Last updated September 09, 2026
Commendy, located at 437 Baldwin Road, Santa Barbara, CA 93105, United States, is the entity responsible for this Privacy and Cookie Policy and is referred to as “we,” “us,” or “our.”
We take privacy and data protection very seriously and are committed to protect your personal information by offering the highest standards of data security. If you have any questions about this privacy and cookie policy after reading it, please don’t hesitate to contact us at privacy@commendy.com .
This Privacy and Cookie Policy (“Policy”) applies to Commendy, located at 437 Baldwin Road, Santa Barbara, CA 93105, United States, referred to as “we,” “us,” or “our.” Commendy is the Data Controller for the personal data of our own customers and website visitors. Where a customer submits another individual's personal data to Commendy, such as contacts added for a referral program, that customer is the Data Controller for that data and Commendy acts only as a Data Processor, as described in Section 8 below and in our Terms of Service.
Under the General Data Protection Regulation (“ GDPR ”) we must inform both website visitors and subscribers to our services (“ Customer(s), ” “ you, ” or “ your ”) about our privacy and data protection policies. Personal data is information that can be used to identify you as an individual, such as your first and last name, address and e-mail address, IP address and telephone number.
Our internal security protocols and systems comply with industry-standard measures. This Policy governs the privacy of our customers and visitors to our website. We will discuss the relevant privacy and data protection measures in this document. Moreover, we will explain how we process, store, and protect your personal information.
We actively protect your privacy rights and take all necessary steps to shield your information. Our website fully complies with all applicable data protection laws and regulations, including applicable privacy and data protection laws in the United States and California, as well as other laws that may apply to our users. In the event of any changes in the applicable law, we may inform you. However, you acknowledge and agree to inform yourself and check this page from time to time for any changes.
We collect your personal data based on a legitimate interest when you contact us or create an account - either through our website, email, social media channels, or by any other means. Your personal data is kept private and is processed in a secure way in accordance with an appropriate retention period. Moreover, we promise a safe and secure data transmission of your data. Should you create an account with us and leave personal information you do so at your own risk. We will retain your data based on legitimate business interests. Your data will be stored as long it is legally required.
Besides the legitimate interests mentioned in this Policy, your personal information may be used for other purposes that are always appropriate to our business dealings. As a result, your personal information and data may be used in different ways than the list below as long as you have not withdrawn your consent. We may also process your personal information after we have received a governmental or judicial order.
We shall never collect or process any personal information from children under the age of sixteen (16). If you are the parent or guardian of a child under the age of sixteen (16) and your child is visiting our website, please contact us immediately at privacy@commendy.com. After such a request, we shall erase all (personal) information about children from our systems.
We value your privacy and are committed to maintaining the trust of our users. We do not sell your personal data to third parties, and we strictly limit sharing of data to circumstances that allow us to serve you better, comply with legal requirements, or improve our services. Specifically, we may share data in the following situations:
We work with trusted service providers to support our operations (such as email delivery, data storage, and analytics). These providers are permitted to access data only as necessary to perform their functions and are contractually bound to uphold data protection standards.
We may disclose your data to law enforcement or other government entities if required to comply with applicable laws, regulations, or legal processes.
In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity under terms that maintain this privacy commitment.
Any data shared is done so with the utmost respect for your privacy and in accordance with applicable laws.
Commendy makes use of other parties necessary to operate our business and services. Under the applicable laws and regulations, those third-parties are Data Processors. We make use of the following Data Processors. Please check their respective privacy and data protection policies.
We use Stripe solely to process payments; we do not store your full card number on our own systems. We undertake to only use Data Processors that offer the same level of data protection as our company. We will never be liable for data leaks or breaches made by the Data Processors listed above or their respective sub-processors. Your personal data may be processed or transferred outside your state, province, or country of residence. We take appropriate measures designed to protect personal data in accordance with applicable privacy and data protection laws.
If you are a Commendy customer, our Services let you add contacts to your account manually, by uploading a CSV file, by pasting a list, or by connecting a third-party address book (see Section 9 below for the specific disclosures that apply when you connect Google Contacts). We use this contact information (name, email address, and phone number) to operate your referral program, which includes sending automated email invitations and reminders on your behalf inviting these contacts to share their own referral link.
When you submit another individual's personal data to Commendy this way, you are the Data Controller responsible for having the appropriate rights or consent to share that information, and Commendy acts only as a Data Processor on your behalf and instructions, consistent with our Terms of Service.
