Privacy Policy

The controller of the personal data processed through Convertly is BINARY BRAIN TECHNOLOGIES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ. For privacy requests, contact support@convertly.buzz. Company details:

We use the service providers listed below to run Convertly. Each processes personal data only on our instructions and under a data processing agreement. Paddle.com, our Merchant of Record, processes payment data as an independent controller under its own privacy policy. When you connect your own tools (for example Mailchimp, HubSpot, Zapier or a webhook), lead data is sent to them on your instruction; they are your providers, not ours. We do not sell personal data.

Account data: name, email address, password (stored hashed by Supabase Auth) or your Google sign-in, plan and subscription status, team membership, email preferences. We do not receive or store card numbers. Content: the quizzes you create and the images you upload. Lead data (processed on behalf of quiz creators): the name and email address a respondent enters, their answers, score and result. If a quiz asks for contact details before the last question, the name and email are saved at that point (a partial lead). Lead records do not contain IP addresses. Usage and technical data: product analytics events (PostHog), collected without cookies or device identifiers; signed-in users are identified by account ID and plan only. Error reports with technical details of the failing request, without IP addresses (Sentry). Server logs (Vercel). API request logs for API key users. AI generation inputs: when you generate a quiz with AI, the topic, audience and goal you enter are sent to Anthropic.

We use personal data to: provide and secure the Service; send emails about your account, billing and new leads, quiz results to respondents, and, unless you unsubscribe, welcome and onboarding tips; send service messages such as trial reminders and usage warnings; understand how the product is used, without cookies or device identifiers (PostHog); find and fix errors (Sentry); limit abuse with rate limits that use IP addresses temporarily (Upstash); and generate quizzes with AI when you ask for it (Anthropic).

Contract performance (Art. 6(1)(b) GDPR): your account, quizzes, leads, billing and the emails the Service needs to send. Legitimate interests (Art. 6(1)(f)): security, rate limiting, error monitoring, cookieless product analytics, welcome and onboarding emails (you can unsubscribe at any time), and improving the Service; these interests do not override your rights. Legal obligation (Art. 6(1)(c)): records we must keep by law.

Account, quizzes and leads: kept until you delete them or your account. Deleting your account is immediate and permanent: your profile, quizzes, leads, uploaded images, team, API keys and integrations are deleted, and an active subscription is cancelled. Database backups are taken daily and kept for 7 days, so deleted data is gone from the backups within 8 days. Quiz images: deleted when you delete the quiz or your account. Quiz session and answer analytics: deleted after 180 days. API request logs: deleted after 90 days. Error reports (Sentry): 30 days. Product analytics (PostHog): 30 days. Payment records: kept by Paddle as Merchant of Record under its policies; any records we must keep by law are kept for the required period.

You have the right to: access your personal data (Art. 15); rectify it (Art. 16); erase it (Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and withdraw consent at any time. You can delete your account and change your email preferences yourself in your account settings; every welcome or onboarding email has an unsubscribe link. Leads can be exported as CSV (Pro and Business plans) or through the API; for a copy of your other data, email support@convertly.buzz. We answer requests within one month. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

We use only the essential and functional cookies listed in the table below: they keep you signed in, secure sign-in, let a respondent download their own results, and remember preferences such as your currency. Product analytics (PostHog) is cookieless: it uses no cookies, local storage or other device identifiers, so we do not use a consent banner for analytics. We do not use advertising cookies.

Data is encrypted in transit (TLS) and at rest. Row-level security in the database separates the data of each account and team, and server-side checks protect sensitive fields and actions. We apply appropriate technical and organisational measures; no method of transmission over the internet is completely secure.

We process data mainly in the EU: Supabase and Upstash in Frankfurt, application functions on Vercel in Frankfurt, Resend in Ireland, Sentry in Germany and PostHog in its EU cloud. Some providers are based in, or may process data in, the USA: Vercel (edge network and a secondary function region), Anthropic (AI quiz generation) and Google (sign-in with Google, if you use it). These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses approved by the European Commission.

When you collect leads with Convertly, you (the quiz creator) are the controller of your respondents' personal data, and we process it on your behalf as a processor under our Data Processing Agreement. You need a lawful basis for collecting lead data and must inform your respondents how it will be used. You can delete leads at any time in your dashboard and export them as CSV (Pro and Business plans) or through the API.

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

We will notify you of material changes by email. The current version is always available at https://convertly.buzz/privacy.