Privacy Policy

InControl (“InControl,” “we,” “our,” or “us”), operated by The Coffey Company, respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to useincontrol.com, our marketing pages, our subscription product, and any related services (collectively, the “Services”).

InControl is a software service operated by The Coffey Company. For privacy questions, please send us a message using the chat widget on this page.

We collect information in three ways: information you provide, information collected automatically, and information from third-party services.

a) Information You Provide

• Account information: name, email address, password (managed by our authentication provider, Clerk), profile image, and business name.
• Billing information: when you subscribe, our payment processor (Stripe) collects your payment card details, billing address, and transaction history. We do not store full card numbers on our servers.
• Customer / lead data you upload: contact names, emails, phone numbers, notes, pipeline stages, tasks, and other CRM-style data you choose to store inside InControl.
• Email and delivery data: sender details, recipient addresses, message content, campaign settings, and delivery events such as sends, bounces, complaints, opens, clicks, and unsubscribes when you or a business using InControl sends email through the Services.
• Email compliance and acknowledgement data: when you confirm a multi-recipient send, we may record the account and workspace, confirmation time, applicable Terms version, recipient count, and logical send or schedule identifier. We may also record managed-email restrictions, suspensions, enforcement actions, and related reasons.
• Communications: messages you send us through the website chat widget, email, or support requests.
• Form and inquiry submissions: if you fill out a form or chat with the widget on our marketing pages, we collect what you submit (e.g., name, email, message, business interest).
• Affiliate program information: if you apply to or participate in our affiliate program, we collect your name, contact email, PayPal email, referral code, referral attribution and commission records, and related payment details.

b) Information Collected Automatically

• Device and log data: IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, links clicked, and timestamps.
• Cookies, pixels, and similar technologies: we and our partners use cookies, web beacons, SDKs, and pixel tags to operate the Services, remember preferences, measure performance, and serve advertising. See Section 7.
• Usage data: features used, actions performed, and crash or error reports.

c) Information from Third Parties

• Authentication and identity providers (e.g., Clerk) when you sign in or sign up.
• Payment processors (e.g., Stripe) for subscription and refund events.
• Advertising and analytics partners (e.g., Meta/Facebook, Google) who report aggregated campaign performance and may provide audience data.

We use information to:

• Provide, operate, and maintain the Services.
• Create and manage your account, authenticate you, and prevent fraud or abuse.
• Process payments and manage subscriptions.
• Administer the affiliate program, attribute referred customers, calculate commissions, make payouts, prevent abuse, and meet applicable reporting or withholding obligations.
• Personalize the experience and store your dashboard, preferences, leads, tasks, and configuration.
• Provide customer support and respond to inquiries.
• Send transactional emails (e.g., receipts, security alerts, product notices).
• Deliver customer-requested and business-authored email, measure delivery and engagement, process bounces and complaints, and maintain unsubscribe and suppression preferences.
• We use email compliance, acknowledgement, delivery, and enforcement records to document confirmations, prevent abuse, enforce our Terms, honor suppression requirements, maintain deliverability and shared sending reputation, investigate complaints, and comply with legal obligations.
• With your consent or where permitted, send marketing communications about InControl features, content, and offers. You can opt out at any time using the unsubscribe link.
• Measure and improve the Services, including analytics, A/B testing, and performance monitoring.
• Run, measure, and optimize advertising campaigns on platforms such as Meta (Facebook, Instagram), Google, and similar networks, including conversion tracking and retargeting.
• Comply with legal obligations and enforce our Terms of Service.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data based on one or more of the following legal bases:

• Contract: to provide the Services you have requested.
• Legitimate interests: to operate, secure, and improve our business and Services.
• Consent: for non-essential cookies, marketing communications, and certain advertising activities. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws.

We do not sell your personal information for money. We share information only as described below:

• Service providers (sub-processors): trusted vendors that help us run the Services, including:
  • Authentication: Clerk
  • Hosting and infrastructure providers
  • Database: PostgreSQL hosting providers
  • Email delivery: Resend and other transactional email providers
  • Payments: Stripe
  • Analytics: Google Analytics and similar providers
  • Advertising platforms: Meta (Facebook/Instagram), Google Ads, and similar networks
  • Customer support tools
• Advertising partners: hashed identifiers (such as your email address) and event data may be shared with Meta, Google, and similar advertising platforms to measure campaign performance, build custom audiences, and serve relevant ads. For purposes of laws like the California Consumer Privacy Act (CCPA/CPRA), this activity may be considered “sharing” or a “sale” of information for cross-context behavioral advertising. See Section 10 for opt-out rights.
• Legal and safety: to comply with valid legal requests, enforce our Terms, protect rights, property, or safety, or investigate fraud or security incidents.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case we will provide notice before your information is transferred.
• With your direction: when you ask us to share information, or you make information public.

