1. Who we are and how to contact us
ConvertAI.one is operated by Mahdi Group Ltd, registered in England and Wales with company number 12008243. Our registered office is 4 Capricorn Centre, Cranes Farm Road, Basildon, Essex, SS14 3JJ, United Kingdom.
For privacy questions, requests or complaints, email hello@convertai.one. This notice covers our website and platform. A business using ConvertAI on its own website must also explain its processing in its own privacy notice.
2. Our role and the website owner's role
We are a controller for information used to operate our business, including account administration, our enquiries, billing, service security and legal records. We decide the purposes of that processing.
For customer-controlled leads, visitor recordings and website reporting, we generally act as a processor on the customer's documented instructions. The customer is responsible for deciding its purposes, lawful basis, notices and appropriate retention. That does not remove our own processor, security or assistance obligations. Our Data Processing Addendum sets out terms for incorporation into a customer agreement.
If you visited a customer's website, contact that business first about its collection or use of your information. We can help route a request to the appropriate customer without disclosing another customer's information.
3. Information we handle
Do not send passwords, payment-card details, medical records or other unnecessary sensitive information through free-text bot fields, task notes or uploads. Masking reduces recording exposure but does not replace the website owner's responsibility to identify and protect sensitive content.
| Information | What it can include |
|---|---|
| Accounts and support | Name, email, workspace membership, authentication information, account preferences and correspondence. |
| Orders and billing | Package, invoice, payment-provider references and payment status. Where Stripe is used, card entry and processing occur through its payment services. |
| Customer enquiries and bots | Answers and contact details voluntarily submitted to a customer's enquiry flow, calculator answers and estimates, lead status, and authorised delivery destinations. |
| Visitor recordings and journeys | Page and navigation events, device and viewport characteristics, interaction counts, masked replay events and, where enabled and permitted, derived journey observations. Shared recordings can contain multiple pages and tabs. |
| Connected reporting | Authorised Google account and property information, encrypted connection tokens and the reports available through explicitly selected properties, websites, advertising accounts or Business Profile locations. |
| Assessment and content work | Public-page excerpts, page inventories, confirmed business facts, aggregate performance evidence, action history, drafts, approvals and implementation records. |
| Consent and technical records | Purpose choices, random consent references, policy versions, timestamps, access/security information and service diagnostics. These are not a verified identity of a website visitor. |
4. Purposes and lawful bases
For processing where we act as controller, the basis depends on the activity and relationship. For customer website processing, the customer must establish and document its basis. A general privacy-policy link, an owner enabling a feature or legacy analytics metadata is not proof of a visitor's consent.
A website visitor can submit an ordinary enquiry without agreeing to optional advertising or helpful suggestions. Refusing an optional purpose should not be treated as refusing the service the visitor requested.
| Purpose | Basis |
|---|---|
| Provide an individual account, respond to a requested enquiry or fulfil an agreement | Contract or steps requested before a contract; legitimate interests where the contact represents an organisation rather than being the contracting individual. |
| Operate business accounts, provide support and protect the service | Legitimate interests in administering, maintaining and securing a business service, balanced against the person's rights. |
| Maintain required financial records or respond to legal obligations | Legal obligation, where the relevant law requires the processing. |
| Optional storage, behavioural measurement, personalised suggestions and relevant marketing | Consent where required, obtained through the applicable purpose-specific choice. Optional permissions can be withdrawn. |
5. Google connections and Google user data
Connecting Google authorises the scopes shown by Google for that connection. Analytics and Search Console reporting use read-only access. Property, stream, hostname, Ads account and Business Profile location selections are explicit; connecting an account alone does not bind every accessible property or business.
We use selected Google data to show reports, prepare website reviews and action plans, support the integration features you request, and check subsequent observed performance. Analytics, Search Console, advertising interactions and ConvertAI enquiries remain separate measurements; we do not claim individual organic-search-query attribution or verified sales from these reports.
