Privacy Policy
Last updated: 22 October 2026
1. Introduction
This Privacy Policy explains how ConvertScale (legally registered as Конвърт Скейл ООД, a company incorporated in Bulgaria, European Union) collects, uses, stores, shares, and protects your personal data when you use our websites and services.
This policy applies to all visitors and users of:
- convertscale.ai — our corporate website
- flowscan.pro — our FlowScan post-click funnel diagnostic SaaS product
By accessing or using our websites and services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.
2. Data Controller
The data controller responsible for your personal data is:
Конвърт Скейл ООД (ConvertScale)
Registered in Bulgaria, European Union
General contact: [email protected]
Privacy / DPO contact: [email protected]
For all privacy-related inquiries, data subject requests, or complaints, please contact us at [email protected].
3. Personal Data We Collect
We collect different categories of personal data depending on how you interact with our websites and services.
3.1 Contact Form (convertscale.ai)
When you submit our contact form, we collect:
- Full name
- Email address
- Company name
- Website URL
- Monthly advertising spend range
- Area of interest
- IP address (collected automatically)
3.2 FlowScan Product (flowscan.pro)
When you use FlowScan, we may collect the following data:
Free Scan
- Email address — collected via our email gate for report delivery and to identify you as a user
- Domain / URL submitted for scanning — the publicly accessible website you submit for analysis. We crawl and analyze only publicly available page data (HTML, CSS, JavaScript, assets, performance metrics).
- During a scan, FlowScan renders the page in a browser and captures a temporary image (screenshot) of it as part of automated analysis. These images are never published; shown only inside the report for that scan, and they are covered by the same retention rule as the scan record they belong to.
- Browser fingerprint hash — a one-way hash used solely for A/B price variant assignment. We do not store your full browser fingerprint; only a non-reversible hash identifier is retained.
- Answers to intake questions — voluntary responses about your advertising spend, tools used, funnel type, and related business context
- IP address — collected automatically with each request
Paid Services
If you purchase a paid audit or consultation, we may additionally collect:
- File uploads — screenshots, CSV exports from marketing tools (e.g., ad platform exports, analytics exports), and other documents you choose to share for intake purposes
- Voice notes — optional audio recordings you provide to describe your funnel or situation
- Loom video URLs — optional links to screen recordings or video walkthroughs you share
- Google Analytics data — accessed via OAuth integration with your explicit consent, used for deeper funnel analysis. You can revoke this access at any time through your Google account settings.
- Payment information — payment card details are processed directly by Stripe Inc. We do not receive, process, or store your full card numbers. We receive only a transaction reference, payment status, and the last four digits of your card for receipt purposes.
When you buy something. At checkout we record the country of your billing address, the country of your payment card, your IP address and the country we derive from it, and the date and time you accepted our terms. We keep these together with the invoice because tax law requires us to show which country a sale belongs to, and because a payment record must be kept complete and unchanged for the period the law sets (ten years in Bulgaria, where we are established). We use them for nothing else. They are not shared with anyone except our payment processor (Stripe), our accountant, and the tax authorities when required.
3.3 Automatically Collected Data
When you visit our websites, certain technical data is collected automatically:
- IP address
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time spent
- Device type and screen resolution
4. Legal Basis for Processing (GDPR Article 6)
We process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Providing the FlowScan scan service | Performance of a contract / pre-contractual steps | Art. 6(1)(b) |
| Processing payments via Stripe | Performance of a contract | Art. 6(1)(b) |
| Responding to contact form inquiries | Legitimate interest (business communication) | Art. 6(1)(f) |
| Email marketing and drip sequences | Consent | Art. 6(1)(a) |
| A/B price variant assignment (fingerprint hash) | Legitimate interest (service optimization) | Art. 6(1)(f) |
| Funnel analysis, including AI-written recommendations | Performance of a contract / legitimate interest | Art. 6(1)(b) / (f) |
| Google Analytics data access (OAuth) | Explicit consent | Art. 6(1)(a) |
| Website analytics (Google Analytics 4) | Consent (via cookie banner) | Art. 6(1)(a) |
| Session recording (Microsoft Clarity) | Consent (via cookie banner) | Art. 6(1)(a) |
| Security, fraud prevention, and abuse detection | Legitimate interest | Art. 6(1)(f) |
| Product improvement and analytics | Legitimate interest | Art. 6(1)(f) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time by contacting us at [email protected].
