Convertlyft privacy & data

the customer is the data controller and we act as their processor/service provider under our Data Processing Agreement

name, email, company, the messages you send

IP address, device and browser type, operating system, referring URL, pages viewed

Billing data (paid plans only): plan, billing address, and transaction history.

Usage data : how you use the dashboard (features used, pages accessed)

We may receive limited business contact information (name, email, role) from public sources

the shopper identifiers Shopify includes in its customer data request and redaction webhooks

checkout events (order value, currency, order id, item count)

behavior data (clicks, scrolls, form interactions)

technical data (device, browser, errors, performance)

visit data (session IDs, timestamps)

Card details (entered on Stripe, never stored by us), billing address, and transaction history

Recipient email address and message content

Access and refresh tokens for the customer's own connected accounts

Browser and device signals and the IP address of the person completing the check

Messages you send us and your email address

To provide the Service (contract): operate your account, deliver dashboards and digests, provide support, send transactional and security notices, process billing.

Legitimate interests : improve and secure the Service, prevent fraud and abuse, perform internal analytics and reporting

We may aggregate or de-identify information so it can no longer reasonably identify you, and use it for any lawful purpose — including research, benchmarks, and published industry studies.

collection, storage, aggregation, analysis, and display of visitor event data to provide the Service

Application hosting, delivery and serverless execution

Processes payments for paid plans and one-off purchases

Receives error reports from the dashboard and our servers

the Turnstile bot check on sign-in and password reset

Routes the model calls behind questions asked in the dashboard, written reports, error explanations and drafted fixes

We keep personal information for as long as your account is active or as needed to provide the Service

If you close your account, we keep your account and site data for 12 months in case you come back, and then delete it.

Shopify allows 30 days for this; a run that cannot finish is tried again the next hour.

Within 90 days after account termination, we will delete or anonymize Customer Personal Data

Customer redaction requests are completed within 30 days.

our servers are located in Germany (database and application servers)

and the United States (scheduled jobs and error reports)

Customer Personal Data is stored and processed in Germany (database and application servers)

the United States (scheduled jobs and error reports)

Germany (application servers)

Supabase Primary database, authentication, and file storage Germany

we rely on appropriate safeguards, including EU Standard Contractual Clauses or the UK International Data Transfer Agreement

the parties rely on the EU Standard Contractual Clauses (Module 2: controller-to-processor)

the UK IDTA/Addendum

A current list is available at convertlyft.com/subprocessors .

under our Data Processing Agreement (" DPA ")

You can delete your sites’ data yourself at any time in Settings; that deletion is permanent.

access, correct, or delete your personal information

object to or restrict processing

data portability

withdraw consent (where processing is based on consent)

opt out of marketing communications

lodge a complaint with your local supervisory authority

Customer is responsible for responding to data-subject requests (access, deletion, portability, objection)

tools or exports to locate and delete a visitor's data

a customer may object on reasonable data-protection grounds under DPA §4

We do not sell your personal information, and we do not share it with third parties for their own advertising.