01The parties and what this addendum is
This addendum is part of the Terms of use and applies between you, the Converto customer, and Converto. By accepting the terms you accept this addendum. In the event of a conflict about the processing of personal data, what is written here prevails.
Controller. You, the customer, decide why and how the data of the visitors to your links is processed.
Processor. Converto processes that data on your behalf and on your instructions, solely to provide the service you subscribed to.
For the data of your own account, such as registration, billing and dashboard use, Converto is the controller, and what applies is the Privacy policy.
02Subject matter, duration and purpose
Subject matter. The processing of the click and conversion data needed to shorten and redirect links, generate QR codes, apply the routing rules you configure, record clicks and match those clicks with the sales your integrations confirm.
Purpose. Providing the service to you and producing the attribution reports in your dashboard. Converto does not use this data for advertising purposes of its own and does not sell it.
Duration. For as long as your account exists. After closure, for the periods in clause 07 of this addendum.
03Data and data subjects
Data subjects. People who click your links or scan your QR codes and, when you connect a checkout integration, people who buy from you.
Click data. Date and time, country, device type, operating system, browser, source of the click and whether it came from a QR code. Neither the visitor’s IP address nor their city is processed.
Pseudonymized counting data. To avoid counting the same device twice, a random number in the visitor’s cookie and, for devices without a cookie, a code calculated from the IP address and the browser, deleted within 24 hours.
Sales data. The sale’s identifier on the platform, amount, currency, product, payment status, date and the click code. The buyer’s name, email, phone number and tax ID are not stored.
Converto does not process sensitive personal data or data of children and adolescents on your instructions. If your use requires that, talk to us first.
04Instructions and roles
Converto processes the data only in accordance with this addendum, the Terms of use and the instructions you give through the dashboard and the API. If one of your instructions appears to be contrary to the LGPD, we tell you and may suspend carrying it out.
You are responsible for having a legal basis for the processing, for informing visitors about the tracking, including in the code that accompanies WhatsApp messages, and for keeping your own privacy policy.
On your side, you are the one with access to the data: Converto does not access your account’s content for any other purpose, except when you ask for support, when the law requires it, or when it is indispensable to investigate abuse and protect the platform.
05Security
Converto maintains technical and administrative measures consistent with article 46 of the LGPD, among them: encrypted connections throughout the service, passwords stored as hashes, role-based access control, internal access restricted to those who need it, access logs for the logged-in area, protection against bots and abuse at the network layer, and separation of each account’s data.
People with access to personal data are bound by a duty of confidentiality.
06Sub-processors
You authorize Converto to use the sub-processors below, each under a contract requiring the same level of protection as this addendum:
- Cloudflare: hosting, network, security, database and email delivery. United States and global network.
- Paddle: subscription billing and tax document, as merchant of record. United Kingdom and European Union.
- Google: the spreadsheets where we organize demo requests and the waitlist. United States.
When a sub-processor is added or removed, we give at least 30 days’ notice by email or in the dashboard. If you do not agree with the new sub-processor, you can cancel the subscription before the change and get back the proportional part of the period not yet used.
07International transfers
Some of the sub-processors process data outside Brazil. In those cases, Converto adopts the safeguards of article 33 of the LGPD, in particular the standard contractual clauses approved by the ANPD in Resolution CD/ANPD 19/2024, or an equivalent mechanism recognized by the authority.
08Return and deletion
You can export your data from the dashboard at any time, at no cost and in a machine-readable format.
Once the account is closed, the data stays available for export for 30 days and is then deleted or anonymized, except for what the law requires us to keep, such as the access logs for the logged-in area and tax documents.
Click history is deleted according to your plan’s retention period, even while the account is active.
09Security incidents
If there is a security incident affecting personal data processed on your behalf, Converto notifies you within 48 hours of becoming aware of it, with what is known at that point: what happened, which categories of data and data subjects were affected, the measures taken and the point of contact for following up.
Notifying the ANPD and the data subjects, where applicable, is up to you as the controller. Converto provides the information and technical support needed for that.
10Data subject requests and support to the controller
If a data subject contacts Converto directly about data that is yours, we forward the request to you and do not reply on your behalf, unless you ask us to in writing.
Converto supports you, as far as the service allows, in meeting the requests under article 18 of the LGPD, in preparing impact reports and in responding to authorities. The dashboard already lets you view, export and delete the data of each link and each click.
11Demonstrating compliance
On request and once a year, Converto provides in writing the information needed to demonstrate compliance with this addendum. An on-site audit, or one by a third party you hire, depends on prior agreement on scope, date and cost, and on a confidentiality agreement.
12Changes and contact
We may update this addendum. When a change is significant, we give at least 30 days’ notice by email or in the dashboard, and the same cancellation right as clause 06 applies.
Data protection matters: support@conver-to.com, with the subject "Personal data".