Every email we send on your behalf includes a one-click unsubscribe link; once a contact unsubscribes, we stop sending them further promotional emails. A contact who wants their information corrected or removed can also contact us directly at privacy@commendy.com, and we will act on that request or forward it to the applicable account.
Contact records are retained for as long as the referring account remains active, and are permanently deleted along with the rest of that account's data if the account is deleted.
Commendy offers an optional feature that lets you import contacts from Google Contacts to make it easier to invite people to your referral program. If you use this feature, you are directed to Google's own sign-in and consent screen, where you review and approve the specific access requested.
With your explicit authorization, we request read-only access to your Google Contacts (the contacts.readonly scope of the Google People API) — specifically, your contacts' names, email addresses, and phone numbers. We do not request access to Gmail, Google Drive, Google Calendar, or any other Google service, and we never request permission to modify your Google Contacts.
The contact information we retrieve is used solely to populate a list within your Commendy account so you can choose which contacts to invite to your referral program. We do not use this data for advertising, do not use it to build profiles, and do not use it for any purpose unrelated to the import you initiated.
We do not store your Google account password, and we do not retain the OAuth access or refresh tokens Google issues; they are used only for the single import request and then discarded. Imported contact details become part of your account's contact list and are protected by the same technical and organizational security measures described elsewhere in this Policy, including encrypted transmission (HTTPS/TLS) and restricted access controls.
We do not sell or share Google user data obtained through this feature with any third party, except as necessary to operate the feature (e.g., our infrastructure providers listed above) or as required by law.
You can revoke Commendy's access to your Google Contacts at any time from your Google Account's Security settings (myaccount.google.com/permissions), delete imported contacts within Commendy, or request deletion by emailing privacy@commendy.com.
Commendy's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Under the GDPR, you are considered a Data Subject with certain fundamental rights as listed below.
You have the right to access the personal data we have received from you by receiving a copy of the information we have stored. Moreover, you may ask us about how we collect and process your data.
If your data is incorrect or incomplete, you can correct it yourself by logging in or by contacting us at privacy@commendy.com and providing us with the correct information.
When you believe we do not have a good reason anymore to hold your personal data for a more extended period of time, each individual can request the full deletion of personal data. We will immediately award such a request unless there is a legal obligation to keep your personal data for a longer period of time.
Upon your request, we shall give you a copy of your data in a machine-readable format, or transfer it directly to a new Data Controller appointed by you.
You can always ask us to stop the processing of your personal data. Moreover, you can always object to the processing of your personal data when it is based on your explicit permission.
We want to solve any matter regarding your privacy directly with you. Please contact us at privacy@commendy.com . You also have the right to bring a complaint before the national Data Protection Authority in the country where you reside.
If you are a California resident, you have the right to know what personal information we have collected, used, and disclosed about you in the preceding 12 months; to request deletion of your personal information; to correct inaccurate personal information; and to opt out of the sale or sharing of your personal information (we do not sell or share personal information, so there is nothing to opt out of). We do not collect or use sensitive personal information in a way that triggers a right to limit its use. We will not discriminate against you for exercising any of these rights. You may submit a request by emailing privacy@commendy.com, or, for account and contact data, by using the self-service account deletion option in your Account Settings.
We may send you specific offers related to our business unless you have opted out from receiving such communications. We always give you the option to cancel receiving such offers. However, you cannot opt-out from receiving messages that are necessary to fulfill our contractual obligations and legal duties.
Our website may have links to third-party websites and/or service providers. Customers should be advised before they click external links on our website, and may do so at their own risk. Commendy is never responsible or liable for any damages or losses due to visiting any external links from our website.
We may amend this Privacy and Cookie Policy from time to time to comply with new privacy laws and regulations. Each Customer is solely responsible for checking this page on a regular basis to see any applicable changes in our privacy and data protection laws as the policy may change from time to time.
We use only the cookies strictly necessary to operate our website and application, such as maintaining your login session and remembering your sign-in preference. We do not use cookies for advertising or behavioral tracking, and we do not use any third-party analytics or advertising cookies. If you wish to block cookies anyway, you can do so in your browser's security settings, though doing so will prevent you from staying signed in to your account.
This Policy is intended to describe Commendy’s privacy practices under applicable United States and California privacy laws. Additional rights or obligations may apply depending on where you live.