What you are handing over when you plug a tool into your customer list
The connect-your-contacts button is the least-read moment in small business software, and the customer list is usually the most valuable thing the business owns. Five plain questions worth asking any vendor before you tap Allow — and the dull habit that keeps the list yours.
It is a Thursday night, the shop has been closed for an hour, and the owner of a small heating-and-cooling company is at her kitchen table signing up for a scheduling tool she has been meaning to try. The flow is going fine until the last step, which asks to connect her contacts so the tool can get started faster. She taps Allow. Every app asks this, and the alternative is retyping a decade of customers by hand at 9pm.
That is the whole event. It takes about a second. There is no confirmation screen, no summary of what went where, and nothing about the moment feels like a decision. Somewhere in the terms she did not open is the answer to what just happened to those names.
This is a subject that attracts a lot of shouting, so it is worth saying what the argument is not. It is not that these tools are sinister. The contacts request is there for a boring reason: onboarding is where products lose people, and hand-entering a decade of records is where owners give up. The argument is narrower. An owner just agreed to terms she has not read, about the most valuable thing her business owns, in the exact moment she was least equipped to think about it.
The list is the business
Ask an owner to name their most valuable asset and you usually hear about the truck, the tools, the building, or the crew. Ask what they would least want to lose in a fire and the answer changes. The customer list — names, numbers, addresses, what was done and when, who pays on time, who refers — took the longest to build and would take the longest to rebuild. When a small business is sold, a large share of what the buyer is paying for is that list and the relationships behind it. Nearly everything else can be replaced with a purchase order.
The part that is not really yours
There is a second thing here that gets no airtime. The contact list is not only your data. It is also data about every person in it — people who handed over a phone number for a specific reason, which was so you could call them about their water heater. Not so a software company could hold a copy of it.
That is not just a matter of manners. The rules around business texting in the US — the carrier registration process usually called A2P 10DLC — are built on the idea that consent belongs to a particular relationship. A person opted in to hear from you, about their job, from your number. That opt-in does not travel with the file. The carrier rules are explicit that opt-in and consent data is not to be passed around to third parties, and registration is not a license to message whoever sits in your address book. A list you imported is not automatically a list you may text. Owners find this out at the worst moment: after a campaign gets filtered, or a registration comes back rejected.
Five questions worth asking
None of this requires a lawyer, or reading the terms end to end, which is a thing nobody does and nobody should pretend to. It requires asking a vendor five questions in an email you keep. The answers matter. How they answer matters more.
Who can read this? Not the same question as "is it encrypted," which has a reassuring answer that addresses something else. Encryption at rest mostly protects you from a stolen drive. It says nothing about which humans can pull up your list — support staff working a ticket, engineers reproducing a bug, an analytics tool wired into the product because someone wanted a chart. Almost no software is built alone, and the subprocessor list — the outside services that touch your data on the vendor's behalf — is normal to ask for and normal to publish. A vendor who cannot produce one has not thought about the question.
Is it used to train anything? This is the live one, and the answers move. Several large platforms have shipped AI features whose terms permit customer data to be used for model training, on by default, with an opt-out that exists but is not advertised. Others wrote the opposite commitment in after their customers objected loudly. At least one major vendor announced a date, well in advance, on which the default would change. The pattern worth noticing is not that any particular company is behaving badly — it is that this term is not stable. Ask what the answer is today, whether it is the same for everyone, and how you would find out if it changed. "We would update the terms" is an answer. It is just not a good one.
Can I get it back out? Ask for an export, then ask three things about it: what format, how complete, and whether you can do it yourself. Format should be something ordinary — a CSV or a JSON file another tool can read without a translator. Complete should mean the history too, not just the current state of each record: when you last spoke, what the job was, what they paid. Self-serve matters most, because an export you have to request arrives late, in whatever shape the vendor felt like, exactly when the relationship has gone sour.
What happens to it if I leave? There is usually a window after you cancel during which you can still retrieve your data, and then there is not. Ask how long that window is, and write it down the day you sign up rather than the day you go. Ask, too, what happens if the company is acquired or shuts down. Privacy policies routinely carry a clause saying that in a merger, an acquisition, or a sale of assets, your data moves with the business — which is standard, and reasonable, and also means the answers you got today came from a company that might not be holding your list a year from now.
Can I have it deleted? Deletion has the most surface area, because "deleted" in a product usually means "hidden from you." Ask whether deletion reaches the backups, and on what timeline. Ask whether it reaches the copies held by subprocessors. Ask whether anything survives in aggregate or anonymized form, because that is where the real answer often lives — a vendor can honestly delete your records and keep everything it learned from them. And ask whether you get written confirmation when it is done.
The habit that matters more than the questions
Ask the questions. Then do not rely on the answers. The thing that actually keeps the list yours is duller than any of the above: export it on a regular rhythm, and keep the file somewhere you control.
Not because you plan to leave. Because that export is the only version of your customer list whose existence does not depend on a company staying in business, staying honest, or staying interested in the product you bought. Pick a rhythm you will actually remember — the day you do invoices, whenever — and keep the last several copies. If you do need them, you will need them badly and quickly, and that is precisely the situation in which the self-serve export button turns out to be the thing that stopped working.
What the answer tells you
Every one of these questions has a plain answer. Not a simple one — some are genuinely complicated. But plain. A company that has thought about them can answer in a paragraph, on the first ask, without escalating to legal and without changing the subject to how much they care about your privacy.
The evasive answers are informative in a different way. "We take your privacy seriously" in place of a subprocessor list means nobody has written the list. "You own your data" appears in nearly every terms page and tells you nothing about whether you can get it out. A support rep who has to go ask someone means the question has not come up before, which is itself an answer about how the company thinks about the thing you just handed it.
None of this is about finding a villain. It is that the questions are cheap to ask and the answers are expensive to fake.
It would be strange to write all of that and not turn it around. Catalyst asks owners for the same kind of access every tool in this category asks for, and deserves the same five questions, in writing. To be plain about what is and is not running here: Sarah, the front-desk assistant on the Growth side, works over text rather than voice today — voice is on the roadmap, not live — and live texting switches on as carrier approval clears, with a real person on our team running the front desk by hand until then. That is not a pitch. It is the kind of detail a vendor ought to hand you without being asked twice.
The point
The connect-your-contacts button is not a trap. It is a decision designed not to feel like one, offered at the moment of least resistance, about the asset that would be hardest to replace. Nothing about that calls for alarm. It calls for roughly the attention you would give to handing someone a key to the shop — not much attention, honestly, but more than none, and more than a tap.
The five questions take an email. The export takes a few minutes. And the answers you get back will tell you something about a vendor that no feature list ever will.