Privacy Policy

1. Who we are

Conversion Clinic (conversionclinic.io) is a website conversion audit service operated by Fernando Baliño in New York, United States. In this policy, "we", "us" and "our" mean Conversion Clinic and its operator.

2. What we collect

• When you visit the site: pages viewed, time on page, device, browser, approximate location (city level) and the site that referred you. We collect this with Google Analytics 4 (loaded through Google Tag Manager), PostHog and Vercel Analytics. PostHog also records session replays of how pages are used; anything typed into form fields is masked and never recorded.
• When you order an audit: your name, email address, website address and the answers you give about your business, such as your offer, customers, goals, traffic and competitors' websites. If you choose to, files you upload with analytics exports.
• When you pay: Stripe processes your payment. We receive your name, email, the amount and whether the payment succeeded. We never see or store your full card number.
• When you sign in to your dashboard: your email address, to send you a sign-in link. If you use Sign in with Google, we receive your name, email address and profile picture from your Google account.
• When we audit your website: we load the pages you give us in an automated browser and record screenshots, page text and speed measurements from Google PageSpeed Insights. For local businesses we may look up your public Google Business Profile listing through the Google Places API.
• When you write to us: the contents of your message and your contact details.
• Business outreach: in July and August 2026 we emailed a small number of businesses using contact details those businesses publish on their own websites and Google Maps listings. We keep the business name, website and contact address so we can honor opt-outs and never contact the same business twice. That outreach has stopped.

3. Google user data (if you connect Google Analytics)

Connecting Google Analytics is optional. Your audit works without it.

What we access. When you click Connect Google Analytics, Google asks you to give Conversion Clinic read-only access to your Google Analytics data (the analytics.readonly permission). We use that access to do two things: list the Analytics accounts and properties you can see, so you can pick one; and read summary reports for the property you pick, covering the last 90 days. Those reports contain sessions, users, bounce rate, average session duration and conversions, broken down by traffic source, page, landing page, device and day. They are totals and averages. We do not access information about individual visitors, and we cannot change anything in your Google account.

How we use it. Only to produce the audit you asked for and to show those numbers in your dashboard: comparing your traffic and conversions with what we find on your page, and showing where visitors drop off. We do not use it for any other purpose.

Who it is shared with. The summary data is processed by Anthropic through the Claude API, the AI service that analyzes your page and writes your report. Anthropic processes it on our behalf under commercial terms that do not allow it to train its models on that data. The data is stored with our hosting providers, Railway (database) and Vercel (website). We do not share Google user data with anyone else, we never sell it, and we never use it for advertising.

How we protect it. The data travels only over encrypted connections (HTTPS/TLS). Your Google access tokens are kept on our servers and are never sent to your browser. Our database is access-restricted and reachable only by Conversion Clinic's operator. The permission is read-only, so it cannot be used to change your data.

How long we keep it. Our access lasts until you disconnect Google Analytics from your dashboard, or until 90 days pass without us using it, whichever comes first. At that point we revoke the access with Google and delete the access tokens. The summary numbers stay attached to your audit report so the report remains complete, and we delete them when you ask us to delete your data. You can also remove our access yourself at any time at myaccount.google.com/permissions.

Limited Use. Conversion Clinic's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI and machine learning. We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models, and we do not let our providers do so.

4. How we use your information

• To produce your audit and keep your report available in your dashboard
• To send you emails about your order: confirmations, delivery and replies to your questions
• To process payments and refunds
• To keep the site secure and working, and to understand how it is used so we can improve it
• To send follow-up emails after your report is delivered. Every one has an unsubscribe link.

5. Service providers

These companies process data on our behalf, only to provide our service, each under its own terms and privacy policy:

• Anthropic (Claude API): analyzes your page content, screenshots, your answers and, if connected, your analytics summaries, and writes the report.
• Google (Gemini API): marks the findings on your screenshots.
• Perplexity: researches your industry and the competitor websites you name. It receives your business description and those website addresses, never your analytics data.
• Google (PageSpeed Insights and Places APIs): page speed measurements and public business listing information.
• Vercel: hosts the website, stores screenshots and reports, and provides site analytics.
• Railway: hosts our database and the servers that run audits.
• Inngest: schedules the steps that run each audit.
• Stripe: payment processing.
• Resend: sends our emails.
• PostHog and Google Analytics: site analytics.

6. What we don't do

• We don't sell your personal information or your business data.
• We don't use your data, or let it be used, for advertising.
• We don't share one customer's data with another customer.
• We don't use your data to train AI models.

7. Cookies

Google Analytics and PostHog use cookies and similar browser storage to measure how the site is used. Stripe sets cookies during checkout to prevent fraud, and we set a cookie to keep you signed in to your dashboard. We do not use advertising cookies. You can block or delete cookies in your browser settings; the site still works, but you will not be able to stay signed in.

8. How long we keep data

• Orders, answers and reports: while you have an account, so your reports stay available. We delete them when you ask.
• Google Analytics access: as described in section 3, no more than 90 days after we last used it.
• Site analytics: according to each analytics provider's retention settings (14 months for Google Analytics).
• Emails you send us: as long as we need them to answer you and keep a record of the conversation.

9. Your rights

You can ask us to:

• Give you a copy of the personal data we hold about you
• Correct information that is wrong
• Delete your data, including any Google Analytics data and access
• Stop sending you marketing emails

Use the contact form or reply to any email we have sent you. We answer within 30 days and complete deletion requests within 7 business days.

10. Security

We use encrypted connections (HTTPS) everywhere, keep secrets and access tokens on the server, restrict database access to the operator, and use providers with established security programs. No system is perfectly secure, but we take protecting your data seriously.

11. International data transfers

We are based in the United States and our providers process data in the United States and other countries. If you use our service from outside the United States, your information will be transferred to and processed in those countries, which may have different data protection rules from yours.

12. European privacy rights (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your data on these legal bases: to perform our contract with you (producing the audit you bought), your consent (connecting Google Analytics, which you can withdraw at any time by disconnecting it), and our legitimate interests (keeping the site secure, understanding how it is used, and keeping outreach and opt-out records).

You also have the right to data portability, to restrict processing, to object to processing based on legitimate interests, and to complain to your local data protection authority. Use the contact form to exercise any of these rights.

13. California privacy rights (CCPA)

If you live in California, you have the right to know what personal information we collect and how we use it, to ask us to delete it, and not to be treated differently for using these rights. We do not sell personal information or share it for cross-context behavioral advertising.

14. Data breaches

If a security incident affects your personal information, we will notify you and the relevant authorities without undue delay, as applicable law requires.

15. Children

Our service is for businesses and is not directed at anyone under 16. We do not knowingly collect personal information from children, and we delete it if we learn we have.

16. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.

17. Contact

Questions or requests about your data: use the contact form or reply to any email from us. Conversion Clinic, operated by Fernando Baliño, New York, NY, United States.