Privacy Policy

This Privacy Policy describes how GK Tech Ventures Inc., a Delaware corporation doing business as Convertly ("we," "us," "our"), collects, uses and shares personal information through our website and services. We are the controller of information used to manage our own accounts, business relationships and website. When we process a merchant’s customer or program data on its instructions, we act as its service provider or processor; the merchant’s own privacy notice also applies.

1. Information We Collect

From brand users (Shopify merchants):

• Account information: name, email, password hash, role
• Shopify store URL, OAuth access token (encrypted at rest)
• Billing identifiers via Shopify (we don't store card numbers)
• Brand profile: business name, address, contact, business registration details
• Usage data: page views, feature interactions, audit-log events

From Shopify webhooks (with your authorization):

• Order data (totals, items, currency)
• Customer data (name, email, address — when required for attribution)
• Product catalog data

From creator users:

• Account information: name, email, password hash, profile photo, social handles
• Payout preferences: chosen method (PayPal, bank transfer or another supported provider) and account identifier
• Tax KYC data when applicable: tax identification numbers, including US SSN/EIN, address, phone. SSN/EIN and similar high-sensitivity identifiers are encrypted at rest using AES-256-GCM and are never returned by our API
• Content submissions: photos, videos, social-post URLs
• Usage data: page views, feature interactions

From Instagram (Meta Platform Data — only when a creator or brand connects their own Instagram professional account, with their explicit consent):

• Profile: Instagram username, name, biography, website, profile picture, and follower / following / media counts
• Recent media: the account's own posts — captions, media, permalinks, timestamps, and like / comment counts
• Account insights: reach over the last 28 days (via theinstagram_business_manage_insights permission)
• For a connected brand account only: media where the brand is tagged or mentioned, and comments on the brand's own posts, used for social listening

We access only the connecting user's own Instagram account. Access tokens are encrypted at rest, and we honor Meta's deauthorize and data-deletion callbacks.

From YouTube (via the YouTube Data API — only when a creator connects their own YouTube channel, with their explicit consent):

• Channel: title, handle, description, thumbnail, and subscriber / view / video counts
• Recent uploads: the channel's own videos — titles, thumbnails, watch URLs, publish dates, and view / like / comment counts

This application uses YouTube API Services. Convertly's use of information received from YouTube APIs conforms to the YouTube API Services Terms of Service. By connecting your channel you also agree to the YouTube Terms of Service, and any Google-provided data is handled in accordance with the Google Privacy Policy. We access only the connecting user's own channel, use it solely to verify their reach and auto-build their own storefront and profile, never sell it, and never use it to train third-party models. Access tokens are encrypted at rest. You can revoke Convertly's access at any time from your Google security settings or by disconnecting YouTube in the creator portal.

2. How We Use Your Information

• Provide and maintain the Service (account management, dashboards, integrations)
• Track referrals and attribute orders to creators
• Calculate commissions and surface tax-withholding suggestions
• Manage payout records and, when authorized, submit payments through a brand’s connected payment provider
• Send transactional emails (welcome, password reset, payout notifications, audit alerts)
• Provide AI-assisted drafts, recommendations, answers and supported actions under your account settings
• Use a creator's own Instagram or YouTube data, with their consent, to verify their real reach and engagement, auto-build their link-in-bio storefront from their profile and recent posts / uploads, and compute an audience-quality score. This data is shown back to the creator (and, as reach/engagement figures, to brands they choose to work with), is never sold, and is not used to train third-party models
• Use a connected brand's own Instagram tags, mentions, and comments for social listening and to surface engaged creators to that brand
• Improve our product, debug issues, and prevent fraud
• Comply with legal obligations (tax record retention, applicable privacy requests)

3. Sub-Processors

We use service providers and integrations for the purposes below. The providers involved depend on the features you use and the integrations your brand enables:

• Shopify — primary integration; OAuth + webhooks + billing
• Vercel — frontend application hosting
• Railway — API server hosting
• Neon — managed Postgres
• Upstash — managed Redis (job queue, rate limiting)
• Cloudflare — DNS, CDN, R2 object storage for uploads
• ImageKit — image CDN and transformation
• Resend — transactional email delivery
• Sentry — error monitoring
• Crisp — support chat; on the marketing website it loads when you choose “Chat with us”
• PostHog — product and website analytics, when configured
• Google Analytics / Google Tag Manager, Meta Pixel — website measurement, advertising attribution, subject to your optional-cookie choice and enabled integrations
• Anthropic, PBC — large-language-model provider (Claude) for AI features. Relevant context is processed when you use AI features or enable agent workflows
• Payment providers when configured: PayPal, Stripe, Razorpay — used only when a brand explicitly connects credentials and uses a feature that requires them. Payments are submitted through the brand’s connected provider account, or recorded after the brand pays outside Convertly

