Privacy Policy

Account Information: Name, email address, and profile image. Failed Log-Ins: How many wrong passwords were entered in a row for your account and, once there are 10, when the 60-minute stop on log-in with a password ends. Convika uses them only to stop people guessing your password, and emails you when the stop starts. The wrong passwords themselves aren't kept. Two-Step Verification: If you turn it on, the secret that your authenticator app and Convika share, your backup codes that haven't been used, both stored encrypted, and that two-step verification is on. Convika uses them only to check the code you enter when you log in. It doesn't learn which app you use or anything else on your phone.

Sign-up Source: How you reached the sign-up page: the UTM parameters of the link you came from, the referring site (its host name only, such as www.google.com), and the path of the first page you opened. If you came through convika.com, the first page is the convika.com page you entered on, and Convika also records the convika.com page whose sign-up or log-in link you clicked. If you came to convika.com from the bar at the bottom of a Free plan page, the source recorded is that bar, as the UTM value convika_badge, and the referring site recorded is the address (host name only, such as yourpage.convika.page) of the page the bar was on, which the bar's link carries. If you came from the line on a page that offers to make your own copy of it, the source recorded is that line, as convika_copy, and not the page. If you came to convika.com from the line on a page made from a template, the source recorded is that line, as the UTM value convika_template, and the sign-up record doesn't include which page the line was on. The dashboard sends these with your sign-up request, and Convika records them with your account to see which links and pages lead to sign-ups. What it sends depends on your answer to the cookie banner: - Accepted on convika.com or the dashboard: the first such link your browser saved. - Not answered yet: what the link that opened the sign-up page carries, which your browser doesn't keep. convika.com adds these values to its sign-up and log-in links when you click one. If convika.com no longer knows the referring site, the link carries only the page you clicked and a note that the source is unknown. - Declined on the dashboard: nothing. Declined on convika.com: its sign-up and log-in links carry none of these values, so Convika doesn't record how you reached convika.com.

Sign-up Button: Only if you accepted cookies on convika.com, the sign-up or log-in link you click there also carries the name of its place on the page, such as the button under a guide's summary, the upload box, or the header. Convika records that name with your new account, next to the items above, to see which buttons lead to sign-ups. If you declined or haven't answered, the link carries no name, and none is recorded with your account.

Sign-up Country and Language: For the request that creates your account, Convika records the country Cloudflare estimates from its IP address and the language your browser is set to (the one it lists first), with your account. This is the same whether you sign up with an email address or with Google. Convika doesn't keep the IP address to record the country. It counts which countries and languages people use Convika from, to improve the Service.

Workspace Time Zone: Each workspace keeps one time zone, as an IANA name such as Asia/Tokyo. When the workspace's owner opens the dashboard and the workspace has no time zone yet, Convika records the time zone the owner's browser reports, unless it is UTC. The owner can change it in Settings, at most once a day. Convika also keeps the time zone a workspace is switching to and when the owner last changed it, and each change goes into the audit log. Convika keeps the time zone to decide where each day starts and ends in the workspace's analytics, in the emails about its pages, and in what Convika's tools tell AI clients.

Usage Data: IP address, User-Agent, access country, and session information.

Server Request Records: For each request that reaches Convika's API, MCP server, or built-in AI server (from the dashboard, an AI client, a form on a published page, an order sheet, and so on), and for each request that opens the dashboard's screens and files (app.convika.com), Cloudflare (Workers Logs) records the time, the full address (its path and query included), the request headers (including the IP address and User-Agent, with cookie values hidden), the approximate location Cloudflare estimates from the IP address (country, region, city, postal code, latitude and longitude), the network (its ASN and organization), a bot score, and the lines the servers write about the request (such as IDs, counts, and error messages). It doesn't record the request's body (such as what a form sends). Convika's team reads these records only to deal with faults and abuse. They are deleted after 7 days.

Sign-up and Log-in Screen Events: So we can find out why signing up or logging in fails, the dashboard's sign-up and log-in screens (app.convika.com/signup and /login) tell Convika when a sign-up or log-in button is pressed, and send it the errors that occur on the screen (the kind of error and its message, the script file and position where it occurred, and files that failed to load). Email addresses and URL queries are removed from the messages, and no visitor ID is attached. Convika adds the browser's name and major version and writes what was sent into the record of the request that sent it, as one of the servers' own lines about that request. So each report is kept as a server request record, as described above, with that request's IP address, User-Agent, and approximate location, and is deleted after 7 days. Nothing is stored in your browser, and the reports are sent whatever you chose in the cookie banner (not when your browser asks sites not to track you).

Password Reset and Verification Emails: When someone asks for a password reset link or a new verification email, Convika keeps a keyed hash of the email address entered and one of the IP address the request came from, not the addresses themselves, to limit how many of these emails go out. It deletes the hashes within 2 days.

