Privacy Policy

Most people reading this fall into one of two groups.

You are a customer or user. You signed up, you are using the dashboard, and you may have connected your Google account. We hold your account details, your usage data, and whatever you connect or upload. You control it, you can export it, you can delete it.

You are a business professional whose information is in our system. Cnvrted collects publicly available business information — the kind of thing on a company website, a public professional profile, a public post, a press release, a job listing. We use it to help our customers work out which companies are likely in the market for what they sell. If you would rather not be in there, email work@cnvrted.com and we will remove you.

• We collect business information about people in their professional capacity — work email, job title, employer, public professional posts. Not personal or household information.
• We do not collect or want sensitive personal data — health, finances, biometrics, caste, religion, political or trade union affiliation, sexual orientation, precise location.
• We do not sell data to consumer marketers, and using Cnvrted for business-to-consumer outreach breaches our Terms.
• We do not send outreach on our own initiative and we do not control what our customers send. If you received an email you did not want, the sender chose to send it — though you can still ask us to remove you so it does not happen again through us.
• Our Services are for businesses. They are not for anyone under 18.

2.1 From customers and users

• Account and identity. Name, work email, phone, job title, company, credentials, and any profile details you add.
• Onboarding and ICP configuration. What you tell us about your product, your buyers, your target segments and your qualification criteria.
• Content you put in. Lead lists, target lists, notes, pipeline records, uploaded files, and anything you type into the product, including into ORKA.
• Usage data. Which features you use, scans you run, searches, exports, session timestamps and in-product actions.
• Support and sales. Emails, messages and anything else you send us.

If and when we begin charging for the Services, billing details will be handled by a third-party payment processor and we will not store full card or bank numbers on our systems.

2.2 From your Google account, if you connect one

Connecting a Google account is optional and powers outreach features. We request two scopes, gmail.send and gmail.readonly, and use them only to:

• send the emails you compose and approve in Cnvrted, from your own mailbox; and
• read the messages needed to detect and display replies to emails you sent through Cnvrted, so they appear against the right conversation in your pipeline.

We do not read or store email unrelated to conversations you started through the Service, and we never use Gmail data for advertising.

You see the exact scopes on Google’s consent screen before you approve anything, and you can disconnect at any time from your integration settings in the product or from your Google Account security settings. Disconnecting stops all future access. It does not by itself delete data already synced — ask us and we will delete that too.

Google API Services User Data Policy. Cnvrted’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide the features described above; we do not transfer it to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; we do not allow humans to read it except with your explicit consent, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and de-identified; and we do not use it to develop, improve or train generalised AI or machine learning models.

2.3 From public and third-party sources

This is the core of what Cnvrted does. We collect business information from across the open internet, including publicly accessible company websites, careers pages and press releases; public professional profiles and public posts; public regulatory and corporate registry filings; and public job listings, funding announcements, news and industry directories. We also use third-party research and enrichment providers — currently Apollo, Serper and Exa — to find and verify company and contact information from public sources.

From this we build records that may include name, job title and department, employer, business email address, business phone number, professional profile URLs, employment history, company size, industry, location, funding stage, technology stack, hiring activity, and public statements made in a professional context.

We also derive information — scores, inferences and buying-intent signals generated by analysing and combining the above. Derived data about you is personal data too, and the rights in Section 6 apply to it.

Our lawful basis. Where Indian law applies, we process publicly available personal data made public by the individual or under a legal obligation, as permitted under the Digital Personal Data Protection Act, 2023. Where the GDPR or UK GDPR applies, we rely on legitimate interests — operating a B2B intelligence service — limited to professional-context data with a straightforward opt-out. You can object at any time.

2.4 From visitors to this website

• Forms. Early-access registrations, waitlist signups and career applications: the details you enter, which we store with our database provider.
• Slack community sign-ups. Your name, email, business name, industry and optional website are sent to our team through Resend. After submission, you can follow an invitation link to Slack; joining there is governed by Slack’s own terms and privacy policy.
• Server logs. Our hosting provider records IP address, device and browser type, referring URL and timestamps as part of serving and securing the site.
• Cookies. We use only cookies that are strictly necessary — keeping you signed in to the product and keeping sessions secure. We do not run advertising or analytics cookies, and there is no third-party tracking on this site. If that changes we will add a consent banner before it does.

2.5 What we do not collect

We do not intentionally collect sensitive personal data — health data, financial account data, biometric or genetic data, caste or tribe, religious belief, political affiliation, trade union membership, sexual orientation or sex life, precise geolocation, or government identifiers such as Aadhaar or PAN of individuals in our intelligence database. If such data reaches us incidentally, we delete it.

We do not knowingly collect data about anyone under 18. If you believe we hold data about a child, email work@cnvrted.com and we will delete it.

• To run the Services — create and manage accounts, authenticate users, deliver features and provide support.
• To generate signals and scores — detect buying-intent signals, match them to a customer's ICP, and rank accounts and leads.
• To build and maintain our data — verify accuracy, reconcile records across sources, refresh stale records, and suppress records subject to a removal request.
• To secure the platform — detect and investigate fraud, abuse, credential misuse and breaches of our Terms.
• To improve and develop — diagnose issues, measure feature performance and build new capability.
• To communicate — service notices, security alerts, product updates, and marketing where you have opted in. Every marketing message carries an unsubscribe link.
• To comply with law — respond to lawful requests, meet tax and accounting obligations, and enforce our rights.

Cnvrted is an AI product. Being specific about that:

What our AI does. ORKA and our underlying pipeline use AI to classify signals, infer firmographic and intent attributes, score and prioritise accounts, summarise research, and draft outreach copy for a user to review, edit and send.

