Privacy Policy
How Converise processes personal data on this website and in the Converise application.
1. Who we are
The controller of your personal data is Converise sp. z o.o. with its registered office at ul. Gajowa 13D, Ignatki, 16-001 Kleosin, Poland, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court in Białystok, XII Commercial Division of the National Court Register, under KRS number 0001265873, NIP 9662226736, REGON 545696703, share capital PLN 5,000.00 (“Converise”, “we”). Contact: support@converise.io. This policy covers the Converise website (the “Website”) and the Converise application (the “Application”).
2. When we are not the controller — workspace content and warehouse data
Where our customer's team uses the Application, the content saved in the customer's workspace (experiment records, hypotheses, comments and similar) and any personal data contained in the customer's own data warehouse connected to the Application are processed by Converise on behalf of that customer as a processor, under the Data Processing Agreement available at /dpa. For those data, the customer is the controller and requests concerning them should be addressed to the customer.
Two facts worth knowing even so: warehouse queries are executed inside the customer's warehouse, where the aggregation runs, so Converise ingests and stores only aggregated results and never ingests or stores end-user identifiers; and the Application contains no analytics or tracking of any kind.
One deliberate exception exists at set-up. When an administrator connects a data source, the Application shows that administrator up to ten sample rows from it, so that the column mapping can be checked against real data. Those rows pass through our servers without being stored, and are never written to logs or included in error reports. Before the sample leaves the server, the assignment-unit column and columns named like identifiers are masked to their shape only, and columns named after other personal data — together with any value shaped like an e-mail address, telephone number or IP address, whatever the column is called — are removed entirely.
3. What we process, why, and on what legal basis
Account and authentication — e-mail address, password hash or Google/Microsoft sign-in identity, account identifier; identity data are stored exclusively in our authentication platform, while the product database stores only pseudonymous identifiers. Account e-mails — confirming your address, resetting your password, and workspace invitations — are delivered by our transactional e-mail provider, which receives your address for that purpose only. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Providing the Application (workspaces, collaboration, notifications) — account identifier references, content you enter, in-app notifications. Legal basis: performance of a contract (Art. 6(1)(b)).
Alert e-mails — recipient e-mail addresses (resolved at send time; additional recipients entered by the workspace are stored) and alert content. Legal basis: performance of a contract; legitimate interest for additional recipients (Art. 6(1)(b), (f)).
Support and feedback — your e-mail address and message content (support mailbox); anything you submit through the feedback form (Google Forms). Legal basis: legitimate interest — responding to enquiries (Art. 6(1)(f)).
Demo requests (Website only) — the name, work e-mail address, company, role, approximate experiment volume and optional message you enter in the guided-demo form on /demo. The request is delivered to our team's mailbox by our transactional e-mail provider and is not stored in any of our databases; we use it only to arrange and hold the demo and follow up on it. Legal basis: steps taken at your request before entering into a contract, and legitimate interest in answering your enquiry (Art. 6(1)(b), (f)).
AI exploration of experiment memory (Application) — when you ask a question on a workspace's Memory page, the question and the texts of that workspace's experiment records and imported notes (hypotheses, KPI names, recommendations, recorded decisions and learnings — never raw evidence, never account identifiers) are sent to a language model and an embedding model that we run ourselves on rented compute in the EEA; no third-party model provider receives them. Answers are shown to you and not stored; we keep only an operational record of each call (a hash of the question, counts and timings). A workspace admin can switch the feature off for the workspace. Legal basis: performance of a contract (Art. 6(1)(b)).
Error monitoring — server exception messages and stack traces (EU-region monitoring; request headers, cookies and IPs are not captured). Legal basis: legitimate interest — keeping the service working (Art. 6(1)(f)).
Hosting, delivery and login records (Website and Application) — every request to our website and application reaches a hosting provider, which writes it to its own operational logs: your IP address, the user agent your browser reports, and request metadata such as the time, the path, the response status and the region that served you. Our authentication platform likewise records sign-in and account events together with the IP address they came from. We do not build profiles from these records, do not join them to website analytics, and no code of ours reads or stores an IP address or a user agent — these are the providers' logs, kept so that the service can be delivered, failures diagnosed and abuse detected. Legal basis: legitimate interest (Art. 6(1)(f)); for sign-in records also security of processing (Art. 6(1)(c); Art. 32) and, in the Application, performance of a contract (Art. 6(1)(b)).
Security and accountability — an append-only audit trail of account and workspace actions (identifiers, event types, and the name of the object acted on, such as an experiment, KPI, business area or workspace; never the content written into those records), a register of warehouse queries (metadata and volumes) and a register of AI model calls (hashes, counts and timings — never the question or the answer). After 24 months only a minimised copy without names remains, as set out in section 7. Legal basis: legitimate interest and legal obligations regarding security of processing (Art. 6(1)(f), (c); Art. 32).
Backups and disaster recovery — encrypted full-database copies, including authentication data. Legal basis: legitimate interest and security of processing (Art. 6(1)(f); Art. 32).
Website analytics (Website only) — Google Analytics 4: pages viewed and how visitors move through the site, approximate location derived from a truncated IP address, device and browser type, and a pseudonymous analytics identifier kept in a cookie. Legal basis: consent (Art. 6(1)(a)), given and withdrawable at any time in the cookie banner.
Advertising — conversion measurement and remarketing (Website only) — Google Ads: whether a visit followed one of our ads and whether it ended in a sign-up, and inclusion in remarketing audiences so that Converise ads can be shown to you elsewhere. This involves profiling for marketing purposes. Legal basis: consent (Art. 6(1)(a)), given and withdrawable at any time in the cookie banner.