First-time Steps in the Dashboard: The first time your account takes certain steps, Convika records the step and when it happened. These include signing up, choosing what to do first on the dashboard's first screen (having the built-in AI make a page, or publishing an HTML file you have), seeing the offer to have Convika make a page for you, opening its request page, sending a request, opening the upload screen, choosing a file or pasting code there, following that screen's link to the AI generator, seeing or answering its question when a typed name reads like a request for a page, making your first preview by upload or with the built-in AI, uploading a new version of a page you already have, downloading or copying a page version's HTML, choosing whether a file you upload with the same title as one of your workspace's pages becomes that page's new version or a new page, seeing the page the AI finished, opening a preview, asking the AI for a change, pressing Publish, being asked there who can open the page and choosing to protect it with a password, answering there whether search engines may show the page, publishing for the first time, approving and connecting an AI client, keeping a page from a free tool or from a link Convika sent you and first editing it, letting people make their own copy of a page, keeping a copy of someone's page and publishing it for the first time, starting a page from a template and publishing that page for the first time, keeping a page you made from a template without an account, setting a page password, seeing the banner about keeping Pro during a trial, opening the plans page or a checkout, seeing the offer at the end of a trial (the first year of Pro billed yearly for $29) on the plans page or right after your first publish, pressing its button there, opening the plans page from an email with that offer, opening a checkout with it, seeing the screen to choose a plan (Free, the 1-year Pro pass, or Pro monthly) when you publish your first page, or when a workspace on the Free plan publishes a page behind a password or as a private link (open only to people who have its link), and choosing one, opening the 1-year Pro pass's checkout, its payment being made or, for a payment method paid later, waiting, starting Pro monthly chosen on that screen, with its free trial or, when none applies, paying at checkout, seeing a notice or offer in the dashboard (offers of a paid plan or feature, the Pro offer shown when you choose a feature beyond a Free plan limit, connecting an AI client, the sample page, a page's next step, a custom domain, a problem with a form or a tracking tag on a page) and pressing its link or button, opening Sell on this page (planned) in a page's settings and asking to hear when it's ready, and starting or ending a trial or a plan. Each step is recorded with your account, your workspace, and the UTM values recorded for your sign-up, if any (Sign-up Source above). Some steps also record the plan you were on. Depending on the step, it also holds: - About a page: which page and version it was, how the page was made, whether you chose a file or pasted code, whether an uploaded page uses scripts, whether a page was live when you uploaded a new version of it, whether you downloaded or copied a version's HTML from the page's upload card or its version history, which you chose when a file had the same title as one of your pages, which AI run made it and whether that run created or edited the page, which screen you were on, whether your plan let you set a page password then, whether a page password replaced an earlier one, whether it was set while publishing or in Site settings, whether you let people copy the page while publishing or in Site settings, which page a copy was made from, for a page made from a template, which template and which page's line it was made from, and, when you answered whether search engines may show a page while publishing it, your answer and the answer the question started on. - About an AI client: the client's ID, its User-Agent, how it signed in (the OAuth grant type), the name of the first tool it called, and whether your workspace was on the Free plan once you approved it. A step that Convika adds afterwards from its sign-in records says so. - About plans and payment: the plan, the billing interval, which notice in the dashboard, in an email, on a published page (the link to remove the Convika bar at the bottom of a Free plan page, which shows only in a browser the page's creator opened the page in from the dashboard), or on the screen an ended preview link shows led to the plans page or the checkout, and, when you came from a page's link to remove its bar, that page's address, recorded whether or not the page is yours, and whether your workspace publishes it, the day of the trial, when the trial ends, whether a plan followed a trial, which offer a checkout or a plan came with, how many days before or after the trial's end the offer was seen or used, which screen showed it after your first publish (the page's screen or the built-in AI's), and Stripe's ID for the checkout or the subscription. - About a page you kept from a link: which page, the link's code, and whether your workspace was on the Free plan once you kept it. - About the question on a typed name: which rule read the name as a request, and how many characters the name had. The name itself isn't recorded. - About the offer to have Convika make a page: where in the dashboard you saw it, which offer you opened the request page from, and the ID of the request you sent. - About a notice or offer in the dashboard: which one it was. - About Sell on this page (planned): which page's settings you opened it in, and, when you asked to hear when it's ready, what you picked as the thing you would sell on the page, if you picked one (a one-time item in the game, a subscription, sponsor slots for businesses, or something else). Convika uses this record to decide whether to build selling on pages. If you asked to hear, Convika sends one email about this feature to your account's address, such as when it becomes available, even if you turned off tips and reminders. - About the plan choice and the 1-year Pro pass: that the screen to choose a plan was shown, whether it was for a first publish or for a password or private link, which plan you chose, and which screen it was on (the page's screen or the built-in AI's). For the 1-year Pro pass: the checkout's currency and the payment methods it offered, Stripe's IDs for the checkout (Checkout Session) and the payment (PaymentIntent), the amount and currency paid, whether the payment was made or is waiting, and, if it was refunded in full, that it was and Stripe's ID for the charge. For Pro monthly: Stripe's ID for the checkout and its currency. When the pass is paid, Convika records the time of the payment as when its Pro started, and records with your workspace when that Pro ends and that it came from the pass. If the same account pays again and the payment is refunded, Convika records that with Stripe's ID for the checkout and emails Convika's operator about it, with only the first 8 characters of the workspace's ID and Stripe's IDs. - About Light: opening its checkout and paying for it are steps too, with where the checkout was opened and its currency, and, for the payment, the amount paid and Stripe's ID for the checkout; so is Light's end, with why it ended. A step never holds a page's name, its content, or the text you typed. Convika uses the steps to see where new accounts stop before their first live page.

Your Answers to Convika's Questions: The dashboard asks 2 optional questions. Shortly after you sign up: "Where did you hear about Convika?", with a short follow-up for some answers. It also used to ask once, right after your first publish: "What did you ask when Convika came up?". The answer you choose and any text you type (up to 200 characters each) are recorded with your account, to learn which places and questions lead people to Convika. You can skip either of these 2; Convika then records only that you skipped, so it doesn't ask again. On the plans page, right after a payment for the 1-year Pro pass or a Pro or MAX plan: "What made you pay today?", with a text field after "Other". The answer you choose and any text you type (up to 200 characters) are recorded with your account, your workspace, the time, and that payment (what was paid for and Stripe's ID for the checkout), to learn what people pay for and decide what to build. You can skip it; Convika then records only that you skipped it for that payment.

Page Requests: If you ask Convika to make a page for you, Convika keeps what you write (your business, what visitors should do, a page to start from, and anything else) with your account and your workspace, along with the dashboard's language, the offer you came from, and where the request stands. Convika uses it to make the page and to email you about it at your account's email address: the preview, and the page once it is live. Convika may make the page with the built-in AI, and its team may draft or review it with Anthropic's Claude. So what you write, and what the page at the address you give says, go to OpenRouter and the AI model provider when the built-in AI makes the page, and to Anthropic when the team uses Claude (section 3). The emails go out through Resend, and replies to them reach tomoya.fujita@fluxenic.com.

Workshop Applications and the Free Diagnosis: If you ask for the free diagnosis on the Claude Code business launch workshop page on convika.com (in Japanese), Convika keeps your email address (a work or a personal one), what you apply for (workshop seats, how many, and which dates, the company offer, or the kit pre-order), how you'll pay for seats (card or invoice), and when you sent it. If you give them, it also keeps your answers (how many people your company has, the AI tools it gave its staff, how many use them, its rules for review and permissions, and the workflow you want running), your company's name, your role, and anything else you write. Unless you declined cookies on convika.com, it also keeps the utm_source of the link that opened the page. Convika uses them to write the diagnosis and email it to you, and to reply to what you applied for: a payment link, an invoice, scheduling, or news that the kit is on sale. Convika's agent writes the diagnosis by reading your answers with Anthropic's Claude, and Convika's team replies to your application with Claude, so your answers, what you apply for, your company's name, your role, your email address, and anything else you write go to Anthropic (section 3). The notice Convika's team gets for each one carries only the choices you made and the length of what you wrote, never what you wrote, your company's name, or your email address. If you pay for workshop seats, Convika also keeps how many seats you paid for, the amount, when you paid, when it was refunded, and Stripe's IDs for the payment with your application, and deletes them when it deletes the application. To take a card payment, Convika gives Stripe the email address you applied with and your application's ID, and Stripe sends the receipt to that address. When you buy the 1-year Pro pass, Stripe keeps the card you paid with so that page views past the monthly allowance can be charged to it. The card number never reaches us.

The aio-cycle Skill: If you give your email address on the aio-cycle page on convika.com (convika.com/aio-skill/ or /ja/aio-skill/) to get the install commands for Convika's free aio-cycle skill, Convika keeps that address, the page's source tag (aio-article), and when you sent it. Convika uses them to see who took the skill and to write to you about aio-cycle and about Convika's Claude Code business launch workshop. The notice Convika's team gets for each one doesn't carry your email address. Sending the form doesn't send you an email.