Third-party model providers. We use commercial large language model providers to deliver some of these features, and share only what the feature needs. Those providers are listed in Section 5 and are contractually prohibited from using your data to train their models.

Training our own models. We may use aggregated, de-identified usage and signal data to improve our own scoring and classification. Gmail data is never used to train generalised AI or machine learning models, ours or anyone else’s, and we do not train on customer-uploaded data unless a customer has separately opted in in writing.

No significant automated decisions. Our scores and drafts are decision support — a human reviews and acts. We do not use AI to make decisions producing legal or similarly significant effects on individuals, such as employment, credit, housing, insurance or education, and our Terms prohibit customers from using Cnvrted that way.

We share personal data with:

• Service providers and subprocessors. Supabase (database and authentication), Vercel (website hosting), Railway and Cloudflare (application and API infrastructure), Resend (transactional email), Anthropic and OpenAI (scoring, outreach drafting and the in-product assistant), and Apollo, Serper and Exa (company and contact research and enrichment). Each is bound by contract to process data only on our instructions.
• Customers and their authorised users. Business contact and firmographic records, and the signals attached to them, are made available to customers through the Services.
• Our own team, on a need-to-know basis and under confidentiality obligations.
• Professional advisers — lawyers, auditors and accountants, where necessary.
• Acquirers, in a merger, acquisition, financing or asset sale, subject to confidentiality.
• Authorities, where required by valid legal process or to protect the rights, safety or property of Cnvrted, our customers or others. Where we are legally permitted to tell you, we will.

We do not disclose customer content — your leads, notes, pipeline, or anything from a connected Google account — to other customers. Ever.

We do not sell personal data for consumer advertising. Making business contact records available to customers on a subscription basis may count as a “sale” or “sharing” under certain non-Indian privacy laws; where those apply to you, you have the right to opt out under Section 6.

Whoever and wherever you are, you can ask us to:

• Tell you what we hold about you, where it came from, and who we have shared it with
• Give you a copy of it
• Correct anything inaccurate, incomplete or out of date
• Delete it, and add you to our suppression list so it is not re-collected
• Export it in a structured, machine-readable format
• Opt you out of our intelligence database, of marketing, and of any sale or sharing
• Stop processing based on legitimate interests, or pause it while a dispute is resolved
• Withdraw consent at any time, where we rely on consent
• Let someone you nominate exercise these rights if you die or become incapacitated — a right under the DPDP Act

How to exercise them. Email work@cnvrted.com. Customers can also do most of this from account settings. We may ask for enough information to confirm who you are, but no more than we need, and we respond within 30 days. If we need longer and the law allows it, we will tell you why before the deadline.

One note on deletion. After you ask to be removed, we keep the minimum needed in a suppression list — typically a hash of your email — so the request is honoured and the record is not re-collected from public sources. That is the only way an opt-out stays sticky.

No retaliation. We will not degrade your service or charge you differently for exercising any of this.

Grievances (India). Under the DPDP Act, 2023 and the Information Technology Act, 2000, you can reach our Grievance Officer at work@cnvrted.com, or by post at the registered office above. If we do not resolve your complaint, you may escalate to the Data Protection Board of India or, in the EEA, UK or Switzerland, to your local supervisory authority.

Two different roles, and it decides where you send your request. We are a controller — we decide the purposes and means — for our website visitors, our marketing, our own business operations, and the intelligence database we build from public sources. We are a processor — acting on a customer’s instructions — for data a customer uploads or connects from their Google account. There, the customer is the controller and is responsible for having a lawful basis, giving notice and handling rights requests. If your data is with us only because a customer put it there, send your request to that customer and we will support them in fulfilling it.

We maintain administrative, technical and physical safeguards appropriate to the risk, including encryption in transit and at rest, role-based access control and least-privilege internal access, row-level security with tenant isolation on customer data, multi-factor authentication for administrative access, audit logging and monitoring, and regular backups.

No system is perfectly secure. Please help: use a strong unique password, enable multi-factor authentication, keep your devices patched, and tell us immediately at info@cnvrted.com if you suspect unauthorised access.

Breach notification. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as the DPDP Act requires, and notify supervisory authorities and individuals under the GDPR, UK GDPR and other applicable laws within the timeframes those laws set. Customers will be told without undue delay so they can meet their own obligations.

We keep personal data only as long as we need it.

When a retention period ends we delete, anonymise or de-identify the data. Where deletion is not technically practicable — backups, for instance — we isolate it and stop further use until it cycles out.

Cnvrted is based in India. Our infrastructure and subprocessors may store or process data in India, the United States, the European Union and other jurisdictions. Where we transfer personal data across borders we use the safeguards applicable law requires, including Standard Contractual Clauses for transfers from the EEA and the UK. We do not transfer personal data to any country restricted by the Central Government under Section 16 of the DPDP Act. A copy of the relevant transfer mechanism is available on request from work@cnvrted.com.

The Services link to and integrate with third-party sites and tools. Their privacy practices are theirs, not ours. Read their policies.

We will update this policy as the product and the law change. Material changes get a notice — email to account holders or an in-product banner — at least 15 days before they take effect. The date at the top always reflects the current version, and we will provide any earlier version on request.

Cnvrted Pvt Ltd
#41, VJ Infinity, 2nd Cross, Doctors Layout, B. Channasandra, Bengaluru, Karnataka 560043, India

Security: info@cnvrted.com
Privacy, grievances and everything else: work@cnvrted.com