5. How We Use Your Data
We use the personal data we collect for the following purposes:
- Service delivery — to perform funnel scans, generate diagnostic reports, and deliver them to you
- AI analysis — to send your submitted URL and associated data (public page content, a screenshot of the page, your intake answers and any follow-up emails the scan receives) to an AI model (Azure OpenAI) to judge a few checks and write the explanations and recommendations in your report
- Payment processing — to process transactions for paid services via Stripe
- Communication — to respond to your inquiries, send scan reports, and provide customer support
- Email marketing — to send relevant educational content, product updates, and promotional material (with your consent, and with a one-click unsubscribe option in every email)
- Product improvement — to analyze aggregated scan data, user behavior patterns, and feedback to improve the accuracy and capabilities of FlowScan
- Price optimization — to assign A/B test variants for pricing using a non-reversible browser fingerprint hash
- Security — to protect our services from abuse, fraud, and unauthorized access
- Session booking — to facilitate scheduling of paid consultation sessions via Calendly
7. Third-Party Service Providers
We use the following third-party service providers to operate our business. Each provider has access only to the minimum data necessary for their specific function.
Stripe, Inc.
Stripe is PCI DSS Level 1 certified. We never receive or store your full card number. Stripe processes payments directly and provides us only with transaction confirmations and the last four digits of your card.
Resend (Resend, Inc.)
Resend is our single email delivery provider, used to send scan reports, verification emails, and marketing communications. Our self-hosted Sendy installation relays its outbound email through Resend's SMTP transport rather than sending directly.
Azure OpenAI Service (Microsoft)
Data is sent to Azure OpenAI for processing to generate funnel diagnostic analysis. Per our enterprise agreement with Microsoft, submitted data is not stored by Azure OpenAI after processing, is not used to train or improve their models, and is not accessible to other customers.
Cloudflare, Inc.
Cloudflare acts as a reverse proxy for our websites. It processes request data to provide security and performance services. Cloudflare may temporarily log access data for security purposes.
Calendly, LLC
Used for scheduling paid consultation and audit sessions. Data shared with Calendly is limited to what you provide when booking a session.
Google Analytics 4 (Google LLC)
Active. Loaded through Google Tag Manager, and sets cookies only after you accept analytics cookies in our banner (outside the EEA, the UK and Switzerland it sends cookieless pings until you choose, as described in section 6.3). GA4 does not log or store IP addresses.
Microsoft Clarity (Planned)
Not yet active. When implemented, Clarity will only be loaded after explicit cookie consent. Sensitive form fields will be masked to prevent capture of personal data.
About Sendy (Email Marketing)
We use Sendy for email marketing automation (drip sequences, newsletters, and product updates). Sendy is a self-hosted application running on our own infrastructure — it is not a third-party cloud service. Your email marketing data never leaves our server environment. Sendy relays its outbound email through Resend's SMTP transport for delivery.
8. Data Storage and Security
8.1 Where We Store Your Data
Your personal data is stored in a PostgreSQL database on a dedicated server hosted by Scaleway (Dedibox) located in France, European Union. This ensures that your data remains within the European Economic Area (EEA) at all times for primary storage.
