Privacy Policy

1. Information we collect

We only collect what we need to run the product:

• Account data: email address, optional first name, hashed password (bcrypt) or OAuth identifier when you sign in with Google.
• Audit data: the URLs you submit, the public page content and screenshots we capture when we load those pages, and the resulting scores, findings and redesign images.
• Billing metadata: plan, status, last 4 digits of card, and renewal date, mirrored from Stripe. We never see or store full card numbers, CVCs, or expiry dates.
• Email engagement: opens, clicks, and bounces for transactional and lifecycle emails (sent via Resend). Used to improve deliverability and let you opt out.
• Standard request logs: IP address, user agent, route accessed, and timestamps. Used for rate limiting, abuse prevention, and debugging. Rotated after 30 days.
• AI assistant connections: when you use ConversionScore from ChatGPT, Claude or another assistant; see section 3.
• Analytics and ad measurement: how the site is used (Google Analytics), and whether a visit came from one of our ads and led to an audit (the OpenAI Ads pixel). In the EU and UK these wait for your consent; see section 6.

2. How we use it

• To run an audit, generate your report, and email it to you.
• To maintain your account, process payments, and apply your subscription tier.
• To send transactional and lifecycle emails (audit-ready, payment receipts, monthly recap, win-back). You can unsubscribe from non-essential email at any time using the link in every message.
• To debug issues, prevent abuse, and protect the service from spam, bots, and fraud.
• To measure aggregate product usage so we can prioritise improvements. Aggregate metrics are anonymised, not joined back to individual users in any reporting surface we share publicly.
• To measure which of our ads lead people to run an audit or sign up.

We do not sell your personal information, rent it, or use your audit data to train external AI models.

3. AI assistants (ChatGPT, Claude and other MCP clients)

You can use ConversionScore from an AI assistant by connecting it to our MCP server. When you do:

• What we receive: only what each tool needs, namely the addresses of the public pages you ask us to score, audit or compare, the ids of your own reports, and the redesign options you choose. We never receive your conversation with the assistant, and we don't ask for passwords, payment details or other sensitive data.
• What we store: full audits and redesigns are saved to your account like any other report. Quick scores and comparisons aren't saved as reports; we log the page address as a usage event, as we do for quick scores on our website. Each connection is stored as a revocable key: its name, a one-way hash (SHA-256) of the key, and when it was created, last used and revoked.
• Why: to run the tools you ask for and to apply your plan's monthly allowance.
• Who receives it: our sub-processors in section 4, to run the audit (for example, OpenAI analyses the page). The results go back to the assistant you connected, and its provider handles them under its own privacy policy. We don't sell this data or use it for advertising.
• How long we keep it: reports are kept while your account is active and deleted within 30 days of an account deletion request. Connection records are kept until your account is deleted, so a revoked connection still appears in your list.
• Report links: a report link the assistant shows you carries a key that opens that one report and its redesign, read-only, for 30 days, so it works in the assistant's own browser without signing in. Anyone you share such a link with can view that report until the key expires.
• Your controls: revoke a connection at any time in Settings, API keys, and it stops working immediately. Your rights in section 5 cover everything an assistant saved, too.

4. Sub-processors

We use a small set of trusted vendors to run the product. Your data flows through these providers strictly to deliver the service:

• Replit, application hosting and deploy pipeline.
• Neon, managed Postgres database (encrypted at rest by default).
• Stripe, payments and subscription management.
• Resend, transactional and lifecycle email delivery.
• OpenAI, the AI that analyses pages and generates redesign mockups. Under OpenAI's API terms, content sent through the API is not used to train their models.
• Google, sign-in with Google, and Google Analytics for site usage. Our Analytics property is linked to Google Ads so we can measure which ads lead to sign-ups.
• OpenAI Ads, an ad-measurement pixel; see section 6 for exactly what it receives.
• RankAI, a script on our pages that delivers search-optimisation updates to our own site content.
• Sentry, error monitoring, so we can find and fix crashes.

5. Your rights (GDPR / CCPA)

If you live in the EU, UK, EEA, Switzerland, or California, you have the right to:

• Access the personal data we hold about you.
• Correct anything that is inaccurate.
• Delete your account and the data associated with it.
• Export your data in a portable, machine-readable format.
• Object to processing for marketing purposes (just unsubscribe).

Email support@conversionscore.ai with the request. We will respond within 30 days, typically much sooner.

6. Cookies and tracking

Strictly necessary. A session cookie keeps you signed in. Your cookie choice is stored in your browser's local storage. These are always on.

Analytics and ad measurement. Google Analytics tells us how the site is used. The OpenAI Ads pixel tells us whether a visit came from one of our ads: it receives page views, an event when you generate a report, and, when you're signed in, a one-way hash (SHA-256) of your email address so the visit can be matched to the ad. It never receives your email address itself. Neither receives your report links: report IDs are removed from the page views we send to Google Analytics, and the pixel doesn't run on report pages.

Our own measurement. We record a few product events on our own servers, like viewing a report or clicking to upgrade, with a random ID stored in your browser, so we can see how people move through the product. This is never shared. Unless analytics are on for you, the ID lasts only for your visit.

If you're in the EU, EEA, UK or Switzerland (we go by your device's time zone), these stay off until you choose "Accept" in the cookie banner. Everywhere else they load unless you turn them off. Either way, "Reject non-essential" in the banner, or "Cookie settings" in the site footer, stops them loading and stops us sending them data, and you can change your choice at any time.

7. Data retention

Account data and reports are retained for as long as your account is active. If you delete your account, we remove your reports and personal data within 30 days, except for records we are legally required to keep (e.g. invoices for tax compliance, retained per Stripe's standard schedule). Application logs are rotated after 30 days. Product usage events (for example, that a page was quick-scored) are kept to measure and improve the product. AI assistant connection records are kept until your account is deleted (see section 3).

8. Children

Conversion Score is not intended for, and not directed at, anyone under 16. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we will delete the account.

9. Changes to this policy

When we make material changes we will update the date at the top, post the new version here, and email active subscribers if the change meaningfully affects them. Continued use of the service after a change constitutes acceptance of the updated policy.

10. Contact

Questions, requests, or complaints about how we handle your data? Email support@conversionscore.ai . A real person reads every message.