Google Signals (Website only) — if you accept the marketing category and are signed in to a Google account that has Ads Personalization switched on, Google may link your visits across the devices you use and add estimated age, gender and interest categories to our reports. We see the result only as aggregated statistics, never as individual profiles, and Google withholds figures drawn from small groups. Accepting analytics alone does not switch this on. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time in the cookie banner.
Analytics and advertising technologies operate only on the Website. The Application is deliberately free of analytics SDKs, tracking cookies and advertising technologies. Nothing beyond strictly necessary storage runs on the Website before you consent.
4. Cookies
Cookies and similar technologies are described in the Cookie Policy available at /cookies, including the categories used, their lifetimes, and how to give, refuse and withdraw consent in the cookie banner. Non-essential cookies are used only with your consent. The Cookie Policy also explains how the Application keeps your session without cookies.
5. Recipients of data
We use the following categories of processors and providers: authentication and database hosting (Supabase — data at rest in the EEA, Ireland), application hosting and serverless compute (Vercel — compute in the EEA, Dublin; global edge network), key management and encrypted backup storage (Google Cloud — EEA, Belgium), transactional e-mail (Resend — US), error monitoring (Sentry — EEA data residency, Frankfurt), AI model hosting for the memory assistant (RunPod — GPU and CPU compute in EEA data centres, running models we deploy ourselves), and — with your consent, on the Website only — Google Analytics and Google Ads. For advertising signals, Google also acts as an independent controller as described in Google's own privacy documentation. The current list of sub-processors relevant to customer data is published in the Data Processing Agreement at /dpa; the website analytics and advertising services are not on that list, because they process visitors' data for which Converise is the controller, never customer workspace data.
6. International transfers
Our data plane — databases, application compute and backups — is located in the EEA. Requests first reach the hosting provider's global edge network, which terminates the connection at the point of presence nearest the visitor. Where a provider is a US company, transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses: Vercel (DPF + SCCs), Supabase (SCCs with UK addendum), Google (DPF + SCCs), Resend (DPF + SCCs), Sentry (DPF; EU data residency in use), RunPod (SCCs; EEA compute in use). Copies of the relevant safeguards can be requested at the contact address above.
7. How long we keep data
Retention runs from the last event that keeps the record alive — the life of the account or workspace, the date of the entry, or the date of your last activity, as stated per row.
| Data | Retention |
|---|---|
| Account data | Life of the account. Deletion of the account is immediate and permanent. |
| Pending identity-deletion record | Only the authentication user id, kept until the sign-in identity has been removed from our authentication provider (retried daily); nothing else survives the account purge. |
| Workspace content | Life of the workspace. Deletion of a workspace is immediate and permanent. |
| In-app notifications | 90 days. |
| Audit trail, query register and AI call register | 24 months in full, then only a minimised archive — identifiers and event types, with the object names dropped — kept for security analytics. |
| Backups | Daily copies 35 days, weekly copies 180 days. Data deleted from live systems persist inside encrypted backups until those copies expire; backups are not restored except for disaster recovery, and re-deletion is part of the restoration procedure. |
| Hosting and delivery logs | 1 day — the retention our hosting plan provides. We do not export these logs into any other system. |
| Sign-in and authentication logs | 7 days — the retention our authentication plan provides. Any sign-in records the platform keeps inside the database it manages for us fall under the account and backup rows above. |
| Support correspondence | As long as needed to handle the matter, then up to the limitation period of possible claims. |
| Demo requests | Up to 12 months after our last contact about the request, then deleted from the mailbox — unless it has become a customer relationship, in which case the account rows apply. |
| Google Analytics data | 14 months from a user's or device's last activity — the retention we configure in the property. Aggregated reports may be kept longer. Cookie lifetimes are in the Cookie Policy. |
| Advertising cookies and remarketing audiences | The lifetimes in the Cookie Policy table, currently about 90 days for the conversion cookie. Audience membership ends when its duration expires or when you withdraw consent. |
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interest, as well as the right to withdraw any consent at any time — for cookies, directly in the cookie banner through “Cookie settings” in the footer — without affecting the lawfulness of processing before withdrawal. In practice: you can view and edit your data in the Application; a workspace owner can export the entire workspace as a JSON file at any time; deleting your account removes your data immediately. Your sign-in identity is removed from our authentication provider in the same step; if that removal fails, it is retried automatically every day until it succeeds, and each failure is recorded. To exercise any right, you can also write to support@converise.io. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
We do not make automated decisions producing legal or similarly significant effects concerning you. The Application refreshes experiment evidence automatically on schedules configured by the customer — this processes workspace and warehouse data as described in section 2, without profiling of individuals. Remarketing on the Website does involve marketing profiling based on cookies, and it operates only with your consent, which you can withdraw at any time.
9. Security
We apply technical and organisational measures appropriate to the risk, including: encryption in transit and at rest, envelope encryption of warehouse credentials with keys held in a cloud KMS, per-workspace access control verified by automated tests, deny-all database policies for non-application access, an append-only audit trail, encrypted off-site backups with restore testing, multi-factor authentication on all operator accounts, and a documented incident response procedure.
10. Children
The Website and the Application are not directed at children under 16 and we do not knowingly process their data.
11. Changes
We will announce changes to this policy on the Website and — for registered users — by e-mail. The current version applies from 23 September 2026.