8.2 Security Measures
We implement appropriate technical and organizational security measures, including:
- Encrypted data transmission (TLS/HTTPS on all endpoints)
- Dedicated server infrastructure (not shared hosting)
- Database access restricted to application-level connections only
- Cloudflare DDoS protection and Web Application Firewall
- Regular security updates and patching
- Minimal access principle — only authorized personnel access personal data
- CSRF protection on all form submissions
- Secure session management
8.3 International Data Transfers
Our primary data storage is within the EU (France). Some third-party providers (Stripe, Calendly) are based in the United States. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place:
- EU-U.S. Data Privacy Framework (DPF) certification of the receiving party
- Standard Contractual Clauses (SCCs) as adopted by the European Commission
- Binding data processing agreements with all third-party processors
9. Data Retention
We retain your personal data according to the following schedule:
| Data Category | Retention Period |
|---|---|
| Scan data and reports | Identifier-bearing scan and outreach records: active period up to 18 months, then irreversibly anonymised — identifiers stripped and the linking key destroyed. Aggregated anonymised benchmark data, which is non-personal and cannot be linked back to you, is kept indefinitely for product improvement and benchmarking. Subject to erasure upon request while the record is still identifier-bearing. |
| Inbound alias-inbox emails | Transient; deleted after grading (maximum 30 days). |
| Suppression (opt-out) list | Kept indefinitely but minimal, solely to honour objections. |
| Email addresses | Until you unsubscribe from marketing, plus a suppression record to prevent re-subscription. Account-related emails retained for the duration of our business relationship. |
| Contact form submissions | Retained for the duration of the business inquiry, then archived for up to 3 years for legitimate business reference |
| Payment records | Payment and invoice records, including the location evidence described above: ten years from the end of the year of the sale, as required by Bulgarian accounting and tax law. |
| File uploads (screenshots, CSVs) | Retained for the duration of the service engagement, then deleted within 90 days unless otherwise agreed |
| Voice notes and video URLs | Retained for the duration of the service engagement, then deleted within 90 days |
| Google Analytics OAuth data | Accessed only during analysis. Not permanently stored. OAuth tokens revocable at any time. |
| Browser fingerprint hash | Retained for the duration of the A/B test, then deleted or anonymized |
| Server access logs | Retained for up to 90 days for security purposes |
You may request deletion of your personal data at any time (see Section 10). Upon receiving a valid erasure request, we will delete or anonymize your data within 30 days, except where retention is legally required.
10. Your Rights Under GDPR
As a data subject under the General Data Protection Regulation, you have the following rights:
Right of Access (Art. 15)
You have the right to request a copy of all personal data we hold about you, including the purposes of processing, categories of data, recipients, and retention periods.
Right to Rectification (Art. 16)
You have the right to request correction of any inaccurate personal data we hold about you, or to have incomplete data completed.
Right to Erasure (Art. 17)
You have the right to request deletion of your personal data ("right to be forgotten"). We will comply unless retention is required by law (e.g., financial records under Bulgarian accounting regulations).
Right to Restriction of Processing (Art. 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
Right to Data Portability (Art. 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV), and to transmit it to another controller.
Right to Object (Art. 21)
You have the right to object to processing of your personal data based on legitimate interest. Upon objection, we will cease processing unless we demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Art. 7)
Where processing is based on consent (e.g., email marketing, analytics cookies, Google Analytics OAuth), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.
Right to Lodge a Complaint (Art. 77)
You have the right to lodge a complaint with a supervisory authority. As a Bulgarian company, our lead supervisory authority is the Commission for Personal Data Protection (CPDP) of the Republic of Bulgaria. You may also lodge a complaint with the supervisory authority in your EU member state of residence.
How to Exercise Your Rights
To exercise any of these rights, please email us at [email protected] — the monitored channel for data-subject requests and for objections to direct marketing — or at [email protected] with the subject line "GDPR Data Subject Request". We will verify your identity and respond within 30 days as required by GDPR. In our current version (V1), erasure and access requests are handled manually by our team. We are committed to processing every request within the statutory timeframe.
Bulgarian Supervisory Authority
Commission for Personal Data Protection (CPDP)
Комисия за защита на личните данни
Website: www.cpdp.bg
11. Email Marketing and Communications
11.1 Subscription
When you provide your email address through FlowScan (via the email gate, checkout, or intake forms) or through our contact form, you may be subscribed to relevant email marketing lists. These may include:
- Scan report delivery and follow-up sequences
- Educational content about funnel optimization and CRO
- Product updates and feature announcements
- Promotional offers for paid services
11.2 Unsubscribe
Every marketing email we send includes a one-click unsubscribe link. You can unsubscribe at any time with a single click. Unsubscribe requests are processed immediately. We also maintain a re-consent mechanism for users who wish to manage their subscription preferences.
11.3 Bounce and Complaint Handling
We use Resend for email delivery, which provides automated bounce and complaint feedback. If you mark one of our emails as spam or if your email provider reports a complaint, you will be automatically unsubscribed from all marketing communications. We maintain bounce and complaint suppression lists to ensure we do not send further emails to addresses that have bounced or filed complaints.
11.4 Transactional Emails
Certain emails are transactional in nature (scan reports, email verification, payment receipts, service notifications) and are not subject to marketing unsubscribe, as they are necessary for service delivery.