Emails About Your Pages: Convika emails your account's address with product tips and reminders, such as a preview waiting to be published or the end of a trial, and its team may write you a letter about your pages, published or not. To write one, the team may read the pages stored in your account, drafts and unpublished versions included, and reads what Convika holds about your account: how you reached Convika and your answers to its questions, the first-time steps above and the actions in your account's audit log, when you signed in, your pages, when they were published, and their settings (such as a page password, a custom domain, or a form), your plan, trial, and subscription, your AI credit use, which emails Convika sent you and your email settings, and your pages' visitors: how many, on which days, and from which countries, referring sites, and kinds of device. It writes these letters with Anthropic's Claude (section 3). The team keeps its drafts of these letters in Convika's private code repository on GitHub (section 3), each with your account's ID, the address and title of the page it is about, and what the letter says. When your account is deleted, the team deletes them with its notes (Notes on How You Use Convika below), but earlier versions stay in the repository's history, and Convika doesn't remove them from it. Convika records which of these emails it sent you and when, so it doesn't send the same one twice. They come from Convika through Resend, and replies to a letter reach tomoya.fujita@fluxenic.com, where the team reads them, also with Claude. You can stop these emails at any time: each one has a link to stop them, and the Product tips and reminders setting in Settings stops them too. Emails your account needs, such as password resets and billing notices, still arrive.

Content You Create: Pages (HTML, CSS, and JavaScript), page settings, and the instructions and source URLs you give Convika's built-in AI.

Page Language and Country: Each time a page is saved, Convika reads from its text which language it is written in (from its HTML lang attribute when the page has little text) and records that language with the page. Pages saved before this change are read the same way from their stored HTML. When you make a page in the dashboard, with the built-in AI included, Convika also records the country Cloudflare estimates from the IP address of the request that made it. A page made with one of the free tools below or from a template without an account gets the country of that request, and keeps it if you keep the page. A page an AI client such as Claude or ChatGPT makes over MCP gets no country, since that request comes from the AI client's servers. Convika doesn't keep the IP address to record a country. It counts which languages and countries pages are made and published in, to improve the Service.

Convika's Access to Your Pages: To provide and run the Service, answer your support requests, improve the Service, and prevent fraud and abuse, Convika's team may view the pages stored in your account. That covers your live pages and also drafts, previews, earlier and unpublished versions, and pages behind a password. Only people on Convika's team can view them, and the team may read them with Anthropic's Claude (section 3). When one of them opens a page's content in Convika's internal admin console, or one of the team's scripts reads it (such as for Notes on How You Use Convika below), Convika logs who or which script opened which page and version, and when. The console's lists show the title and first heading of every page, drafts included, and showing them isn't logged.

Notes on How You Use Convika: To improve the Service, decide what to build, and decide whom to write to, Convika's team reads how each account uses Convika and writes a note about it. It reads each new account, and reads it again when something changes, such as a first publish, a return, a reply, a payment, or the end of a trial. For a note, the team may read the pages stored in your account, drafts and unpublished versions included, and reads what Convika holds about your account: everything Emails About Your Pages above lists, and also your name, email address, language, and account settings, whether another account referred you, your workspaces, their names, and your role in each, how you sign in (such as with Google or a password), the User-Agent of each sign-in, which shows its browser and kind of device, the AI clients you connected and when, your pages' versions with the change note of each, how each page was made (such as by upload, with the built-in AI, or from an AI client), the brief a page was made with (its industry, purpose, audience, product, and offer), whether each page is hidden from search engines now, when you chose Public or Private link at publishing, and the page's gallery status, the free-tool runs that made your pages (Free Rebuild Tool and Free HTML Publishing Tool below), how many people made a copy of your page, how often your preview links were opened (Preview Links below), the reason you choose and the comment you write when you cancel a subscription (Subscription History below), and how many visitors your pages had in each hour. It doesn't read your IP address, your password, what was entered in your forms, or how many entries they received and when. The team reads all of this with Anthropic's Claude (section 3). A note says what your pages are and do and which tool made them, what you did in Convika and when, what you told Convika in a reply or in a cancellation comment, the team's reading of what you want to get done, which may include the country or region you are likely in and your likely age, and what Convika could offer you or ask you next. Each note, with a file of the facts it rests on, is kept in Convika's private code repository on GitHub (section 3). Both name the account only by the first 6 characters of its ID (8, if another account's ID starts with the same 6), never by its name, email address, page address, or page title, and anyone named on a page is written as [name]. They may say what kind of email address the account has, such as a school or a work one, and the country of its domain. What the team read for a note, which holds your name, email address, page addresses, and page text, stays on the team's computer and isn't added to the repository. The logs of the team's sessions with Claude on that computer hold it too, and are deleted once a session has gone unused for 30 days. When an account is deleted, the team deletes its notes, its letter drafts (Emails About Your Pages above), and the files of what it read for them within 2 days. Earlier versions of the notes and the letter drafts stay in the repository's history, and Convika doesn't remove them from it. Once the account's data is deleted (section 5), Convika's database holds no name or email address the notes can be matched to: the account's full ID stays only in a few audit log entries, kept for a year (section 5), some with the IP address and User-Agent of the request, in those earlier letter drafts, and, if the account opened a checkout, in Stripe's records of it.

Convika Bar Experiments: To learn which version of the Convika bar leads more workspaces on the Free plan to a paid plan, brings more people to Convika from the bar, and keeps more pages published, Convika may show different versions of the bar to different workspaces on the Free plan. A workspace that takes part gets one version, which Convika's server picks at random while the experiment runs: when the workspace first makes a preview or starts publishing a page, or, if it already has a live page, when the experiment starts or its trial or Pro ends. Every page, custom domain, and preview of the workspace shows that version. For the workspace, Convika records the version and when it was picked, and, as of then, its plan, its history of trials, subscriptions, and 1-year Pro pass payments, when it was created, what kind of workspace it is, how many owners it had, how many live pages it had, how many page views those pages had in the 7 days before, and the prices of Pro and the 1-year Pro pass. Convika uses the record only to show the workspace its version and to compare the versions. It holds nothing about the people who visit the workspace's pages, and no cookie or visitor ID is used to pick the version.

Convika Bar Wording Comparison: To learn which wording on the Convika bar brings more sign-ups from the bar, we may show different wordings of the Convika bar on views of Free plan pages and compare them. Convika's server picks the wording at random for each page view, without cookies or a visitor ID. For each view we record the wording shown, the page, the date and time, the kind of line the bar showed, and the language it was shown in (the page's language, or the browser's preferred language when the page doesn't set one). The bar's link carries the wording's name, so the record of a click on it, and the first-visit record of anyone who signs up for Convika from it, keep that name too. We use these records only to compare wordings, and the per-view record holds nothing that identifies the page's visitors.

