Privacy policy

Last updated: 30 October 2026

Who we are

TidyContacts is operated by Maxyme Tuffery, trading as Backfillab, France. Contact: support@backfillab.com. TidyContacts is not affiliated with, endorsed by or sponsored by Clio.

Our role

Your law firm is the controller of the data held in Clio Manage. When you use TidyContacts we process that data on your behalf, as a processor, only to find and merge duplicate contacts at your request.

Data we process through the Clio API

• Your Clio user and firm: user id, name, email, firm id and name, region.
• Contacts: names, email addresses, phone numbers, addresses, custom field values, creation dates, used to detect duplicates.
• Items linked to contacts you review or merge: matters, relationships, communications, notes, documents (metadata), tasks, calendar entries, bills and trust information (read only, to decide whether a merge is safe).
• OAuth tokens issued by Clio, encrypted with AES-256-GCM.

We do not download document contents. We do not sell, share or use your data for advertising or to train AI models.

What we store and for how long

• Scan results (proposed duplicate groups with names, emails and phones): until you run a new scan or disconnect.
• Snapshots: before each merge, a full JSON copy of both contacts and their linked items. Kept 30 days, then deleted automatically. You can download them during that time.
• Audit log of merges (what was changed, when, by which Clio user): until you disconnect.
• Billing status (trial end date, Stripe customer and subscription ids).

When you disconnect TidyContacts, or revoke it in Clio, we delete all data we hold for your firm, including tokens, scans, snapshots and logs. Records Stripe must keep for tax and accounting stay with Stripe.

Where data is stored

Database: Supabase, hosted in the EU (Paris, AWS eu-west-3). Application hosting: Netlify. Data travels encrypted (HTTPS) between Clio, our functions and the database.

Sub-processors

• Supabase Inc. (database, EU region)
• Netlify Inc. (hosting and serverless functions)
• Stripe (payments). With Stripe Managed Payments, Stripe acts as merchant of record and processes billing details under its own privacy policy. We never see card numbers.

Security

Tokens are encrypted at rest with a dedicated key. The database is not reachable with public keys: only our server functions can read it. Access is limited to the operator. We request only the Clio permissions needed for detection and merging.

Your rights

Under the GDPR you can ask for access, correction, deletion or export of personal data we hold. Since your firm is the controller, requests about clients and contacts should go through your firm. Write to support@backfillab.com. You may also complain to the CNIL (France).

Incidents

If we discover a security incident affecting your data, we inform your firm without undue delay at the email of the connected Clio user.