If you provide a mobile phone number and opt in to receive text messages from InControl (for example, through a form on our website or in a chat conversation), you consent to receive text messages from us about your inquiry, your account, and related updates. Message frequency varies. Message and data rates may apply. Consent to receive text messages is not a condition of any purchase.

You can opt out at any time by replying STOP to any message, and you can reply HELP for help. If you opt out, we will send a final message confirming your opt-out and then stop texting you.

Your mobile phone number, text messaging originator opt-in data, and consent are never shared with or sold to third parties or affiliates for their marketing or promotional purposes. We share this information only with our text messaging service providers, and only so they can deliver messages on our behalf.

We and our partners use cookies and similar technologies for the following purposes:

• Strictly necessary: session, authentication, security, load-balancing, and 60-day first-touch affiliate attribution cookies required for the Services to function.
• Functional: remember preferences such as theme, language, and settings.
• Analytics: understand how visitors use the Services, including aggregate metrics from Google Analytics.
• Advertising: measure ad performance, build audiences, and show you relevant ads on third-party platforms. We may use:
  • Meta Pixel (Facebook / Instagram) to measure conversions and create custom and lookalike audiences.
  • Google Ads tag, Google Tag Manager, and Floodlight for conversion tracking and remarketing across the Google Display Network and YouTube.
  • Other advertising partners for retargeting and measurement.

You can control cookies through your browser settings. Most browsers let you refuse cookies, delete cookies, or alert you when a cookie is being set. Blocking some cookies may impact your experience and the availability of certain features. You can also opt out of certain advertising cookies at:

• Digital Advertising Alliance: optout.aboutads.info
• Network Advertising Initiative: optout.networkadvertising.org
• European Interactive Digital Advertising Alliance: youronlinechoices.eu
• Meta Ad Preferences: facebook.com/adpreferences
• Google Ads Settings: adssettings.google.com

We respect Global Privacy Control (GPC) signals where required by law and treat them as a request to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising.

We retain personal information for as long as we need it to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Account data is generally kept for the life of your account and for a reasonable period after cancellation. Backups and audit logs may be retained for an additional period in accordance with industry practice. You may request deletion as described in Section 10.

Email delivery records and suppression preferences may be retained for as long as reasonably necessary to deliver messages, honor unsubscribe and complaint requests, prevent abuse, maintain deliverability, and comply with legal obligations. Resend may process email data and delivery events as our email-delivery provider.

We may retain email acknowledgements, delivery records, suppression records, complaints, and managed-email enforcement records for as long as reasonably necessary to document compliance, honor recipient preferences, prevent abuse, resolve disputes, protect deliverability, enforce agreements, and meet legal obligations.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS), access controls, secure authentication via Clerk, and tokenized payment processing via Stripe. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — request that inaccurate or incomplete information be corrected.
• Deletion — request that we delete your personal information, subject to legal exceptions.
• Portability — request a machine-readable copy of certain information you provided.
• Restriction or objection — restrict or object to certain processing.
• Withdraw consent — where processing is based on consent.
• Opt out of marketing — unsubscribe via the link in any marketing email.
• Optional-email choices — where available, choose to stop marketing-only email or all optional email. If you choose the broader option, confirmations and reminders may stop; required legal, security, and service-critical messages remain separate.
• Opt out of “sale” or “sharing” for cross-context behavioral advertising (CCPA/CPRA and similar US state laws).
• Non-discrimination — you will not be discriminated against for exercising these rights.

Settings provides one Export Contacts action, not a complete-workspace export or self-service account deletion. It downloads a full-fidelity JSON contact backup and a flat CSV. Both files include contact records; the CSV contains the supported flat contact fields. The JSON also includes contact-related sources, directions, channels, relationship/contact types, and pipeline stages. This action does not export the complete workspace, and account holders cannot delete their own account from inside the product.

Access, portability, and deletion requests beyond the self-service contact export go through the website chat privacy-request process and may require identity verification. Send us a message using the chat widget on this page and include “Privacy Request” in your message.

InControl is operated in the United States. If you access the Services from outside the U.S., your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please send us a message using the chat widget on this page and we will take appropriate steps to delete it.

The Services may contain links to third-party websites and services. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party you interact with.

Some browsers offer a “Do Not Track” (DNT) signal. The Services do not currently respond to DNT signals because no consistent industry standard has been adopted. We do honor recognized opt-out signals such as Global Privacy Control where required by law.

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised “Effective Date.” Material changes will be communicated by email or through the Services. Your continued use of the Services after the effective date constitutes your acceptance of the updated policy.

For privacy questions, requests, or complaints, please send us a message through the digital receptionist (the chat widget on this page). Your request goes straight to our team, and a real person will respond.

If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

This document is governed by the laws of the State of New York, United States, without regard to conflict-of-laws principles.