Free Rebuild Tool (used without an account): The page URL you enter and the rebuilt page. Convika keeps your IP address for 2 purposes. To enforce the daily limit and to count how many different people use the tool, it keeps keyed hashes of the address and of its network, and deletes them the day after. To deal with misuse, to answer requests made under law, and to count how the tool is used, it keeps the IP address itself for each rebuild it accepts, with the network operator that address belongs to (such as your internet provider), the approximate location Cloudflare estimates from the address (country, region, and city), the rebuilt page, and the time, for 90 days. Unless you keep the rebuild by signing up, the rebuilt page, its preview link, and its list of changes are deleted after 7 days, and so is the URL you entered. Convika keeps the page's domain, when the rebuild ran, the country Cloudflare estimates from the request's IP address (not the region or city), the language of the rebuilt page, and when the sign-up or log-in page first showed its "Your page is waiting" message and which of its 2 versions it showed, to count how the tool is used. The version is chosen for each claim link, to compare which one leads more people to keep their page.

Free HTML Publishing Tool (used without an account): The HTML you upload or paste, and the file's name if you upload a file. A copy you make of someone's page from its line (Copies of Pages below) is handled the same way, and Convika also keeps which page it copies. Convika stores the HTML as you gave it, in Cloudflare R2. The tool doesn't ask for an account or an email address. Convika keeps your IP address for 2 purposes. To enforce the daily limits and to count how many different people use the tool, it keeps keyed hashes of the address and of its network, and deletes them the day after. To deal with misuse, to answer requests made under law, and to count how the tool is used, it keeps the IP address itself for each upload or copy that makes a page, with the network operator that address belongs to (such as your internet provider), the approximate location Cloudflare estimates from the address (country, region, and city), the page, and the time, for 90 days. The preview link holds a random token, and the preview tells search engines not to index it. Unless you keep the page by signing up, its link stops working after 3 minutes. Convika stores the page and the file's name for 24 hours after the upload, so that you can still keep the page from the upload's result after its link stops, or finish a sign-up that takes longer, and a cleanup that runs twice a day then deletes them. For 30 days after that, Convika keeps a note for the link's address that holds only the page's language (English or Japanese) and the time of the deletion, so the old link can say that the preview has ended. A page uploaded earlier keeps the life its link was given. A page uploaded before October 14, 2026 keeps the 7 days it was given: its link works for 7 days, and the first cleanup after that deletes it. A page uploaded from October 14, 2026 until this change has a link that works for 1 hour, and is stored for 24 hours like a page uploaded now. Convika keeps the time of the upload, the country Cloudflare estimates from the request's IP address (not the region or city), the page's language, whether you kept the page, whether the page uses scripts, and when the sign-up or log-in page first showed its "Your page is waiting" message and which of its 2 versions it showed, to count how the tool is used. The version is chosen for each claim link, to compare which one leads more people to keep their page. Whether the page uses scripts is a yes or no, read from the HTML when you upload. It is yes when the page has a script that runs (the Tailwind CSS script from cdn.tailwindcss.com doesn't count), an attribute such as onclick that runs code, or a canvas element. Convika also uses it on the preview: when it is yes, the bar at the top of the preview says that the page's scripts are off there and that they run once you keep the page. For that, the yes or no stays with the preview until you keep the page or the page is deleted. If you accepted cookies on convika.com, Convika also keeps which convika.com page you uploaded from, such as the tool's page, a guide, or the HTML viewer; if you keep the page, that stays with it in your account. If you declined or haven't answered, that page isn't recorded with your upload: the upload is only added to the page's daily count, described under Convika Website and Dashboard Analytics below.

Copies of Pages: You can let people make their own copy of a page, when you publish it or in Site settings. It stays off until you turn it on, and you can turn it off at any time. While it is on, the live page shows a line that links to convika.com with a random code for the page, which names neither you nor your account. Anyone who follows it gets a copy of the page as it is live then, through the Free HTML Publishing Tool above, and keeps it by signing up. The copy credits your page by its title and address. Convika doesn't add your name, but the text on the page, any names included, stays as you wrote it. The copy leaves out your page's Convika forms, any form embedded from a form service such as Google Forms, and the analytics and ad tags Convika recognizes in its code, such as Google Analytics, Google Ads, or the Meta Pixel. The rest of the page stays as it is, such as its links, other embeds, and its own scripts, and before keeping the copy, the person making it is told which of those still send data to another site. A page with a password, a page that isn't live, and a page with a report under review can't be copied. Convika records which page each copy was made from, and shows you how many people kept a copy of your page, not who they are. It also counts how many views of your live page showed the line, per day and without a visitor ID.

AI Templates: From a template's page on convika.com, you can have the built-in AI make a page such as a personality test, a quiz, or a game. For each page made from a template, Convika records which template it was made from and, if it was made after following the line on someone else's page, which page that was. A page made from a template and published on the Free plan shows a line in the bar at its bottom that links to the same template's page. The link passes through the page's own address on its way to convika.com, and carries a random code for the page, which names neither you nor your account. If someone who follows it makes a page from that template, Convika uses the code to record which of your pages the new page came from. Convika shows the person who made the new page neither your page nor your account, and shows you no one who made one. Convika counts, per day and without a visitor ID, how many times the line was shown and clicked on your live pages. A page with a report under review shows no line.

Gallery: A page you publish as Public from the dashboard may be listed in Convika's gallery on convika.com. To choose candidates, Convika computes the page's visitors over the last 7 days (from daily counts without a visitor ID) and its page views per hour (counts without a visitor ID) and checks automatically whether its text includes people's names, school or class names, contact details such as email addresses or phone numbers, forms, or images. Only the Convika team members who decide on listings see the results. Before a page is listed, a Convika team member opens and reviews it, and Convika records who decided what, and when. For a listed page, anyone can see its title, description, address, the share image Convika makes from the page (its title and template), an image of its screen, its format, and the template it was made from. The image of its screen is the page's first screen, which Convika takes by opening the live page at a computer's screen width when a Convika team member lists the page, and again when the team retakes it. It leaves out what Convika shows over the page, such as the cookie banner and the Convika bar, and opening the page to take it isn't counted in the page's visitors or page views. When someone opens the gallery, each card's image loads from Convika's servers (convika.com or convika.page). The visitor count only orders the list and is never shown. Convika counts, per day and without a visitor ID, how many times the gallery's cards are clicked. Convika also records when you chose Public at publishing, and whether you turned on "Don't show this page in the gallery" in Site settings. A report sent from a gallery card's Report link is recorded like any other report, together with the fact that it came from the gallery.

Preview Links: A preview link is the private link that shows a page before you publish it, made in your account or by the upload box, the HTML viewer, the copy page, the Free Rebuild Tool, or a template's page without an account. Convika counts how many times each page's preview link is opened, per day. Each count is kept by the kind of link; by whether the link worked, had expired, or had been replaced by a newer preview; by whether it was opened within 10 minutes of being made; and by where it was opened from: Convika's dashboard or the convika.com page that made the link, an AI assistant's chat such as claude.ai or chatgpt.com, or anywhere else. Convika tells these apart by the referring site the browser sends, and keeps only which of them it was. To tell your own opens apart, the dashboard's preview links send app.convika.com as the referring site, without the path of the dashboard page, so the page and any analytics tags on it see that address too. The counts hold no visitor ID, IP address, or User-Agent, nothing is stored in the browser for them, they are kept whatever a visitor chose in the page's cookie banner, and opens by known bots aren't counted. Convika uses them to see whether people share preview links with others.

