Privacy Policy

1. Introduction

Convertly ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

By using Convertly, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Account Information: Name, email address, password, and profile details
• Business Information: Store name, business details, bank account information
• Payment Information: Payment gateway credentials (stored securely and encrypted)
• Communications: Messages, feedback, and support inquiries

2.2 Content and Usage Data

We automatically collect information about your use of our Service:

• Salespages: Content you create, including text, images, and configurations
• Products: Product listings, pricing, and inventory data
• Orders: Transaction records and customer information
• Analytics: Page views, feature usage, and performance metrics
• Device Information: IP address, browser type, and operating system

2.3 Cookies and Tracking

We use cookies and similar technologies to improve your experience, analyze usage, and provide personalized content. You can manage cookie preferences through your browser settings.

3. How We Use Your Information

We use the collected information for various purposes:

• Service Provision: To create, host, and manage your salespages
• Payment Processing: To process transactions and integrate with payment gateways
• Account Management: To authenticate users and manage subscriptions
• AI Generation: To generate salespage content using AI tools
• Analytics: To analyze usage patterns and improve our Service
• Communication: To send updates, security alerts, and support messages
• Legal Compliance: To comply with legal obligations and protect our rights
• Fraud Prevention: To detect and prevent fraudulent activities

4. Data Sharing and Disclosure

4.1 Payment Gateways

We share necessary transaction data with payment gateway providers (ToyyibPay, Billplz, SenangPay, ChipIn) to process payments. This includes:

• Transaction amount and customer details
• Product or service information
• Payment credentials (encrypted and tokenized)

These providers have their own privacy policies governing your data.

4.2 AI Services

We use third-party AI services (e.g., Google Gemini) to generate salespage content. Your inputs to the AI (product descriptions, business details) are processed by these services according to their privacy policies. We do not share sensitive customer or payment data with AI services.

4.3 Service Providers

We may engage trusted third-party companies to perform services on our behalf, including:

• Hosting and infrastructure (Supabase, Vercel)
• Analytics and monitoring
• Email and communication services
• Customer support tools

4.4 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new owner.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest
• Access Controls: Strict access limits and authentication requirements
• Secure Storage: Payment credentials are stored using encrypted vaults
• Regular Audits: Periodic security reviews and vulnerability assessments
• Row Level Security: Database policies ensure users can only access their own data

Despite our efforts, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your data for as long as necessary to provide our Service and fulfill the purposes outlined in this policy:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: Content is deleted within 30 days of account closure
• Legal Requirements: Some data may be retained longer to comply with legal obligations
• Backups: Backup copies may persist for up to 90 days in secure systems

You can export or delete your data at any time from your account settings.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a structured format
• Objection: Object to processing of your data
• Restriction: Limit how we use your data

To exercise these rights, contact us at support@convertly.my. We'll respond within 30 days.

8. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us, and we will take steps to delete such information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last Updated" date. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@convertly.my
• Website: www.convertly.my

For data protection inquiries from Malaysia, you may also contact the Personal Data Protection Department (JPDP) or refer to the Personal Data Protection Act 2010.