Authorised AI review and strategy features can send bounded aggregate reporting evidence, confirmed business facts and sanitised public-page excerpts to our AI provider. The weekly reporting workflow excludes identified leads, raw recordings, private notes and credentials. Business Profile content is not sent to AI in that reporting workflow.
Our use and transfer of Google API information follows Google's applicable User Data Policy and Limited Use requirements. We do not sell Google user data, use it for unrelated advertising targeting, or use it to train general-purpose AI models. Human access is limited to authorised feature fulfilment, support and permitted security/legal purposes, consistent with the applicable Google policy.
You can disconnect a website binding in ConvertAI and revoke the application's permission through your Google Account. Disconnecting a binding stops its future imports; it does not, by itself, erase previously saved reports, remove every account-level credential or delete records held by Google. Contact us to request the applicable deletion of stored connection data and reports. Other active bindings must be considered separately.
Business Profile access is separate and requires Google's business.manage permission even though our provider client is read-only. Only explicitly bound locations are reported. Cached Business Profile content has a maximum 30-day lifetime; expiry must not be confused with the retention of other report types or customer records.
6. AI-assisted features
We use the OpenAI API for enabled AI-assisted features. Depending on the feature and your instructions, inputs can include service/pricing descriptions, selected uploaded material, bot conversation context, public-page excerpts and bounded aggregate reports. The exclusions described for weekly reviews are not a claim that every conversational feature receives no visitor-supplied text.
AI can be wrong. Drafts, estimates and intent observations are not guaranteed facts, professional advice, a measure of a person's worth, or proof of buying intent. Content publication, calculator pricing approval and customer-site implementation remain separate approval steps. The service is not intended to make legally or similarly significant decisions about people using intent estimates alone.
OpenAI's API documentation states that API data is not used for model training by default unless an organisation opts in, and describes abuse-monitoring and feature-specific retention. We do not represent our account as having Zero Data Retention or UK-only AI processing. Contact us for information about the processing arrangements relevant to your enabled features.
7. Recordings, traffic classification and consent
Recordings are configured by the customer. Capture uses masking and bounded events rather than treating typed values, credentials or every page element as suitable recording data. Browser visit identifiers provide website-and-origin-scoped continuity, not a person's identity.
Traffic classification uses explainable behavioural evidence and, through a trusted request path, supported crawler verification. The security design uses expiring, website-scoped keyed network fingerprints rather than raw-IP identity or MD5 matching. Matching technical characteristics does not establish that visits are the same person. Hosting/access logs are a separate data category and require their own retention schedule.
Journey measurement requires its own valid permission signal. Helpful suggestions also require separate personalisation permission and an owner-approved prompt policy. Unknown or denied permission is not a grant. Withdrawal stops the relevant new measurement and triggers the service's applicable removal of derived intent evidence; it does not imply that all independently retained enquiry or recording records are automatically deleted.
The native ConvertAI banner is optional and disabled by default. Existing installations, third-party banners and independently executed tags require an appropriate integration. A policy page cannot retrospectively establish consent or silently alter the customer's current recording/display settings.
9. Retention, deletion and account closure
There is no single maximum lawful period for every category of personal information. Retention must be justified by its purpose, applicable obligations and the person's rights. We do not offer indefinite storage as a way to avoid deletion responsibilities.
Customers determine a suitable schedule for the leads and website data they control and tell us their documented instructions. Contact hello@convertai.one for the applicable export or deletion request; there is currently no general self-service lead/replay retention control. This responsibility does not transfer our processor duties to the customer. Contracted platform limits and technical availability still apply; a policy does not create a retention control that is not implemented.
Known product limits include seven-day expiring security fingerprints, consent choices of 180 days by default, consent receipt retention of 365 days by default, and a maximum 30-day Business Profile cache. Configurable product defaults are not statutory retention periods. Derived visit records are tied to the underlying evidence and consent/deletion behaviour.