Making a Page from a Template Without an Account: On a template's page on convika.com, you can write what you want and have the built-in AI make your own page from that template, without an account. What you ask the template for goes, with the template's description and example page, to OpenRouter and the AI model provider that write the page (section 3), as it does for a page made in an account. Convika stores the page in Cloudflare R2 and shows it to you as a preview: its link holds a random token, tells search engines not to index it, and works for 3 minutes after the page is made. The page's scripts run in the preview, but its share buttons don't make a link to it. Convika keeps your IP address for 2 purposes. To enforce the daily limits and to count how many different people make pages here, it keeps keyed hashes of the address and of its network, and deletes them the day after. To deal with misuse, to answer requests made under law, and to count how this is used, it keeps the IP address itself for each try it accepts, with the network operator that address belongs to (such as your internet provider), the approximate location Cloudflare estimates from the address (country, region, and city), the page, and the time, for 90 days. Unless you keep the page by signing up through its link, Convika stores the page and what you typed for 24 hours after it was made, and a cleanup that runs twice a day then deletes them. For 30 days after that, Convika keeps a note for the link's address that holds only the page's language, the time of the deletion, and which template the page was made from, so the old link can say that the preview has ended. If you came through the line on someone else's page, Convika records which page that was, as AI Templates above says, and if you keep the page, that record stays with it. Convika keeps the time of each try, its template, the country Cloudflare estimates from the request's IP address (not the region or city), whether it made a page and the page's language, and whether you kept it, to count how this is used. On the template's page, Convika also counts, per day and page and without a visitor ID, how many tries were sent, made a page, and were opened, and how many times the button that keeps the page was pressed.

Translating a Game Without an Account: On convika.com's game translation page, you can upload or paste a game's HTML file and have the built-in AI translate the text players see into the languages you choose, without an account. Convika stores the file as you gave it in Cloudflare R2, finds the text in it that players may see (the page's text and the strings in its scripts), and sends only that text to OpenRouter and the AI model provider that translate it (section 3). Each string from the scripts goes with a few dozen characters of the code around it, so the AI can tell which strings players see. The rest of the file isn't sent, and the game's code isn't changed. To check that the translated game still works, Convika plays it in a browser at Cloudflare (Cloudflare Browser Rendering), which also loads what the game itself loads from the internet. Convika shows you the translated game on convika.com in a sealed frame, and doesn't put it on a Convika address. Convika keeps your IP address for 2 purposes. To enforce the daily limits and to count how many different people use the tool, it keeps keyed hashes of the address and of its network, and deletes them the day after. To deal with misuse, to answer requests made under law, and to count how the tool is used, it keeps the IP address itself for each try it accepts, with the network operator that address belongs to, the approximate location Cloudflare estimates from the address (country, region, and city), and the time, for 90 days. Unless you keep the game by signing up through its link, Convika stores the file and its translation for 24 hours after the translation is done (or after you sent the file, if it wasn't translated), and a cleanup that runs twice a day then deletes them. To count how the tool is used, Convika keeps the time of each try, whether it was translated, the game's language, the country Cloudflare estimates from the request's IP address (not the region or city), and whether you kept the game. When you translate a page in your account from the dashboard, the same text goes to OpenRouter and the AI model provider. The page also counts, per day and with no visitor ID, the translations started, the translated games shown, the presses of the button that keeps a game, and the copies of the request for the game's AI.

Automatic Abuse Checks: When you publish a page or make a preview link, Convika automatically checks its content for signs of phishing or malware. If it finds them, Convika takes the page offline, records why with the page, and emails you. To do this, Convika sends the page's address and the web addresses in the page to Google Web Risk, which checks them against its lists of unsafe sites. While a page is live, Convika also sends its address to Google Web Risk again from time to time to check it.

Page Analytics: Views, button clicks, form submissions, and on-page behavior (scroll depth, time on page, and load speed) on published pages. Each event records the page path, referrer, UTM parameters, device type, country, User-Agent, visitor ID, and session ID. These events don't include the visitor's IP address.

Visitor ID: If a visitor chooses Allow analytics cookies on the page's cookie banner, the visitor ID is a random value kept in the `_cvk_vid` cookie for 90 days. If they choose Decline analytics cookies, or haven't chosen yet, Convika sets no visitor cookie. It computes the ID from the site, the IP address, and the User-Agent with a random key for each day in the time zone the site's workspace uses for analytics (UTC until it uses one), and deletes that key 2 days after its day begins. The same person gets a different ID on each site and on each day. After the key is deleted, no one, Convika included, can compute the ID again from an IP address and User-Agent.

AI Fetches of Published Pages: When an AI service fetches a published page under a name Convika recognizes in the User-Agent (such as ChatGPT-User or ClaudeBot), Convika doesn't count it as a page view, so it counts toward neither your plan's page views nor your bill. An AI agent Convika can't tell apart from a visitor, one that browses with an ordinary browser's User-Agent (such as ChatGPT's agent mode or Claude in Chrome) or names itself in a way Convika doesn't recognize, is counted like a visitor. To show the page's owner which AI services read the page, Convika records, for each fetch by a service it recognizes, only that service's name, whether it fetched for a person's question or while crawling, the page's ID, the host and the path requested (without the query), the response status, and the time. It records no IP address, User-Agent string, cookie, or visitor ID, so the record identifies no person. So the page's owner can see these counts on the dashboard and through MCP for longer, Convika also keeps them in its database as daily counts per page, day (in the workspace's time zone, or UTC when none is set), host, path, AI service, and kind of fetch. Where an AI service publishes the addresses its fetches come from, Convika also records whether the fetch came from an address on that published list, and keeps that answer in the daily counts too. Convika compares the address with the list only at the moment of the fetch and doesn't record the address.

Google Search Data for Pages on convika.page: Each day, Convika imports Google Search data for convika.page, a domain Convika manages in Google Search Console. For each page address on convika.page and each day, it imports how often the page appeared in Google's search results, how often it was clicked, its average position, and the search queries it appeared for. These are Google's aggregated counts of many searches and include nothing that identifies the people who searched. Convika keeps them in its database per page and day and shows them only to the page's owner, on the dashboard and through MCP. A page's numbers are kept only from the day the page began using its address.

AI Answer Check: A workspace can save questions, brand names, and its own domains for the AI answer check. When a member of the workspace, or an AI client a member connected, runs the check, Convika asks ChatGPT, Perplexity, Gemini, and Google AI Overviews the questions picked. With each answer it keeps the question as it was asked, the answer's text, the web addresses the answer cites, and whether the answer names one of the brand names or links to one of the domains. A question or a brand name can include a person's name, such as a sole trader's, and other companies' names, such as competitors'. Convika shows the results only to the workspace's members, on the dashboard and through MCP.

