Privacy policy

Last updated October 13, 2026.

Summary

• If you run the free CRO audit, our audit app receives your email address, the website you entered and the page you came from. It runs the audit on that website, and we use your email address to send your audit and a few follow-up emails about your results. Every email has an unsubscribe link.
• To stop abuse of the audit, Cloudflare Turnstile checks that you are a person, and the audit app counts audits per IP address and per email address using one-way hashes, never the addresses themselves.
• Our hosting provider keeps standard server logs.
• We use Google Analytics, Clicky and PostHog to see how the site is used. They run for every visitor unless you switch analytics cookies off, which you can do at any time with Cookie settings at the bottom of every page.
• If you switch them off, PostHog still counts visits and clicks without cookies and without storing anything on your device (see Analytics).
• We advertise on Reddit. If you arrive from one of our Reddit ads, which are shown in the United States only, Reddit's measurement pixel loads straight away, on this site and in the audit app, so we can see which ads lead to audits and purchases. For everyone else it loads only if you choose Accept in Cookie settings. If you reject, it does not load (see The Reddit pixel).
• The only advertising cookies the site sets are the Reddit pixel's, and analytics cookies unless you switch them off. A light or dark theme choice and your cookie choice are saved in your own browser and never sent to us.
• We do not sell your personal data. The only advertising use is the Reddit pixel, where your email address and the website you entered are never sent.

Who is responsible for your data

The controller of your personal data is Convertica OÜ, a company registered in Tallinn, Estonia.

• Registered address: Sepapaja 6, 15551 Tallinn, Estonia
• Email for privacy questions and requests: admin@convertica.org

In this policy, "Convertica", "we" and "us" mean Convertica OÜ. "The site" means convertica.org.

What personal data we collect and why

The table below lists everything the site collects, why, the lawful basis under the EU General Data Protection Regulation (GDPR), and how long it is kept. Each item is explained after the table.

The free CRO audit

The free CRO audit is an app at audit.convertica.org. When you enter your website and email address in the audit form on this site, your browser sends them straight to the audit app, together with the page of this site you were on, your cookie choice and, if a campaign link brought you to the site, that link's campaign tags (for example utm_source and the click ID Reddit adds to its ad links). The campaign tags are stored with the audit record, added to the anonymous events the audit app sends to PostHog and, if you buy the full report, passed to our payment provider with the payment, so we can see which campaign an audit or a purchase came from. The audit app then:

• checks that you are a person with Cloudflare Turnstile (see Abuse protection)
• checks that your email address can receive email: it looks up your email domain's mail server and refuses known temporary inboxes
• loads the website you entered, takes screenshots of it, measures it and shows you the audit while it runs
• emails you your audit, followed by a few follow-up emails about your results

We do not add you to a newsletter or send you other marketing emails unless you separately agree to that.

Every email we send you about your audit includes an unsubscribe link. If you unsubscribe, we send you no more follow-up emails. We keep your email address and website until 12 months after we send your audit, or until you ask us to delete them, whichever comes first. The audit app also keeps a one-way hash of your email address, never the address itself, so that a second audit with the same address does not start the follow-up emails again.

Giving us your email address is voluntary, but without it we cannot run or send your audit. The form also contains a hidden field that people do not see. If that field is filled in, the request is treated as automated and nothing is started or stored.

The audit app runs on servers of Railway, our hosting provider for it, in Railway's EU West region in Amsterdam, the Netherlands. While your audit runs, your email address is held only in the app's memory. It is written to the app's storage only if your audit's AI review has to wait in a queue (it is removed once the email with your review has been sent) or if we ask you to confirm your email address at a very busy time (that request is deleted after 2 days). Your report and the screenshots of your page are stored by the app so that your report link keeps working. Anyone with the link can open the report, so share it only with people you choose.

To write the audit, the app sends the address of the page you entered, never your email address, to Google PageSpeed Insights to measure its speed, and the page's text and screenshots to an AI model provider for the written review.

When your audit is ready, your email address, the website and your audit's results are added to our contact list at Resend, the email service that sends your audit and the follow-up emails. We use Resend only to deliver your audit and the follow-up emails.

You can withdraw your consent at any time with the unsubscribe link in any of our emails, or by emailing admin@convertica.org to have your data deleted. If you email us, we will then delete it. Withdrawing consent does not affect anything we did with your data before you withdrew it.

Abuse protection

The free audit costs us money to run, so the audit app limits how many audits can be started. It counts audits per connection and per email address over 24 hours with one-way hashes: your IP address and email address are combined with a random secret key kept in the app's private storage, so neither address is written down for this, and the stored values cannot be matched back to an address without that key. Because we hold the key, we still treat the values as personal data. The counts are deleted automatically after 2 days.

