Privacy Policy

Account Information: Name, email address, and profile image.

Sign-up Source: The UTM parameters, the referring URL, and the page path of the link that brought you to sign up. The dashboard sends them with your sign-up request, and Convika records them with your account to see which links lead to sign-ups. What the dashboard sends depends on your answer to the cookie banner: - Accepted on convika.com or the dashboard: the first such link your browser saved. - Not answered yet: the link that opened the sign-up page, which your browser doesn't keep. - Declined on the dashboard: nothing. Declined on convika.com: its sign-up links don't pass UTM parameters to the dashboard, so Convika doesn't record the link that brought you to convika.com.

Usage Data: IP address, User-Agent, access country, and session information.

Content You Create: Pages (HTML, CSS, and JavaScript), page settings, and the instructions and source URLs you give Convika's built-in AI.

Free Rebuild Tool (used without an account): The page URL you enter and the rebuilt page. To enforce the daily limit, Convika keeps a keyed hash of your IP address, not the address itself, and deletes the hash the day after. Unless you keep the rebuild by signing up, the rebuilt page, its preview link, and its list of changes are deleted after 7 days, and so is the URL you entered. Convika keeps the page's domain and when the rebuild ran, to count how the tool is used.

Page Analytics: Views, button clicks, form submissions, and on-page behavior (scroll depth, time on page, and load speed) on published pages. Each event records the page path, referrer, UTM parameters, device type, country, User-Agent, visitor ID, and session ID. These events don't include the visitor's IP address.

Visitor ID: If a visitor chooses Allow analytics cookies on the page's cookie banner, the visitor ID is a random value kept in the `_cvk_vid` cookie for 90 days. If they choose Decline analytics cookies, or haven't chosen yet, Convika sets no visitor cookie. It computes the ID from the site, the IP address, and the User-Agent with a random key for each UTC day, and deletes that key 2 days after its day begins. The same person gets a different ID on each site and on each day. After the key is deleted, no one, Convika included, can compute the ID again from an IP address and User-Agent.

Convika Website and Dashboard Analytics: Page views on convika.com and the dashboard, counted per day by page path, referring site, UTM parameters, device type, and country. If you accepted cookies in the banner, each page view carries a random visitor ID that your browser keeps. If not, Convika computes the ID from the host name, the IP address, and the User-Agent with a key for each UTC day, the same way as the visitor ID above. The Cookie Policy lists what is stored.

Form Submission Data: Form responses, submitter's IP address, User-Agent, and country.

Payment Information: Payment is processed by Stripe. Convika does not store credit card numbers. We retain your Stripe customer ID and subscription ID.

Cookies: Session cookies, locale preferences, and consent state. See our Cookie Policy for details.

We use the information we collect for the following purposes:

- Providing and maintaining the Service, including authentication - Analyzing usage to improve the Service - Processing billing and payments - Providing customer support - Preventing fraud and abuse - Complying with legal obligations

We share your information with the following service providers only as necessary to provide the Service:

- Cloudflare: Hosting, CDN, DNS, custom domain certificates, database and file storage (D1 and R2), page analytics (Workers Analytics Engine), and loading the source URLs you give the built-in AI - Tinybird: Storing and querying page analytics: button click and form submission events (page path, referrer, UTM parameters, device type, country, the visitor ID, and the clicked button's text and link) and daily counts per page. To count unique visitors over a period, Tinybird also stores a per-site visitor identifier for each day a visitor viewed the site. We derive it with a secret key that only Convika holds, so without that key it can't be matched to the visitor ID in those events or to the same visitor on other sites. Tinybird deletes these identifiers after 400 days. Form responses and IP addresses are not sent to Tinybird. - Stripe: Payment processing - Resend: Email delivery (verification emails, form notifications, reports, and billing notices) - OpenRouter: Relays requests from Convika's built-in AI (page generation and editing in the dashboard) to the AI model you choose. It receives your instructions, the content of any source URL you import, and the page being edited. - AI model providers: OpenRouter passes those requests to the provider that serves the chosen model, such as Anthropic, OpenAI, Google, DeepSeek, Z.ai, Moonshot AI, or Sakana AI. The model picker in the dashboard lists the current models. - Google: Sign-in with Google (only if you choose it) - Slack: Internal alerts when someone reports a page for abuse (the page ID, the reason, and the reporter's description)

When you connect an AI client such as Claude, ChatGPT, or Codex, that client receives what Convika's tools return for your requests: page HTML, site settings, analytics summaries, and form submissions (without the submitter's IP address or User-Agent). The client's provider handles that data under its own privacy policy.

We may also disclose information in response to lawful requests from public authorities.

Your data is stored on Cloudflare's global network (D1 database and R2 object storage). Payment data is processed and stored by Stripe in the United States. Page analytics events are stored by Tinybird in the United States (AWS us-west-2). Requests to the built-in AI pass through OpenRouter in the United States to the chosen model's provider, which may process them in the United States, China, or another country, depending on the model.

- Account data: Retained while your account is active, plus 30 days after deletion (recovery grace period) - Access logs: 90 days - Page analytics events, which carry visitor IDs: 3 months in Cloudflare Workers Analytics Engine, and 400 days in the raw event archive in Cloudflare R2 and in Tinybird - Per-site daily visitor identifiers in Tinybird: 400 days - Daily key behind visitor IDs without analytics consent (landing pages, convika.com, and the dashboard): 2 days after its day begins - Daily page view counts for convika.com and the dashboard: kept indefinitely - Rows behind their unique visitor counts, each pairing a one-way hash of a visitor ID with the pages and sources it was counted under that day: 2 days after their day - Daily page analytics totals (counts per page, referrer, device, country, and UTM parameter, with no visitor IDs): kept indefinitely, so long-term charts keep working - Form submission data: Managed by site owners - Audit logs: 1 year

You have the following rights regarding your personal data:

- Access: View your personal data - Correction: Update inaccurate data - Deletion: Delete your account and associated data - Data Portability: Export your data - Withdrawal of Consent: Revoke previously given consent

To exercise these rights, contact us at tomoya.fujita@fluxenic.com.

For details on how we use cookies, please see our Cookie Policy.

The Service is not intended for individuals under 16 years of age. If we become aware that we have collected personal information from a child under 16, we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website. Your continued use of the Service after such notice constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, please contact us at tomoya.fujita@fluxenic.com.