This page tells you what Convinci collects, where it lives, and what your rights are. We wrote it in plain words on purpose. If something is unclear, email us and we will fix the page, not just answer your question.
Who we are
Convinci is run by 2612579 Ontario Inc, 10 Yonge Street, Toronto, Ontario M5E 1R4. Our privacy officer is Omar Shahban. You can reach us at hello@convinci.io.
What we collect
- Your account. When you sign in with Google, we get your name, your email address and your profile picture URL from them. When you sign in with Facebook, we get your name, your email address and your Facebook account id, and nothing else (no friends, posts or pages). If you sign in with an email link instead, we just get your email address. See User Data Deletion to have it removed.
- Your storefront's public information. When you connect a store, we read the public storefront: your products, prices, photos, and reviews shown by widgets like Okendo or Yotpo. This is the same information any shopper can see.
- The ads we make you. We keep the branded images and clips we generate from your product photos, so you can preview, download and reuse them.
- Billing information. Stripe handles your card. We keep your Stripe customer id and subscription id, not your card number.
- Basic technical data. We keep your IP address for a short time to stop abuse, and simple facts like which pages you open, through our analytics and ad measurement tools, as the Cookies section below explains. We also work out your approximate city and region from that IP address, on our own server, using a local lookup file we keep. No third party ever sees your IP address for this. We also use your cookie, or your IP address and browser type when there is no cookie, to recognize when you come back to our site, and when you open a link we emailed you we connect your later visits to that email so we can follow up at the right time.
What we do NOT collect
- No passwords. You sign in with Google, Facebook or an email link. We never ask you to make up a password, so we never store one.
- No card numbers. Your card goes straight to Stripe. We never see or store the full number.
- No access to your customers or orders. We do not use the Shopify Admin API. We never see your customer list, your orders, or anyone's personal information but yours.
- No Google login tokens. We use the token once, at sign-in, to read your name and email. We do not keep it, and we cannot use it to act as you anywhere else.
Where it lives
Everything: our server, our database, and our backups, live on one computer we rent from Hetzner in Falkenstein, Germany, inside the European Union.
Who helps us
We use a small number of outside companies to run Convinci. Here is what each one gets.
| Who | What they get |
|---|---|
| A cloud hosting provider (servers in the EU) | Everything we store, on their servers |
| A payment processor (we never see your full card number) | Your billing details and payment |
| An email delivery service | Your email address, to send your sign-in link and account emails |
| Sign-in providers you choose (Google, Meta) | Name and email when you use their sign-in button |
| Analytics and ad measurement (see Cookies below) | Page visits and actions on our site, your IP address and browser type, and for sign ups and payments your email, name, and billing city, state, postal code and country in scrambled (hashed) form |
| A bot check on the store tester | Your IP address |
Some of these providers store or process data outside Canada, including in the European Union and the United States. We do not sell your personal information to third parties. A current list of our service providers is available on request at hello@convinci.io.
Cookies
We use analytics and advertising cookies to see how people use the site and to measure our ads. How we ask depends on where you are:
- United States and Canada: these cookies are on by default. Our cookie notice has an Opt out button, and you can opt out at any time with the button below.
- Everywhere else, including the EU and the UK: we ask first. Nothing loads until you press OK. If you press No thanks, or never press OK, they are never loaded.
We tell the two apart by your device's time zone, not by tracking your location. If your browser sends Global Privacy Control, we treat it as an opt out and do not ask. We keep your choice in a cookie for 12 months. When these cookies are on and you came here from an ad or a link with ad tags in it, we keep those tags and the ad click id in a cookie for 90 days and save them with your account when you sign up, so we can tell which ads bring people here.
When you create an account or pay for a plan, we tell our ad partner that it happened, with your email and billing details in scrambled (hashed) form, so we can measure which ads work. This is part of running your account and happens whether or not you answered the cookie notice, but never if you opted out or your browser sends Global Privacy Control.
We record page visits and actions on our own server to improve the product, with a random session cookie and no IP address. We skip the cookie if you press No thanks or send Global Privacy Control.
How long we keep it
- Backups: kept on the same server for 72 hours. We do not currently keep a copy off that server.
- Server logs: kept for 30 days.
- IP addresses used for rate limits: kept for 7 days.
- Preview cache: kept for 30 days.
- Temporary card images: kept for 24 hours.
- Your feed and card files: deleted 7 days after your plan lapses.
Your rights
You can ask to see, fix, delete, export, or object to how we use your personal data. Use "Delete my account" on your account page, or email hello@convinci.io from the address on your account.
If you live in the EU or UK, here is the legal basis for each thing we do:
| What we do | Why it is allowed |
|---|---|
| Running the service you asked for | Contract, because you asked us to |
| Google Analytics and the Meta Pixel | Your consent, which you can take back any time |
| Security logs and rate limits | Our legitimate interest in keeping the service working and safe |
You can also complain to your own country's data regulator. In Canada, that is the Office of the Privacy Commissioner.
Kids
Convinci is built for people 18 and older. It is not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18, and if we learn that we have, we delete it.
Changes
If we make a big change to this policy, we will email you before it takes effect. Small changes will just update the date at the top of this page.
Governing law
This policy is governed by the laws of Ontario and the federal laws of Canada that apply in it. You agree to the exclusive jurisdiction of the courts of Ontario.
Contact
Questions about this policy: hello@convinci.io.