Before an audit starts, Cloudflare Turnstile checks that you are a person. Its script loads from Cloudflare only when you start filling in the audit form, and it looks at technical details of your browser and connection, including your IP address. The audit app sends the check's result and your IP address to Cloudflare to confirm it. We do not store this data.

Server logs

Like almost every website, the servers that host convertica.org record basic technical details of each request: your IP address, the date and time, the page requested, the page you came from and your browser and device type. These logs are kept by our hosting provider and are used to deliver the site, keep it secure and investigate faults.

Emails you send us

If you email us, we receive your email address, your name if you include it and whatever you write. We use it to reply and keep it as long as we need it for that conversation. Our email is provided by Google Workspace (Google), which processes messages for us under its data processing terms.

Rebuild clients

If you buy a one page rebuild or a full site rebuild, we use the personal data involved in that work, such as contact details and any access you give us to your site, to do that work.

Analytics

convertica.org uses Google Analytics 4, a service provided by Google, Clicky, a web analytics service provided by Roxr Software Ltd, and PostHog, a product analytics service provided by PostHog, Inc., to understand which pages and buttons are used. They run for every visitor unless you switch analytics cookies off; PostHog's cookieless measurement, described below, then still counts your visit. It is set up like this:

• On unless you switch it off. The analytics tools load on every page without asking first. Cookie settings at the bottom of every page opens a panel with an Accept button and a Reject button of the same size and style. The site works the same whichever you choose.
• PostHog without cookies if you reject. PostHog then stores nothing on your device: no cookies, no local storage. To tell one visit from another for a day, PostHog's servers compute a one-way hash from your IP address, your browser's user agent and a secret that changes every day; according to PostHog, the IP address and user agent are used only to compute that hash and are then discarded. There are no session recordings and no heatmaps in this mode.
• Clicky stops if you reject. The site stops Clicky, deletes its cookies and does not load it again.
• Google Analytics stops if you reject. The site switches Google Analytics off, deletes its cookies and does not load Google's tag again.
• No Google advertising features. In Google's tag, advertising storage, advertising user data and ad personalization are always off. Reddit's advertising pixel is separate: see The Reddit pixel.
• You can change your mind. Use Cookie settings at the bottom of any page to see your choice and change it. If you reject, analytics stops on the site (PostHog returns to cookieless measurement) and the site deletes the Google Analytics, Clicky and PostHog cookies and PostHog's local storage it can reach in your browser.
• Your choice is remembered in your browser (see Cookies and local storage). A Reject stays until you change it or clear your browser's site data.

Unless you have switched analytics cookies off, Google Analytics records how the site is used: the pages viewed, your browser and device, an approximate location derived from your IP address, and the standard events Google Analytics measures, such as scrolling and links clicked. The site also sends two events of its own: clicks on the main buttons (the button's name and the page it was on) and free audit form submissions passed to the audit app (the page only, never your email address or website).

Unless you have switched analytics cookies off, Clicky records how the site is used: the pages viewed and their titles, the page you came from and any campaign tags in the link, your browser, device, screen size, language and time zone, your IP address, which Clicky uses to estimate your location, links to other sites and downloads you click, and how long your visit lasts. Clicky stores this data in the United States.

Unless you have switched analytics cookies off, PostHog records how the site is used: the pages viewed and the page you came from, the buttons and links you click, how far you scroll, how long pages take to load, your browser, device, screen size and language, and, where PostHog can estimate it, an approximate location. We have set PostHog to discard IP addresses, so your IP address is not stored with this data. PostHog also makes session recordings: a replay of the pages you visit, your mouse movements, scrolling and clicks, so we can see where pages are confusing. Everything you type into a form is hidden in the recording, and the email and website fields of the audit form are blocked from it entirely. PostHog also builds click heatmaps from the same data.

The site sends PostHog a few events of its own: clicks on the main buttons (the button's name and the page), use of the calculators (which calculator and the page), clicks on Trustpilot and email links, and when the free CRO audit form is sent, succeeds or fails (the page, a short reason and any campaign tags from the link that brought you to the site, never your email address or website). The free CRO audit app's server also sends PostHog anonymous events about each audit, such as that it started, finished or failed, its scores and whether the report was opened, never your email address or IP address. Unless you switched analytics cookies off on this site, the form passes your anonymous PostHog ID to the audit app so those events are linked to it; otherwise each audit gets its own random ID. PostHog never receives your name or email address from us, and we do not create PostHog profiles for visitors.