Suggested Questions for the AI Answer Check: When a member who can edit pages first opens AI & search, or presses Suggest again, Convika picks up to 3 of the workspace's live public pages, the most visited first, and sends each one's title, description, the site name it gives itself (such as og:site_name), headings, and opening text, with the brand names saved for the check, to the built-in AI, which suggests questions and the brand names the pages use (section 3). Pages with a password or on a private link are never sent. Convika keeps only the suggestions that come back, not the page text it sent. The suggestions are shown only to the workspace's members, and none becomes a question until a member saves it.

Convika Website and Dashboard Analytics: Page views on convika.com and the dashboard, counted per day by page path, referring site, UTM parameters, device type, and country. The first page of a visit is also counted together with its referring site or utm_source, to see which pages people arrive on and from where. Page views that follow a click on the bar at the bottom of a Free plan page count under that bar (convika_badge), and those that follow a click on a page's line offering to make your own copy count under that line (convika_copy), in place of the referring site. Page views that follow a click on the line on a page made from a template count under that line (convika_template). The first page of a visit from the bar is also counted together with the address (host name) of the page the bar was on, which the bar's link carries. These counts don't show which page a line was on. If you accepted cookies in the banner, each page view carries a random visitor ID that your browser keeps. If not, Convika computes the ID from the host name, the IP address, and the User-Agent, the same way as the visitor ID above, except that the key is one for each day in Japan time (it changes at midnight JST), and the daily counts follow the same days. On convika.com, Convika also counts clicks on sign-up and log-in links, and uploads from the upload box, the HTML viewer's button, or the copy page that make a preview, and pages made on a template's page without an account: one number per day for each page and button. These counts carry no visitor ID, nothing is stored in your browser for them, and they are kept whatever you chose in the banner. The language bar under convika.com's header, which offers the page you are on in your browser's language or in English, is counted the same way, on the first page of a visit that didn't come from convika.com or the dashboard only: how many times it was shown there and how many times its link was clicked there, two numbers per day for each pair of the page's language and the language offered and for what it offered (the page in your browser's language, the page in English, or the original of a page whose menus are in another language). To choose its line and to tell the first page of a visit, it reads your browser's language and the page you came from, in your browser. Convika keeps only these counts. The Cookie Policy lists what is stored.

Redirect of the Address Without www: When you connect a domain such as yourbrand.com, Convika can send visitors who open yourbrand.com, without www, to www.yourbrand.com. For that, the domain's address without www points at Convika's redirect server. When a visitor opens that address, the server receives the visitor's IP address and the request: the address opened, with its path and query, and the headers the browser sends. It uses them only to send the visitor to the same path on the www address. The server keeps no access log, so it doesn't store visitors' IP addresses or the addresses they open. It keeps a certificate for each address without www that it redirects, and before getting one it asks Convika whether the address belongs to a connected domain, sending only the address.

Form Submission Data: Form responses, submitter's IP address, User-Agent, and country. Phone Numbers and Other Answers in Forms: A page's form can ask a visitor for a phone or WhatsApp number in a phone field, and for a choice from a list, a number such as a quantity, or a date. When a page's owner connects a form the page already had to Convika from the dashboard, the form keeps the fields the page asks for. Convika stores these answers with the form responses above and shows them to the page's owner and the members of their workspace: in the dashboard, in the email for each entry (where a phone number is a link to call it), in the CSV export, at a webhook the owner sets, and through the owner's AI client (section 3). Convika doesn't call, text, or message the number, and doesn't use the answers for anything else. Senders' IP Addresses and User-Agents: The IP address and User-Agent stored with each form entry are used to stop spam and to leave bots out of analytics. They aren't shown to the page's owner or the members of their workspace, in the dashboard, an export, the API, or an AI client. They are cleared after 90 days, keeping only a mark of whether the entry came from a known bot. The request that sent the entry is deleted after 7 days, as Server Request Records above says.

Data Pages Save for All Their Visitors: A page can save data with window.storage or window.claude's db, the storage that pages made as Claude artifacts use. What a page's script saves for all its visitors is stored by Convika with that page, and anyone who opens the page can read it. It is whatever the script saves, and can include what a visitor typed into the page, such as a name, a score, or an answer. Convika stores it as text, with when it was first and last saved, and stores no IP address or visitor ID with it. To limit how many requests one address can make, Cloudflare counts each address's requests to each page for 1 minute. The page's owner decides what the page saves, can see it in the page's Site settings, and can delete it there at any time. What a page saves for one visitor only stays in that visitor's browser and is not sent to Convika (Cookie Policy, section 2).

Payment Information: Payment is processed by Stripe. Convika does not store credit card numbers. We retain your Stripe customer ID and subscription ID. To take a payment for the 1-year Pro pass, Convika gives Stripe your account's email address and the IDs of your account and workspace, and Stripe sends the receipt to that address. Subscription History: For each Pro or MAX subscription and each Light, Convika keeps a record of each change Stripe reports: when it started and whether with a free trial, when the trial turned into a paid plan, each payment with its amount and currency, changes of plan or billing interval, when it was set to cancel or that was undone, when it ended, and refunds. With a cancellation, Convika also keeps the reason Stripe gives (such as a request to cancel or a failed payment) and, when you cancel on Stripe's billing page, the reason you choose from its list and the comment you write there, both optional. Convika uses this record to learn how long subscriptions last and why they end, and to improve the Service and its plans. Convika's team also reads, for its notes on your account, the reason you choose and the comment you write (Notes on How You Use Convika above). Light: For Light, the monthly add-on to a Free workspace, Convika keeps with your account and workspace Stripe's IDs for the customer, the subscription, and its invoices and refunded charges; its status, currency, and monthly amount; the period paid for; whether it is set to cancel; and, when it ends, when and why (cancelled, unpaid, ended by a payment for Pro, MAX, the 1-year Pro pass, or a page made for you, with which one it was, or a second Light), the amount to refund, and the amount refunded. Light is paid through your workspace's Stripe customer, which holds your account's name and email address and the IDs of your account and workspace, and its checkout also gives Stripe where it was opened, the UTM values recorded for your sign-up (Sign-up Source above), and the ID and version of the page to publish once it is paid. Convika uses these to give the workspace Light's pages, to end and refund Light as Sections 4 and 5 of the Terms of Service say, and to learn whether people want Light.

New Pages and the Monthly Overage Limit: Each time a page is made in a workspace, however it is made, Convika records which workspace and page it was, how it was made (such as in the dashboard, by upload, with the built-in AI, from an AI client, or by keeping a page), and when, to apply the plan's limit on new pages a day. The record stays after the page is deleted, so that deleting a page doesn't give back the day's count. If a workspace's owner sets a monthly limit on page view overage on the Plans & Billing page, Convika keeps the amount, its currency, the month it applies from, which member saved it, and when, to stop the workspace's pages at the limit and to charge no more than it.

Cookies: Session cookies, locale preferences, and consent state. See our Cookie Policy for details.

