CA Utility privacy policy
Effective 6 November 2026 ยท Questions: info@contactlessaccess.com
CA Utility is Contactless Access's installer app, for our installers and the building staff who set up and look after Contactless Access devices. It's only for people we give access to. This policy covers the app and the request form. For CA Secure, the app for everyone, see CA Secure's privacy policy.
Asking for CA Utility
The request form asks for your name, company or building, the access you need, the Gmail address for the Google Play invite, and, if you give them, a work email, a phone number and a note. It's voluntary and used only to set up your access and contact you about it. It's emailed to us and kept in our web admin, with the phone number and email addresses stored encrypted. We add your Gmail address to the app's test list on Google Play so you can install it. Requests we don't act on are deleted after 90 days.
Your account
You sign in with your Contactless Access web admin account: your email address and a 6-digit code we email you. The account holds your name, email address, role and the places you work on. On your phone, the app keeps your sign-in encrypted with a key held in the phone's secure storage, plus your email address and account details. Signing out removes them.
What the app asks your permission for
- Nearby devices (Bluetooth): to find, connect to and test Contactless Access modules.
- Location while using the app: to find modules on older Android phones, to pick the site you're at, and to add a location. There's no location in the background.
- Fingerprint, face or your phone's PIN (security accounts): the phone checks it's you before a secure door code is made. We never see your fingerprint or face.
The app doesn't use the camera, microphone or your contacts.
What the app sends to us
- Installation and test records: each module's hardware address (MAC) and name, its place (campus, building, elevator group, car and floor), the time, the mode, your operator name, the test results, signal strength, clicks, notes and module replacements. These become the module's service history. If you're offline, they're kept on the phone and sent later.
- Secure door PINs: when we build a secure module, its PIN is sent, so the door can be looked after later. PINs are stored encrypted.
- Adding a location: the site's name, centre and size. When you add one, the app also sends your phone's GPS position, so the server can check you're at the site (within 100 m). That position is used only for the check and isn't kept.
- Secure door codes (security accounts): the door, its rules and the phone numbers you type in for the people you give access to. What CA Secure then collects from them is in CA Secure's privacy policy.
Everything is sent over encrypted connections (HTTPS) to our server. The app sends no analytics, advertising IDs or crash reports.
Optional: Dropbox and Google
- Dropbox: used only by Contactless Access's own staff, inside the company. Installers' and building staff's results go only to the Contactless Access server (our device database), never to Dropbox.
- Google Maps and place search: the location editor shows Google Maps, and what you type in its search goes to Google to find the place. Google's privacy policy applies.
On your phone
The app keeps its work files on the phone: the current session, the places list, logos, and a CSV file per location. The CSV files include operator names, module addresses and PINs, so keep the phone locked. You can share a CSV file or a secure door QR code with your phone's share menu; where it goes is your choice. Your phone's own backup may include the app's data. Uninstalling CA Utility removes it from the phone.
Who can see it
Contactless Access, and web admin accounts given rights to those places (for example a building's security staff for their own doors); our service providers, only to run the service (our web host, and our email provider for sign-in codes); and authorities, only if the law requires it.
How long we keep it
Installation and test records are kept as the module's service history while it's in service. Your account is kept until you or your company ask us to remove it, and the work records stay with the modules. Requests we don't act on are deleted after 90 days.
Your choices
- Turn off Bluetooth or location access in your phone's settings (the app then can't find modules).
- To see, correct or delete information we hold about you, email info@contactlessaccess.com. Work records may need to be kept for the building's records.
Changes
If this policy changes, the new version will be posted here with a new date.