PostHog stores this data on its EU Cloud, in data centers in Frankfurt, Germany.

The Reddit pixel

We advertise on Reddit, and convertica.org and the free CRO audit app at audit.convertica.org use the Reddit pixel, a measurement script provided by Reddit, Inc., to see which of our ads lead to audits and purchases. When it loads depends on how you arrived:

• If you arrive from one of our Reddit ads. Our ads are shown in the United States only, and their links are tagged utm_source=reddit. On a visit that starts from such a link, the pixel loads straight away, without waiting for a cookie choice, and stays on for the rest of that visit, including in the audit app if you start an audit. To do that, the site keeps the link's campaign tags in your browser's session storage until you close the tab.
• Everyone else. The pixel loads only after you choose Accept in Cookie settings. Before that, and if you never choose, nothing is sent to Reddit.
• If you reject. The pixel does not load, whichever way you arrived, and it stays off in the audit app. The site deletes the pixel's cookies and the stored campaign tags. If the pixel had already loaded on the page where you reject, it sends nothing further from this site.

When the pixel is on, Reddit receives the address of each page you view on this site and in the audit app, the page you came from, your screen size, your IP address and browser details, a random ID the pixel keeps in a cookie and, if you came from an ad, the click ID from the ad link. The audit app also tells Reddit when an audit is started and when a full report is bought, with the price and currency and a random reference for that event, so the same event is not counted twice. It sends those two events both through the pixel in your browser and directly from its server, so they still arrive if your browser blocks the pixel. The server's copy carries only the pixel's cookie ID and the ad's click ID, which the audit app keeps with the audit record for this purpose, and never your email address or IP address. We do not send Reddit your email address, your name, the website you entered or your audit results, and we have switched off the pixel's feature that looks for email addresses and phone numbers on the page.

Reddit uses this data to report on our ads and, under its own terms and privacy policy, for its advertising services. You can read how Reddit handles data, and control ad personalization if you have a Reddit account, in Reddit's privacy policy.

Cookies and local storage

The only advertising cookies convertica.org sets are the Reddit pixel's (see The Reddit pixel), and it sets analytics cookies unless you switch them off. It loads no chat widgets, video embeds, social media buttons or third-party scripts, apart from Cloudflare Turnstile once you start filling in the audit form, the Reddit pixel as described above, and Google Analytics, Clicky and PostHog, which run unless you switch analytics cookies off. Our fonts are stored on our own server, so loading a page does not contact a font service.

• Theme preference. If you choose the dark theme with the switch in the footer, your browser stores that choice in local storage under the name cv-theme. It stays on your device, is never sent to us, and is removed when you switch back to light or clear your browser's site data. Because it only remembers a choice you made, it does not need consent.
• Cookie choice. When you accept or reject analytics cookies in Cookie settings, your browser stores your answer and the date in local storage under the name cv-consent. It stays on your device, apart from being sent to the audit app with the audit form (see The free CRO audit), and is replaced when you change your choice. It is needed to respect your choice, so it does not need consent.
• Analytics cookies. Set unless you switch analytics cookies off (see Analytics). Google Analytics uses cookies named _ga and _ga_ followed by an ID, which by default expire after 2 years. Clicky uses a cookie named _jsuid, a random visitor ID that can last up to a year, and short-lived cookies such as _first_pageview, _referrer_og and _utm_og that remember the first page, the referring site and campaign tags of a visit. Clicky's own servers may also set cookies on its domain, which the site cannot read or delete; your browser's settings can. PostHog uses a cookie and a local storage entry named ph_ followed by our project key and _posthog, which hold a random visitor ID and last up to a year; short-lived session storage entries starting ph_ for the current visit; and a local storage entry starting __ph_opt_in_out_ that records that PostHog's cookies are on. If you reject analytics, the site deletes the analytics cookies on this site's domain and stops Clicky for the rest of the visit.
• Reddit pixel cookies. Only when the pixel is on (see The Reddit pixel). The pixel sets a cookie named _rdt_uuid, a random ID, and, if you came from a Reddit ad, one named _rdt_cid holding the ad's click ID. Both last 90 days and are set for convertica.org and its subdomains, so the audit app can read them too. The pixel also uses your browser's session storage during a visit. For a visit from a Reddit ad, or after you accept cookies, the site keeps the campaign tags of the link that brought you here in session storage under the name cv-campaign, for that tab only. In the audit app, a local storage entry starting cv-rdt: records that an event was sent, so it is not sent twice. If you reject cookies, the site deletes the _rdt_ cookies and the stored campaign tags.
• Security cookie. Cloudflare, which sits in front of the site, may set a strictly necessary cookie (for example __cf_bm) to tell people from automated traffic. It does not track you across sites and does not need consent.