Order Pages: When someone who publishes a page starts taking orders on it, the page's order button opens Convika's order page (an address of the form "…--o.convika.page", one per page). For each person who orders there (the "buyer"), Convika records: - Name, phone number (for an online or digital order, if entered), and email address (if entered). For a delivery or a home visit, the country, postal code, and address - The order: items, quantities, options, amounts, payment method, how the order is received (pickup, delivery, online, home visit, or digital), preferred date and time, note, when it was placed and how its status changed, and the version of the final confirmation screen shown before the buyer placed it - Which page, and which version of it, the order button was on, and the referring site's address and UTM parameters. When the buyer moves to another page of the same site before ordering, the referring site and UTM parameters of the first page they opened on that site are carried over in the address of the link they follow (no cookie and no visitor ID) - Whether the buyer pressed "Send to the shop on WhatsApp" on the completion screen When an order comes in, Convika uses the request's IP address and the country Cloudflare infers from it to stop floods of orders from one person and to refuse orders from sanctioned regions. The IP address is not stored with the order. Convika sets no cookies on the order page and uses no browser storage there. To stop prank orders, Cloudflare Turnstile checks that a person is placing the order, using information the browser sends.

People Who Take Orders: For each person who starts taking orders on a page (the "shop"), Convika records the legal name, address, phone number, country, and time zone; how the shop's Specified Commercial Transactions Act notice is shown and what it says (delivery time, cancellation and return terms, and so on); the bank details for transfers, the shop's own payment link, its WhatsApp number and LINE ID, and the email addresses that receive order notices (up to 3; for an address the shop adds that isn't a member of its workspace, when Convika sent it a confirmation email, whether and when it confirmed or declined, and who added it); and when the shop agreed to the Orders and Payments Terms, and which version. For a shop that takes cards, Convika also records the country of its Stripe account and the VAT number the shop registers (required for card from shops in EU countries and the United Arab Emirates).

Requests for a Seller's Details: When a shop's Specified Commercial Transactions Act notice says its name, address, and phone number are provided without delay on request, anyone can ask for them through a form on that notice. For each person who asks (the "requester"), Convika records the email address they enter, when they asked, which shop and page they asked about, whether the email went out, and the request's IP address and the country Cloudflare infers from it. To stop automated requests, Cloudflare Turnstile checks that a person is asking, using information the browser sends.

We use the information we collect for the following purposes:

- Providing and maintaining the Service, including authentication - Analyzing usage to improve the Service - Keeping notes on how each account uses the Service, to improve it, decide what to build, and decide whom to write to - Processing billing and payments - Emailing you product tips and reminders, and letters about your pages, which you can stop - Sending the one email to people who asked for it in Sell on this page (planned) - Providing customer support - Writing the free diagnosis you ask for on the workshop page, and replying to workshop applications - Writing to people who took the aio-cycle skill about it and about the workshop - Preventing fraud and abuse - Complying with legal obligations

Convika uses what it records about buyers on order pages to: - Pass each order to the shop so the shop can fill it - Email the order confirmation and status updates to buyers who entered an email address - Prevent fraudulent orders, prank orders, and harm from fake shops (including limits on orders from one phone number or email address, and holding orders from numbers or email addresses a shop marked as spam) - Refuse orders from sanctioned regions, meet legal obligations, and handle complaints and disputes about orders - Show the shop totals of where its buyers came from and how much they ordered Convika uses a shop's details to build its Specified Commercial Transactions Act notice, to disclose seller information where the law requires, to contact the shop, and to prevent fraud. Convika uses a shop's country and VAT number to decide how its fee is taxed and to keep the record of it. Convika may check the VAT number with the tax authorities' checking services (such as the European Commission's VIES), for example when the shop enters it. For a shop outside Japan that takes cards, Convika shows its legal name, country, and contact email address to buyers on the order page's About the Seller page, as the shop agreed in the Orders and Payments Terms, and its address and phone number too where the law requires them (such as in EU and EEA countries, the UK, and Switzerland). Convika uses a requester's details to email them the shop's name, address, and phone number, to tell the shop that someone asked, to stop floods of requests from one person or to one shop, and to look into suspected misuse such as stalking.

We share your information with the following service providers only as necessary to provide the Service:

- Cloudflare: Hosting, CDN, DNS, custom domain certificates, database and file storage (D1 and R2), page analytics (Workers Analytics Engine), and loading the source URLs you give the built-in AI; it also keeps the records of requests to Convika's servers (Workers Logs) - Tinybird: Storing and querying page analytics: button click and form submission events (page path, referrer, UTM parameters, device type, country, the visitor ID, and the clicked button's text and link) and daily counts per page. To count unique visitors over a period, Tinybird also stores a per-site visitor identifier for each day a visitor viewed the site. We derive it with a secret key that only Convika holds, so without that key it can't be matched to the visitor ID in those events or to the same visitor on other sites. Tinybird deletes these identifiers after 400 days. Form responses and IP addresses are not sent to Tinybird. - Stripe: Payment processing - Resend: Email delivery (verification emails, form notifications, reports, billing notices, product tips and reminders, letters from Convika's team about your pages, the one email for people who asked for it in Sell on this page (planned), and the preview and delivery emails for a page Convika makes for you) - OpenRouter: Relays requests from Convika's built-in AI (page generation and editing in the dashboard) to the AI model you choose. It receives your instructions, the content of any source URL you import, and the page being edited. When Convika makes a page you asked for with the built-in AI, it also receives what you wrote in the request. When you make a page from a template without an account, it receives what you ask the template for. When you translate a game, on convika.com without an account or from the dashboard, it receives the text in the game's file that players may see, each string from its scripts with a few dozen characters of the code around it. When Convika suggests questions for the AI answer check, it receives the titles, descriptions, site names, headings, and opening text of the workspace's live public pages, and the brand names saved for the check, and passes them to the model Convika picked (DeepSeek). - AI model providers: OpenRouter passes those requests to the provider that serves the chosen model, such as Anthropic, OpenAI, Google, DeepSeek, Z.ai, Moonshot AI, or Sakana AI. The model picker in the dashboard lists the current models. - Anthropic: When you ask Convika to make a page for you, Convika's team may draft or review it with Anthropic's Claude. Claude then receives what you wrote in the request and what the page at the address you gave says. Convika's team also writes its letters about your pages with Claude, which then receives what those pages say, drafts included, and what Convika holds about your account, as section 1 lists under Emails About Your Pages. When the team reads your reply to a letter with Claude, Claude receives the reply. Convika's team also writes its notes on how you use Convika with Claude, which then receives your pages, drafts included, and what Convika holds about your account, your name and email address included, as section 1 lists under Notes on How You Use Convika. When you ask for the free diagnosis on the workshop page, Convika's agent writes it with Claude, and Convika's team replies to your application with Claude; Claude then receives your answers, what you applied for, your company's name, your role, your email address, and anything else you wrote. Convika's team may also read the pages stored in your account with Claude, drafts and unpublished versions included, for the reasons section 1 gives under Convika's Access to Your Pages; Claude then receives what those pages say. Convika's team has turned off Anthropic's setting that lets it use these conversations to improve its models. - GitHub: Storing Convika's private code repository, which holds the team's notes on how each account uses Convika and the files of facts they rest on (section 1, Notes on How You Use Convika), and its drafts of letters about your pages (section 1, Emails About Your Pages). The notes and the facts name an account only by the first 6 characters of its ID (8 when two IDs start alike), with no name, email address, page address, or page title. Each letter draft holds your account's ID and the address and title of the page it is about. - Google: Sign-in with Google (only if you choose it), and Web Risk (the address of each page you publish and the web addresses in it, to check them against its lists of unsafe sites) - Scrapeless (operated by NST LABS TECH LTD.): Asking ChatGPT, Perplexity, Gemini, and Google AI Overviews the AI answer check's questions, and returning their answers. It receives each question as written, with any brand name, competitor's name, or person's name in it. Convika doesn't send it your account's details, your pages, or the brand names and domains you save for checking the answers. The AI services receive the questions from Scrapeless and answer them under their own privacy policies. - Slack: Internal alerts when someone reports a page for abuse (the page ID, the reason, and the reporter's description), and when someone asks Convika to make a page (the request's ID, the first 8 characters of the workspace's ID, the request's language, and when its preview is due; none of what was written) - Fly.io (Fly.io, Inc.): Running Convika's redirect server for addresses without www (section 1, Redirect of the Address Without www). It receives the IP address and the request of each visitor who opens such an address, only so that the server can send the visitor to the www address. The certificate for each of those addresses is issued by Let's Encrypt (Internet Security Research Group), which receives the address; like every publicly trusted certificate, it is recorded in public Certificate Transparency logs.

