Privacy Policy

1. Who This Policy Covers

ConvoScore has two kinds of users, and this policy covers both. As an account holder, you give us your own details to run your dashboard, and for that data ConvoScore is the data controller. As a visitor to a website that has embedded a ConvoScore chatbot, the information you share goes to the site owner: for that data the site owner is the controller and ConvoScore acts only as their processor, handling it on their instructions.

2. Data We Collect

We collect the following categories of data:

• Account data: your name, optional company name, email address, and either a securely hashed password or, if you sign in with Google, your Google account identifier.
• Site and configuration data: the sites and chatbots you create, their wording and settings, and your own Gemini API key if you choose to provide one (stored encrypted).
• Visitor and conversation data: whatever a visitor types into a chatbot, typically their name, company, contact details, and stated need, together with the full transcript and the priority score and structured fields derived from it.
• Technical data: IP address, browser user-agent, and timestamps in server logs, kept for security and troubleshooting.
• Billing data: your plan, subscription status, and Paddle customer and subscription identifiers. Card details are handled entirely by Paddle; we never see or store them.

3. How We Use Data and Legal Bases

We use account and site data to provide the dashboard and run your chatbots (performance of our contract with you). We use visitor conversation data to generate structured requests for the site owner and to run the conversation itself, which involves sending message content to Google's Gemini API for language understanding (on the site owner's instructions, as their processor). We use technical data to keep the Service secure and diagnose problems (our legitimate interest in a safe, working service). We use your email to send service and billing notices (contract) and, only with your consent, occasional product news. We do not sell personal data, and we do not use visitor conversations to train our own models.

4. Sub-processors and Where Your Data Is Stored

We use a small number of infrastructure providers to run ConvoScore. Each processes data only as needed to provide its part of the Service.

• Neon (Neon Inc.) — the PostgreSQL database that stores all account, site, conversation, and lead data. Hosted in the European Union, region eu-central-1 (Frankfurt, Germany). Provides the continuous backups used for recovery.
• Vercel (Vercel Inc.) — application hosting, serverless functions, and CDN. Runs the code that processes requests; compute runs primarily in the United States. Vercel does not receive a separate copy of the database.
• Google (Google LLC) — the Gemini API processes conversation message content to understand visitor messages and extract structured fields, on Google's infrastructure, primarily in the United States. If a site owner supplies their own Gemini API key, that site's conversations are processed under that key and Google's terms with that customer. Google Analytics (also Google LLC) is used on the marketing site, but only after you consent to analytics cookies through the cookie preference banner.
• Tavily (Tavily Inc.): a web search provider, used only if a site owner turns on lead verification. In that case we may look up the company a visitor entered, and the job title they gave for that company, in public web sources. The search provider receives the company name, the company's web domain taken from the email address, and only when the company checks out, the visitor's name together with the company name, as search queries. A Google Gemini model then reads the search results to extract company facts and a job title. We store only company facts and a job title, never other personal details about the visitor.
• Email delivery — transactional email (lead notifications, password resets, billing and incident notices) is sent through a third-party SMTP provider, currently Google (Gmail / Google Workspace), in the United States.
• Paddle (Paddle.com Market Limited) — Merchant of Record for paid subscriptions. Processes your billing and payment data as an independent controller under its own privacy policy; based in the United Kingdom.

5. International Data Transfers

Your stored data lives in the EU, but some processing happens in the United States (Vercel compute, Google's Gemini API, email delivery). Where personal data is transferred outside the EU/EEA, the UK, or Türkiye, we rely on the transfer mechanisms those providers offer, primarily the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. You can ask us for more detail on a specific transfer.

6. Data Retention

We keep data only as long as it is needed:

• Account data: kept while your account is open and deleted within 30 days of account closure, except where a legal or tax obligation requires us to keep something longer.
• Visitor and conversation data: kept until you delete it or close the site; you control this from your dashboard. We do not impose our own expiry, so you should delete lead data you no longer need.
• Server logs: retained for up to 30 days, then deleted or anonymized.
• Database backups: a rolling point-in-time recovery window of at least 7 days; deleted records fall out of backups as that window moves forward.
• Billing records: invoice and transaction records are kept by us and by Paddle for as long as tax law requires, typically several years.

7. Data Isolation Between Tenants

Every site's chatbot configuration, conversations, and leads are scoped to that site and its owner. Access is checked on every request against the signed-in account, and data never crosses from one tenant to another.

8. Cookies and Local Storage

The dashboard uses a session cookie to keep you signed in; it is strictly necessary and set only after you log in. The embeddable widget uses local storage on the visitor's own device to resume an in-progress conversation, and the marketing site remembers your language choice and your cookie preference, all strictly necessary. With your consent, given through the cookie preference banner (reopen it anytime from the "Cookie preferences" link in the footer), we also set Google Analytics cookies to understand aggregate traffic to the marketing site; nothing beyond strictly necessary cookies is set until you consent, and you can withdraw consent at any time. We set no advertising or cross-site tracking cookies.

9. Your Rights

Depending on where you live, including under the EU/UK GDPR and Türkiye's KVKK, you may have the right to access, correct, export (portability), delete, or restrict the processing of personal data we hold about you, and to object to processing based on legitimate interest. To exercise a right over your own account data, contact us from your account email and we will respond within 30 days. If your request concerns a visitor whose data was collected through your site, we will assist you as the processor, but the request should normally go to you as the controller. You also have the right to complain to your local data-protection authority.

10. How We Protect Data

Security measures include:

• Passwords are stored only as salted hashes, never in plain text.
• Each site's Gemini API key is encrypted at rest with AES-256-GCM and is never returned in plain text through the dashboard or any API.
• All traffic is served over HTTPS/TLS.
• Dashboard data access is authorized per account and enforced on every request.
• The database is hosted in the EU with access restricted to the application, and continuous backups are enabled.

11. Data Breach Notification

If we become aware of a security breach affecting your personal data, we will investigate promptly, act to contain it, and notify you by email without undue delay, and within 72 hours where the law requires it, including what happened, the data involved, and what we and you can do about it. Where we act as your processor for visitor data, we will notify you so that you can meet your own notification duties as controller.

12. Children's Data

ConvoScore is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided data through a chatbot, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date on this page, and for significant changes we will notify account holders by email or an in-dashboard notice before they take effect.

14. Contact

Questions about this Privacy Policy, or to exercise a privacy right, can be sent through our Contact page or by email to the address shown there. If you are in the EU/EEA or UK and want a single point of contact for data protection, use the same address and mark it for the attention of the privacy contact.