Links to other sites, such as Trustpilot, LinkedIn, Facebook and Google Maps, are plain links. Nothing from those sites loads until you click, and their own privacy policies apply once you do.

Who we share your data with

We share personal data only with service providers who process it for us under a data processing agreement, and only for the purposes above:

• Hosting and network: Cloudflare, which hosts the site, keeps the server logs, runs the Turnstile check on the audit form, and processes IP addresses to deliver pages quickly and block attacks.
• Audit app hosting: Railway, which runs the free CRO audit app and stores its records, reports and screenshots in its EU West region (Amsterdam, the Netherlands).
• Email delivery: Resend, which keeps our list of audit contacts and sends the audits and follow-up emails (see above).
• Email inbox: Google Workspace.
• Analytics: Google, Roxr Software Ltd (Clicky) and PostHog, Inc. (PostHog), unless you switch analytics cookies off (PostHog's cookieless measurement then still counts the visit).

Advertising measurement: when the Reddit pixel is on (see The Reddit pixel), the data described there goes to Reddit, Inc., under Reddit's terms for advertisers.

We may also disclose personal data where the law requires it, for example to a court or a public authority, or to protect our legal rights. We do not sell or rent personal data, and the Reddit pixel is the only advertising use of it.

Convertica's team works remotely, so the people who handle audits and emails may access them from outside the European Union, under the same security measures.

International transfers

Convertica is established in Estonia, in the European Union. Where a service provider stores or processes your data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the European Commission's standard contractual clauses to protect it.

• Hosting and network: where Cloudflare processes data outside the European Economic Area, the European Commission's standard contractual clauses or the EU-US Data Privacy Framework apply.
• Audit app hosting: Railway Corp. is a United States company. The audit app and its data are hosted in Railway's EU West region in Amsterdam, the Netherlands. Any access to that data from outside the EEA is covered by Railway's data processing agreement.
• Email inbox: Google may process email data in the United States; Google LLC takes part in the EU-US Data Privacy Framework, and Google's data processing terms include the standard contractual clauses.
• Email delivery: Resend sends our emails from its region in Ireland, in the European Union. Resend is a United States company: it stores contact data in the United States, under the EU Standard Contractual Clauses in its data processing agreement, and it takes part in the EU-US Data Privacy Framework.
• Google Analytics: Google may process data in the United States. Google LLC takes part in the EU-US Data Privacy Framework.
• PostHog: PostHog, Inc. is based in the United States and stores our data on its EU Cloud in Frankfurt, Germany. Any access to that data from outside the EEA is covered by PostHog's data processing agreement.
• The Reddit pixel, when it is on: Reddit, Inc. is a United States company, so the pixel sends its data to the United States.
• Clicky: Roxr Software Ltd processes the data in the United States, under Clicky's data processing agreement.

How long we keep your data

We keep personal data only for as long as we need it for the purpose it was collected for, then delete it. The periods for each type of data are in the table above. If you ask us to delete your data, we delete it unless the law requires us to keep it.

How we protect your data

The site is served only over an encrypted HTTPS connection. Audit contacts are stored in Resend and the audit app's records in its storage at Railway, both behind access-controlled accounts and never in a public file, raw IP addresses and email addresses are not stored for the audit limits, and access to the data is limited to the people at Convertica who need it. No method of storing or sending data is completely secure, but we take reasonable steps to protect it.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy
• rectification: have inaccurate data corrected
• erasure: have your data deleted
• restriction: ask us to limit how we use your data
• portability: receive the data you gave us in a common machine readable format, or have it sent to someone else
• object to processing based on our legitimate interests
• withdraw consent at any time, where we rely on consent, without affecting what we did before

To use any of these rights, email admin@convertica.org. We reply within one month. If we need to confirm who you are before acting on a request, we will ask. We do not make decisions about you based only on automated processing.

How to complain

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a data protection authority. Convertica's lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. You can also complain to the authority in the country where you live or work.

Children

convertica.org is meant for businesses and the people who run them. It is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email admin@convertica.org and we will delete it.

Changes to this policy

We will update this policy when what the site does with personal data changes, for example before analytics is switched on or when the free CRO audit changes. The current version is always on this page, with the date it was last updated at the top.

Contact

For any question about this policy or your personal data, email admin@convertica.org, or write to Convertica OÜ at Sepapaja 6, 15551 Tallinn, Estonia.

See the free CRO audit