job titles.
- The organization is the controller of this data. It is responsible for having a legal basis and for informing the people concerned. We process the files only on its instructions and only to deliver the task to the device it was sent to (GDPR Art. 28; KVKK Art. 12(2)).
- Files are stored encrypted (AES-256). They are accessible only to the uploader, the organization’s administrators and the device the task was sent to.
- Files are permanently deleted automatically 90 days after upload. If a file is used in an open task, it is deleted when that task closes.
If your details appear in such a file, please contact the organization first. If you write to us instead, we will forward your request to the organization and delete the data we hold.
5. Panel users (organization administrators and operators)
- Account data: username, display name, role, an irreversible password hash (bcrypt) and, if you enable it, your encrypted two-factor secret. Purpose: account and access management. Legal basis: Art. 6(1)(b).
- Activity log: sign-ins and sign-outs, failed sign-in attempts, file uploads/downloads/deletions, and task and user changes, each with time and IP address. Purpose: security, detecting unauthorized access, and accountability for access to personal data. Legal basis: Art. 6(1)(f) and the security duties of GDPR Art. 32 and KVKK Art. 12.
- Session cookie: see section 6.
6. Websites and cookies
Our websites use no cookies, analytics or advertising tools, and load no third-party fonts or scripts. For this reason no cookie consent is requested.
When you sign in to the Panel, a strictly necessary session cookie (__Host-pc_session) keeps you signed in. It is HttpOnly, Secure and SameSite=Strict. It lasts at most 12 hours and is removed when you sign out. Because it is strictly necessary for the service you requested, it does not require consent.
The hosting infrastructure that serves the Site (EAS Hosting and our own server) may briefly process technical connection data, such as IP addresses, to deliver pages and prevent attacks. Our own server keeps no access logs.
7. Recipients and international transfers
We never sell your data or share it for marketing. Data is shared only with the following recipients:
- Your organization: your user ID, device details and task results are shown in the Panel to the organization that sends you tasks.
- Hosting provider: our server runs in a data center of Hetzner Online GmbH in Finland (Helsinki, EU); Hetzner acts as a processor and only provides the infrastructure.
- Notification services (outside your country): if you allowed notifications, your push token and the task ID pass through Expo (Expo, USA). They then go through Apple Push Notification service (Apple, USA) or Firebase Cloud Messaging (Google, USA). Notifications contain no task title or contact data. If you do not want this transfer, turn notifications off; tasks still arrive when you open the App.
- Authorities: only where required by law, and only to the extent required.
8. Retention
| Data | Retention |
|---|---|
| VCF files on your device | 60 days, then deleted automatically on the device |
| VCF files uploaded by organizations (server) | Deleted automatically 90 days after upload. If used in an open task, deleted when the task closes. |
| Closed task records | 1 year |
| Device record (user ID, push token, etc.) | Kept until you turn tasks off. Deleted automatically after 1 year without any connection. |
| Panel activity log | 2 years |
| Backups (encrypted) | 14 days |
Expired data is deleted automatically every day.
9. Security
- All connections are encrypted with HTTPS/TLS, and the App never connects over an unencrypted channel.
- Contact lists uploaded by organizations and two-factor secrets are encrypted at rest with AES-256-GCM. Backups are encrypted as well.
- The Panel protects accounts in several ways:
- passwords are stored as irreversible bcrypt hashes;
- two-factor authentication is available;
- accounts lock out after repeated failed sign-ins;
- roles follow the principle of least privilege;
- activity is logged.
- The session cookie cannot be read by JavaScript and cannot be used from other sites. Further defenses protect against cross-site request forgery and content injection.
- Data is limited to what is needed, and expired data is deleted automatically.
If a personal data breach occurs, we will notify the competent authority and affected people within the legal deadlines.
10. Your rights
Under the GDPR and KVKK, you have the following rights:
- to access your data;
- to have it rectified;
- to have it erased;
- to restrict its processing;
- to object to processing based on legitimate interest;
- to data portability;
- to learn which third parties received your data.
PrimeContact makes no decisions based solely on automated processing.
How to exercise them: the quickest way is Tasks → “Turn off tasks and delete my data” in the App, which deletes your server record immediately. For anything else, write to support@primecontact.app. If you have a user ID, please include it. We reply free of charge within 30 days.
You may also lodge a complaint with a supervisory authority:
- in Türkiye, the Personal Data Protection Authority (KVKK);
- in the EU, your local data protection authority.
11. Children
PrimeContact is not directed at children and does not knowingly collect personal data from children.
12. Changes
If this policy changes, the new version will be published on this page and the date at the top will change. We will also announce important changes in the App or on the store page.