4. Data Sharing and Disclosure

We share information with providers for the purposes described above, and with brands and creators as needed to run their programs. A published storefront or opted-in public profile is visible to others. We may also disclose information to meet legal obligations, protect rights and security, or in connection with a business transaction. Optional advertising and visitor-insight tools can involve disclosures treated as “sale” or “sharing” under some US privacy laws. You can reject optional tracking through Cookie settings / Your privacy choices in the footer.

5. AI Features

AI features use a third-party model provider, currently Anthropic, to process relevant prompts and context such as brand information, campaign details, creator profiles and program records. These features include interactive requests and enabled agent workflows. Outputs may be drafts, recommendations or supported actions; the controls and approval requirements depend on the action and your settings. Do not include unnecessary sensitive information in prompts. We do not use connected Instagram or YouTube API data to train third-party models.

6. Encryption and Security

We use HTTPS, access controls and application-level encryption for sensitive integration credentials and tax identifiers. Our Security page describes the controls in more detail. No system can guarantee absolute security.

7. International Transfers

We are a US company and use providers that may process information in the United States and other countries. Their privacy laws may differ from those where you live. Contact privacy@convertlyhq.com for information about the providers and transfer safeguards relevant to your use of Convertly, or to discuss data-processing terms before sharing data that requires a specific transfer arrangement.

8. Data Retention

Retention depends on the information and its purpose: account and program data is kept as needed to provide the service; support records as needed to resolve requests; and financial, security and dispute records as needed for legal obligations, fraud prevention and claims. Deletion requests are subject to these exceptions and to backup lifecycles. Disconnecting an integration stops future authorized access; contact us to request deletion of information already held.

Instagram data can be removed at any time: disconnect Instagram in the creator portal (Settings) to delete the profile, reach, and cached posts we hold, revoke access from your Instagram apps & websites settings, or email privacy@convertlyhq.com. Revoking access via Instagram triggers Meta's deauthorize / data-deletion callback, which deletes the data automatically.

YouTube data can be removed at any time: disconnect YouTube in the creator portal (Settings) to delete the channel profile, subscriber/engagement figures, and cached video data we hold — which also revokes our access token on Google's side. You can additionally revoke access from your Google security settings; deleting your Convertly creator account erases the connected YouTube profile and tokens.

9. EEA and UK Privacy Rights

Where GDPR applies to our processing as controller, our legal bases depend on the purpose: performing our agreement with you, complying with law, consent for optional tracking and connected features, and legitimate interests in operating and securing our service and responding to business enquiries. Withdrawing consent does not affect prior lawful processing. Required account information is necessary to provide the service; optional profile information is your choice.

If you are in the EEA or UK, you have rights of access, rectification, erasure, portability, restriction of processing, and objection. You may withdraw consent at any time. Submit requests to privacy@convertlyhq.com; we respond within the periods required by applicable law, subject to permitted extensions. You may also lodge a complaint with your local supervisory authority.

10. US State Privacy Rights

Depending on where you live and whether the relevant law applies, you may have rights to access, correct, delete or obtain a copy of personal information, and to opt out of sale, sharing or targeted advertising. California residents may also use an authorized agent and exercise applicable rights without unlawful discrimination. Use Cookie settings / Your privacy choices to reject optional website tracking. We honor Global Privacy Control on this website. For other requests, or to appeal a decision where applicable, email privacy@convertlyhq.com. We may need to verify your identity or an agent’s authority. If your request concerns a merchant’s customer data, contact that merchant; we assist it with requests relating to data we process on its behalf.

11. Cookies

Our apps use storage for authentication and service settings. This marketing website stores your cookie choice and only loads optional analytics and marketing integrations after acceptance. These can collect device identifiers, page visits, referrers, interaction data and IP-related information. Reject optional cookies or change your choice using the footer link; withdrawing consent stops future optional tracking on this browser after a reload. Browser controls can remove existing cookies. Support chat loads separately when you request it. Choices are browser-specific.

12. Children

The Service is not directed to children under 18 and we do not knowingly collect personal data from anyone under 18. If you believe we have, contact us to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

14. Contact Us

General privacy questions: privacy@convertlyhq.com
Legal enquiries: legal@convertlyhq.com