Privacy Policy

Further Forward Innovation Ltd, trading as Convultra ("Convultra", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Please read this policy carefully. By using Convultra, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Information You Provide

When you create an account or use our services, we collect information you provide directly:

• Account information: Name, email address, company name, password
• Billing information: Payment method details, billing address (processed by our payment provider)
• Communication: Messages you send to our support team, feedback, and survey responses
• Website configuration: Domain names and tracking settings you configure in your account

Information Collected Automatically

When you use our website and dashboard:

• Usage data: Pages visited, features used, time spent, actions taken
• Device information: Browser type, operating system, device type
• Log data: IP address, access times, referring URLs

Information Processed on Behalf of Our Customers

Convultra processes conversion data on behalf of our customers (data controllers). This data flows through our servers to advertising platforms. We act as a data processor for this information, which may include:

• Event data: Page views, purchases, form submissions, and other conversion events
• User identifiers: Hashed email addresses, hashed phone numbers, IP addresses, user agent strings
• Transaction data: Order values, product IDs, quantities
• Tracking parameters: Click IDs (fbclid, gclid), cookie values, session identifiers

This data is processed according to our customers' instructions and their privacy obligations to their end users.

2. How We Use Your Information

For Our Direct Customers (You)

We use your information to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send administrative messages, updates, and security alerts
• Respond to your comments, questions, and support requests
• Monitor and analyse usage trends to improve user experience
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations

For Data We Process on Your Behalf

We process your customers' conversion data solely to:

• Transmit events to advertising platforms via their APIs
• Provide you with analytics and reporting
• Debug and troubleshoot tracking issues

We do not use your customers' data for our own purposes, sell it, or share it with third parties except as necessary to provide the service.

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your information depends on the context:

• Contract: Processing necessary to provide you with our services
• Legitimate interests: Improving our services, communicating with you, ensuring security
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legal obligation: Where required by applicable law

For data we process on behalf of customers, we act as a data processor. Our customers are the data controllers and are responsible for establishing the legal basis for processing their end users' data.

4. Data Sharing and Disclosure

We may share your information in the following circumstances:

Service Providers

We share data with third-party service providers who perform services on our behalf:

• Payment processing: Stripe processes payment information
• Cloud infrastructure: Our servers are hosted on secure cloud providers
• Analytics: We use analytics tools to understand how our service is used
• Communication: Email service providers for transactional and support communications

Advertising Platforms (On Your Behalf)

When you use Convultra to track conversions, we transmit data to the advertising platforms you have connected:

• Meta (Facebook/Instagram) via Conversions API
• Google via Enhanced Conversions API
• TikTok via Events API
• Other platforms you configure

This data transmission is the core function of our service and occurs according to your configuration.

Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Convultra, our customers, or others.

Business Transfers

If Convultra is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Retention

Your Account Data

We retain your account information for as long as your account is active or as needed to provide services. If you close your account, we will delete or anonymise your information within 90 days, unless retention is required for legal purposes.

Conversion Data

Conversion event data processed through our servers is retained for 30 days for debugging and analytics purposes, then automatically deleted. We do not retain long-term copies of your customers' conversion data.

Backups

Encrypted backups may retain deleted data for up to 30 additional days before being purged.

6. Data Security

We implement appropriate technical and organisational measures to protect your information:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee security training and access restrictions
• Incident response procedures

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. International Data Transfers

Convultra is based in the United Kingdom. If you are accessing our services from outside the UK, your information may be transferred to and processed in the UK or other countries where our service providers operate.

For transfers from the EEA or UK to countries without adequate data protection laws, we rely on:

• Standard Contractual Clauses approved by the European Commission
• UK International Data Transfer Agreement
• Other lawful transfer mechanisms

8. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a machine-readable copy of your data
• Objection: Object to processing based on legitimate interests
• Restriction: Request restriction of processing
• Withdraw consent: Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@convultra.com. We will respond within 30 days (or sooner where required by law).

9. Cookies

Our website uses cookies and similar technologies:

• Essential cookies: Required for the website to function
• Analytics cookies: Help us understand how visitors use our site
• Preference cookies: Remember your settings and preferences

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality.

10. Children's Privacy

Convultra is not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Further Forward Innovation Ltd (trading as Convultra)
Email: privacy@convultra.com

For data protection enquiries in the UK/EEA, you may also contact your local data protection authority.

13. Data Processing Agreement

Business customers processing personal data through Convultra may require a Data Processing Agreement (DPA). Our standard DPA is available upon request at privacy@convultra.com or can be downloaded from your account settings.