Privacy Policy

1. Information We Collect

We collect the following categories of information:

Account Information

When you create an account, we collect your name, email address, organization name, job title, and billing information. If you sign up through a third-party authentication provider, we may receive profile information from that provider.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, device type, browser type, IP address, and referring URLs.

Customer Data

You may submit data to the Service for processing by our AI agents. This Customer Data is processed solely to provide the Service and is governed by the data processing terms in your subscription agreement.

Communications

When you contact us for support or provide feedback, we collect the content of those communications along with associated metadata such as timestamps and contact information.

2. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Service;
• Process transactions and send related information, including confirmations and invoices;
• Respond to your requests, comments, and questions and provide customer support;
• Send technical notices, updates, security alerts, and administrative messages;
• Monitor and analyze trends, usage, and activity to improve the user experience;
• Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity;
• Comply with legal obligations and enforce our Terms of Service;
• Develop new products, features, and functionality.

We do not use Customer Data to train general-purpose AI models. Customer Data is processed only to deliver the specific agent workflows you configure within the Service.

3. Data Sharing

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: We engage trusted third-party companies to perform services on our behalf, such as cloud hosting, payment processing, analytics, and customer support. These providers are contractually obligated to protect your data and use it only for the purposes we specify.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change and any choices you may have regarding your information.
• With Your Consent: We may share information with third parties when you have given us explicit consent to do so.

4. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access controls and least-privilege principles;
• Regular penetration testing and vulnerability assessments;
• SOC 2 Type II audited infrastructure;
• Continuous monitoring and automated threat detection;
• Incident response procedures with defined notification timelines.

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining safeguards consistent with industry best practices.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you terminate your account, we will delete or anonymize your personal information within ninety (90) days, unless retention is required by law or necessary for legitimate business purposes such as resolving disputes or enforcing our agreements.

Customer Data is retained in accordance with the terms of your subscription agreement. You may request export of your Customer Data at any time through the Service or by contacting us.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Under the GDPR (EEA Residents)

• Right of access to your personal data;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure (“right to be forgotten”);
• Right to restrict processing;
• Right to data portability;
• Right to object to processing based on legitimate interests;
• Right to withdraw consent at any time.

Under the CCPA (California Residents)

• Right to know what personal information is collected, used, and shared;
• Right to delete personal information;
• Right to opt out of the sale of personal information (we do not sell personal information);
• Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@conviction.com. We will respond to verified requests within the timeframes required by applicable law.

7. Cookies

We use cookies and similar tracking technologies to operate and improve the Service. Categories of cookies we use include:

• Essential Cookies: Required for the Service to function, including authentication and security cookies.
• Analytics Cookies: Help us understand how users interact with the Service so we can improve the experience.
• Preference Cookies: Remember your settings and preferences across sessions.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

8. Third-Party Services

The Service may contain links to or integrations with third-party websites, applications, and services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information. Third-party services we may use include cloud infrastructure providers, payment processors, analytics platforms, and authentication providers.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe that a child has provided us with personal information, please contact us at privacy@conviction.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Service at least thirty (30) days before the changes take effect. Your continued use of the Service after the effective date of any revised policy constitutes your acceptance of the changes.

We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices.