Privacy Policy

ConvertLens ("we", "our") is a Shopify-embedded app that audits merchant product pages for conversion-rate signals. This policy explains what data we collect, how we use it, and the choices you have.

Who we are

ConvertLens is operated by Abdul Wahhab, registered at 28 Mill Fold Gardens, Chadderton, Oldham, OL9 9FY. Contact: support@convertlens.app.

Data we collect from the merchant store

• Product metadata via the Shopify Admin API: product titles, descriptions, images, prices, vendor, product type, variants, status. No customer data, order data, or PII is ingested.
• Storefront page screenshots (mobile viewport, 375×812) captured via our rendering provider (ScrapingBee) and stored in Cloudflare R2.
• Audit results: scores, lens-level sub-checks, and recommendations generated from the above. Stored in our Supabase Postgres database (US-East).
• Billing events from the Shopify Billing API (subscription start/cancel/charge timestamps and amounts).
• Customer Persona (paid plans only): a written description of your ideal customer across four fields, industry / category, customer description, problem-desire-goal, and considered alternatives. The persona is generated from your own product catalogue using an AI draft you review and edit; you can also enter it manually. We retain every saved version so you can trace which persona was active at the time of any past audit. The persona contains your description of your buyer, not data about a specific real person.

Shared-link views

When a public shared-audit link (/r/{slug}) is viewed, we log the view with:

• The IP address SHA-256-hashed (first 16 hex characters). Wenever store raw IP addresses.
• The User-Agent string (truncated to 256 chars).
• The HTTP Referer header, if any (truncated to 512 chars).
• Timestamp.

These records support the view-counts and referrer breakdowns available to Growth and Pro plans.

Third-party processing

Audit content is sent to Google Gemini (model: gemini-2.5-flash) for analysis. Specifically, on each audit we transmit the rubric, the merchant's product data (title, description, prices, variants, no PII), the rendered mobile (and on Growth+ plans, desktop) screenshot, and, on paid plans where a Customer Persona has been set up, the four-field persona description so recommendations can be framed around the merchant's ideal buyer.

Persona generation itself uses the same Gemini model. We send a truncated sample of your product catalogue (titles, descriptions, product types) so the model can draft persona suggestions you then review and edit before saving. We do not send Shopify customer records, orders, or any shopper PII during persona generation.

Per Google's API terms for paid/Vertex usage, this data is not used to train Google models. We rely on this configuration; if Google changes those terms, this policy will be updated.

We additionally use Cloudflare R2 for screenshot storage, ScrapingBee for storefront rendering, Supabase for our Postgres database, and Render for hosting. All vendors are bound by their respective DPAs. Microsoft Clarity is not in this list because it acts as an independent controller rather than our processor - see below.

Analytics on our own pages

We use Microsoft Clarity to understand how our own pages are used - our marketing site, shared audit links, and the ConvertLens app inside your Shopify admin. Clarity records interaction data (clicks, scrolls, mouse movement, page navigation, browser and device type) and produces heatmaps and session replays, so we can find the screens that confuse people.

We never tell Clarity who you are. We send no account identifier, no email address, and no plan or billing information. Your shop domain, your email, your support messages and every billing and subscription screen are masked, so they are not captured in a recording. Audit reports are masked in full.

To be precise rather than to overclaim: the web address of the app page does contain your .myshopify.com domain, and Clarity offers no way to redact web addresses. So a recording is not linked to your account, but it is not perfectly anonymous either.

Clarity does not run on our public audit tool. Pages that assess a storefront we were simply pointed at are never recorded, because that store never asked to be assessed. The login page is excluded too.

This is also separate from the ConvertLens Web Pixel. The Web Pixel runs on your storefront, is consent-aware, collects no personal data and sets no cookies. Clarity runs only on ConvertLens's own pages and never touches your storefront or your shoppers.

Clarity sets first-party cookies on convertlens.app (_clck, up to one year, and _clsk, one day) to recognise a returning visitor and group page views into a session. It also sets Microsoft third-party cookies, including MUID, _uetvid and _uetmsclkid, which Microsoft uses for advertising and other operational purposes across its own properties. Clarity's masking mode is set to Balanced, and we mask the specific fields listed above on top of it.

If you are visiting from the European Economic Area, the United Kingdom or Switzerland, none of those cookies are set. Clarity applies Consent Mode automatically for those regions and withholds every first- and third-party cookie until it receives a valid consent signal. We do not operate a cookie banner and therefore never send one, so visitors from those regions are measured without cookies: each page view is counted separately and nothing persists on your device or follows you between visits.

Microsoft acts as an independent data controller for the data Clarity collects, not as our processor - it determines its own purposes for that data under its privacy statement. Clarity retains recordings for 30 days, except favourited or randomly sampled recordings, which Microsoft keeps for up to nine months. Microsoft does not offer deletion of individual visitors or individual recordings, so we cannot erase a single person's Clarity data on request - only delete the project in full. This is why we send no identifier with a recording, and why audit reports and all billing screens are masked: so that what is retained is of little use to anyone. It also means that when you delete your account, or when Shopify asks us to erase your data, we delete everything we hold, but we cannot reach into Clarity to remove past recordings - they expire on the schedule above. You can opt out at any time using a tracker-blocking browser extension.

Where data lives

Supabase Postgres database: US-East (Virginia). Cloudflare R2 bucket for screenshots. Render hosting: US-East (Virginia). Gemini API: Google Cloud.

Retention

• Store data (products, audits, recommendations, screenshots) is retained for as long as the app is installed plus 30 days post-uninstall, after which Shopify's shop/redact webhook triggers full deletion.
• Shared-link view records are pruned at 90 days (Free / Starter) or 12 months (Growth / Pro).
• Billing events are retained per accounting requirements (currently 7 years, configurable).

Your rights

• Access & export: Settings → "Download my data" produces a JSON export of everything we hold on your store.
• Erasure: Settings → "Delete account" immediately deletes your data, ahead of Shopify's 30-day window. You can also rely on Shopify's mandatory shop/redact webhook by uninstalling the app.
• Data Processing Agreement: available on request at support@convertlens.app.

Shared-link privacy guarantees

A public shared-link page reveals only the audit's scores, screenshot, and recommendations. It does not reveal: your shop domain, internal product or store IDs, billing information, other audits, or any data unrelated to that single audit. Shared pages set noindex, nofollow.

Changes

We will post material changes to this policy here and update the effective date. Continued use after a change constitutes acceptance.

Contact

support@convertlens.app.