12. Data Sharing and Disclosure
We do not sell your personal data. Ever.
We do not sell, rent, lease, or trade your personal data to any third party for their marketing or commercial purposes. This is an absolute commitment.
We may share your personal data only in the following circumstances:
- Service providers — with the third-party providers listed in Section 7, solely for the purposes described, under data processing agreements
- Legal obligations — when required by applicable law, a court order, or a binding request from a competent authority (e.g., law enforcement within the EU)
- Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to this Privacy Policy.
- Protection of rights — to protect the rights, property, or safety of ConvertScale, our users, or the public, as required or permitted by law
13. AI Processing
FlowScan scans your funnel with automated rules and uses an AI model (Azure OpenAI Service) to judge a few checks and help write the diagnostic report. Here is how we handle data in relation to AI processing:
- We use Azure OpenAI Service (Microsoft) for AI analysis
- Data sent to Azure OpenAI includes publicly accessible website content from the URL you submitted, along with intake question responses
- Per our enterprise agreement with Microsoft, your data is not stored by Azure OpenAI after processing is complete
- Your data is not used to train or improve any Microsoft or OpenAI foundation models
- Your data is not accessible to other Azure OpenAI customers
- AI-generated reports are stored in our database (in France, EU) and are associated with your scan record
Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our AI analysis produces informational recommendations only and does not make automated decisions that have legal effects on you. If you have concerns about our AI processing, please contact us at [email protected].
14. Children's Privacy
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe we have inadvertently collected data from a minor, please contact us at [email protected].
15. Publicly Accessible Website Data
Two scan modes. Mode A — you submit a URL (Art. 13). Mode B — we scan a publicly advertised page we discovered ourselves via public ad libraries (Art. 14). In both modes we may submit the page's public, login-free lead form using a generated alias email on a domain we own plus fictional, non-real placeholder data, then monitor that alias inbox to grade the follow-up sequence. We never create accounts, never log in, never bypass logins or paywalls, and never submit payment or checkout forms. The source of Mode-B data (Art. 14(2)(f)) is publicly accessible advertiser pages and public ad libraries operated by ad platforms. Public accessibility of data does not make it unregulated.
In either mode, FlowScan accesses and analyzes only publicly available data on that website. This includes:
- HTML source code and rendered DOM
- CSS stylesheets and visual layout
- JavaScript behavior (client-side rendering, redirects, tracking scripts)
- Page load performance metrics
- HTTP headers and response codes
- Public meta tags, Open Graph data, and structured data
- Publicly visible images and assets
We do not access any password-protected areas, private databases, or data behind authentication walls. If the website you submit belongs to a third party, you represent that you have authorization to submit it for analysis, or that the analysis of publicly available data is within your legitimate interest.
16. Google Analytics OAuth Integration
For users who opt in to deeper funnel analysis, FlowScan may request access to your Google Analytics data via OAuth 2.0. This integration is entirely optional and requires your explicit consent.
- We request only the minimum read-only scopes necessary for funnel analysis
- We do not modify, delete, or write any data to your Google Analytics account
- Access tokens are stored securely and used only for the duration of the analysis
- You can revoke access at any time through your Google Account permissions page
- Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements
17. Do Not Track Signals
We respect Do Not Track (DNT) browser signals: when we detect a DNT signal, we never start analytics on our own initiative, including the cookieless Google Analytics 4 measurement described in section 6.3. Optional analytics (Google Analytics 4) then loads only if you choose Accept in our cookie banner, an explicit choice we treat as taking precedence over the browser signal; you can withdraw it at any time through the "Cookie settings" link in the footer. Essential cookies and security-related Cloudflare cookies will still function as they are necessary for service operation.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. When we make material changes:
- We will update the "Last updated" date at the top of this page
- For significant changes, we will provide notice via email to registered users or a prominent notice on our websites
- Where required by law, we will obtain your consent to material changes before they take effect
We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes acceptance of the updated policy.
19. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:
General inquiries: [email protected]
Privacy and data protection: [email protected]
Конвърт Скейл ООД (ConvertScale)
Bulgaria, European Union
We aim to respond to all privacy-related inquiries within 1–2 business days, and to all formal GDPR data subject requests within the statutory 30-day period.