ConvertlyLawful Processing
We process data based on clear legal grounds: contract performance, legitimate interest, and explicit consent where required.
CONVERTLY / GDPR
GDPR Compliance
How Convertly protects your data and respects your privacy under EU regulations.
Last updated: October 2026
Our Commitment to GDPR
As a European company based in Poland, GDPR compliance is built into the foundation of Convertly — not bolted on as an afterthought. We are committed to protecting the personal data of our users and their quiz respondents.
How We Comply
Data Minimization
We only collect the data needed to run the service. Lead records store name, email, answers and score, not IP addresses, and quiz session and answer analytics are deleted after 180 days.
Encryption and Security
All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Row-level security ensures complete workspace isolation.
Right to Be Forgotten
You can delete your account and all associated data, including uploaded images, yourself in your account settings. The deletion is immediate and cancels an active subscription; backups are cleared within 8 days.
Data Portability
Export your leads as CSV (Pro and Business plans) or through the API. For a copy of your other data, contact us and we provide it within one month.
Breach Notification
In the event of a data breach, we notify affected parties within 48 hours as required by GDPR Article 33.
Your Rights Under GDPR
As a data subject, you have the right to:
- Access your personal data
- Article 15
- Rectify inaccurate data
- Article 16
- Erase your data
- Article 17
- Restrict processing
- Article 18
- Data portability
- Article 20
- Object to processing
- Article 21
- Not be subject to automated decision-making
- Article 22
To exercise any of these rights, contact us at support@convertly.buzz.
Tracking and Analytics Compliance
When respondents take your quizzes, Convertly records engagement for you. Here is what runs and where:
- No advertising cookies or cross-site advertising trackers
- Product analytics (PostHog, EU cloud) is cookieless: no cookies, local storage or device identifiers, also on public quiz pages and embeds
- Error monitoring (Sentry, EU region) receives technical details of failing requests, without IP addresses; there is no session replay
- Quiz session and answer analytics are deleted after 180 days
- Lead records do not store IP addresses; rate limiting uses them only temporarily (Upstash, Frankfurt)
- All cookies are listed in our Privacy Policy
Sub-processors
Third-party services we rely on to deliver Convertly.
| Provider | Purpose | Location / transfer basis |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage (quiz images) | EU (Frankfurt, Germany) |
| Vercel Inc. | Application hosting, scheduled jobs, content delivery network | EU (Frankfurt) for application functions; global edge network; USA (Washington, D.C.) as a secondary function region; SCCs / EU-US DPF |
| Upstash Inc. | Rate limiting (uses IP addresses temporarily) | EU (Frankfurt, Germany) |
| Resend Inc. | Sending emails (account, billing, lead alerts, quiz results to respondents, onboarding) | EU (Ireland) |
| Functional Software, Inc. (Sentry) | Error monitoring (technical details of failing requests, without IP addresses) | EU (Germany) |
| PostHog Inc. | Product analytics, cookieless (no cookies or device identifiers) | EU (EU cloud) |
| Anthropic PBC | AI quiz generation (receives the topic, audience and goal you enter; no lead data) | USA; SCCs / EU-US DPF |
| Google LLC | Sign-in with Google (only if you choose it) | USA / global; EU-US DPF |
| Paddle.com Market Ltd | Merchant of Record for purchases: checkout, billing, invoices, taxes, refunds (an independent controller for payment data) | United Kingdom (adequacy decision) |
Documentation
Questions about GDPR?
Our team is happy to answer any questions about how we handle your data and ensure compliance.