The five defaults below are product retention limits, not statutory maxima. Scheduled, bounded cleanup applies to the covered application data. Leads use the last genuine enquiry activity, recordings use their captured activity and reporting caches use their reporting period; internal notes and worker retries do not extend these clocks. Expiry is processed on a scheduled sweep rather than at an exact second. Holds, safety failures or a processing backlog can delay a sweep and require operator review.
A valid earlier erasure request, withdrawal where applicable, or lawful customer instruction must be assessed independently of these defaults. Any necessary longer retention needs a specific documented lawful reason, restricted scope and review; a legal hold is not permission to retain every lead or recording. Required accounting/legal records must be separated from optional visitor data.
The 35-day default covers verified application-managed backups, not every supplier-managed snapshot, mailbox or other provider copy. Local database/upload backups and recognised deployment archives follow bounded verification and expiry jobs. Unverified or held archives are flagged for review, not silently certified or deleted. Backup copies are outside ordinary application use; restoration requires reapplying erasures before restored data returns to use. Immediate erasure from every copy, off-site protection and a tested recovery-time guarantee are not promised.
Support correspondence, dedicated security-investigation records and account-closure/export timing are assessed separately according to the purpose, applicable obligations and documented customer instructions. No fixed periods for those categories are specified in this notice. Account closure does not itself establish an automatic deletion deadline or authorise indefinite storage. Contact us for an export or deletion arrangement.
| Information | Default period | Scope |
|---|---|---|
| Leads and enquiry answers | 24 months | Customer-controlled enquiries, submitted bot answers and calculator estimates. Not a blanket period for separate accounting/legal records. |
| Recordings and linked journey evidence | 90 days | Visitor recordings and linked personal journey/prompt evidence, including associated replay data rather than just an index entry. |
| Connected reporting cache | 14 months | Cached Analytics, Search Console and Ads reporting evidence. The shorter Business Profile cache limit remains separate; this does not set Google's own retention. |
| Routine application and delivery logs | 30 days | Managed routine container logs and delivery diagnostic payloads. Minimal delivery-status/idempotency receipts remain with the enquiry lifecycle; provider-managed logs and dedicated incident records are separate. |
| Application-managed backups | 35 days | Verified local database/upload and recognised deployment archives, subject to holds and safety review. Supplier-managed copies are separate; no off-site or tested recovery guarantee. |
10. Your rights and complaints
Contact hello@convertai.one about access, correction, deletion, restriction, portability, an objection, or withdrawal of consent. Rights depend on the processing and applicable law. We may need proportionate information to confirm authority and protect other people's data. Withdrawing consent does not make earlier lawful processing unlawful.
Where we act as a processor, we assist the relevant customer rather than independently deciding every request about its records. If you are concerned about our handling of information, you can also complain to the UK's Information Commissioner's Office or the regulator with jurisdiction over your circumstances.
11. Security and data protection
We use technical safeguards to protect personal information, including Google user data accessed through authorised Analytics and Search Console connections. Our public website and account portal use HTTPS/TLS, and our Google API communications use HTTPS, to protect information in transit.
Google OAuth access and refresh tokens stored in our application database are encrypted using server-side encryption. The encryption key is supplied through server configuration; it is not returned to the browser with reports. Account passwords are stored as bcrypt hashes rather than plain text. Token encryption is not a claim that every report, database volume or backup is encrypted, or that the service provides end-to-end encryption.
Access to saved Google reports requires an authenticated account with access to the relevant workspace and website. Only authorised owners and administrators can connect reporting accounts and select their website's reporting properties. Our reporting integration uses read-only Google permissions, website-scoped property bindings, and expiring, single-use OAuth state with PKCE to reduce unauthorised access and authorisation-replay risks.
These safeguards reduce risk but cannot guarantee absolute security. Contact hello@convertai.one privately to report a security concern or ask about protection of your information. Do not include passwords, OAuth tokens or another customer's data in a report.
12. Changes to this notice
We will identify substantive updates and provide additional notice or request new permission where required before introducing a materially different use. The date and version identify this notice. Publication does not retrospectively change existing customer agreements or visitor permissions.