For a page listed in the gallery, its title, description, address, the share image Convika makes from the page (its title and template), an image of its screen, format, and the template it was made from are shown to anyone on convika.com. Nothing else about your account is shown.

When a page in a workspace on a paid plan is published, gets a new live version, or is taken offline, Convika sends the page's public address to IndexNow (api.indexnow.org). IndexNow passes it to the search engines that take part in it (currently Microsoft Bing, Amazon, Naver, Seznam.cz, Yandex, and Yep) so they can visit the page again. The address of a page hidden from search, on a private link, or with a password is never sent, and nothing about the page's visitors or your account is sent. Each search engine handles the address under its own privacy policy.

When you connect an AI client such as Claude, ChatGPT, or Codex, that client receives what Convika's tools return for your requests: page HTML, site settings, analytics summaries, and form submissions (without the submitter's IP address or User-Agent). The client's provider handles that data under its own privacy policy. For the AI answer check, the client also receives the workspace's questions, brand names, and domains, the web addresses each answer cites, and up to 300 characters of each answer around the brand name.

We may also disclose information in response to lawful requests from public authorities.

Sharing with the Shop: The buyer's details and the order go to the shop that received the order. The order page says, after the fields and above the button that places the order, that what the buyer enters goes to that shop, and placing the order is the buyer's consent to that (Act on the Protection of Personal Information, Article 27(1)). The shop is not Convika's processor: it handles what it receives on its own responsibility. In the Orders and Payments Terms, the shop agrees to use it only to fill the order and meet its legal obligations, and to keep it secure. Resend delivers the confirmation and status emails to buyers and the order notices to shops. Order notices go to an address a shop adds to receive them only after that address has confirmed, through Convika's confirmation email, that it wants them; they include the buyer's name, contact details, and address, and the order.

Shops Outside Japan: When the shop is outside Japan, the order page shows, before "Place order", the country the shop is in, that the shop has agreed with Convika to use the buyer's details only for the order and to keep them secure, and a link to the Personal Information Protection Commission's material on that country's data protection rules. The buyer's details go to the shop only with the buyer's consent (Article 28 of the same Act). The measures the shop takes are those the Orders and Payments Terms require. A shop in a country the Commission has published no such material on can't take orders. Details go to shops in EU and EEA countries and the UK without asking for that consent, as the Act allows.

Disclosing Who the Seller Is: Orders on order pages may fall under Japan's Act on the Protection of Consumers Who Use Digital Platforms for Transactions. Under its Article 5, a buyer who needs to claim money from the shop (above an amount set by Cabinet Office Order) can ask Convika for the shop's name, address, phone number, and other details. If Convika finds that the request meets the Act's conditions and isn't for an improper purpose, Convika asks the shop for its view, unless the shop can't be reached, and then discloses them. And when a shop's Specified Commercial Transactions Act notice says its name, address, and phone number are provided without delay on request, Convika emails them to anyone who asks, on the shop's behalf. Convika then emails that shop (the owners of its workspace) the email address the requester entered and when they asked. The request form says so next to its button, and sending the request is the requester's consent to that (Act on the Protection of Personal Information, Article 27(1)). Resend delivers the email to the requester and the notice to the shop. And once the shop has received the payment, Convika gives a buyer who paid by card, bank transfer, or the shop's payment link before getting the goods or service the shop's legal name, address, and phone number, on the shop's behalf, by email and on the order's status page, in the notice of acceptance and payment that Article 13 of the Specified Commercial Transactions Act requires. This includes shops whose notice says these details are provided on request.

Orders from Shops in the EU, EEA, UK, and Switzerland: Where the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection applies to the buyers' details of these shops, the shop is the controller of their handling for filling its orders, and Convika is the shop's processor, handling them for the shop under section 7 of the Orders and Payments Terms. Convika is a controller in its own right of what it handles to prevent fraudulent orders, refuse orders from sanctioned regions, meet its own legal obligations, handle complaints and disputes, and keep the record of its fees. Buyers of these shops can send requests about their details to the shop or to Convika.

Stripe (Card Payments on Order Pages): When a shop takes cards, the buyer enters the card number on Stripe's payment page, and Convika never receives it. Convika gives Stripe the order number, the items and amounts, and the buyer's email address if entered, and the payment is made on the shop's Stripe account. The shop's Stripe account is run by the Stripe company the shop has its agreement with: Stripe Japan, Inc. for a shop in Japan, Stripe, LLC in the United States, Stripe Payments Canada, Ltd. in Canada, Stripe Payments Australia Pty Ltd. in Australia, Stripe New Zealand Limited in New Zealand, Stripe Payments Singapore Pte. Ltd. in Singapore, and Stripe Payments Europe, Limited (Ireland) in EU and EEA countries, the UK, Switzerland, Hong Kong, and the United Arab Emirates. Convika gives this information to the Stripe company handling the shop's payments as part of giving the order to the shop, which the buyer consents to. When the shop is outside Japan, this happens only after the buyer's consent with the shop's country shown, as described under Shops Outside Japan above (except for shops in EU and EEA countries and the UK). Stripe handles the information under its agreement with the shop and Stripe's privacy policy, in the Stripe company's country and in the other countries Stripe's privacy policy names (such as the United States). Convika receives from Stripe the payment's result, the card's brand and the last four digits of its number, Stripe's fee, refunds, and disputes (chargebacks), and records them on the order. The brand and last four digits are shown to the shop on the order so it can check it, and the last four digits are deleted with the buyer's details (by the shop's button, or after 2 years).

Your data is stored on Cloudflare's global network (D1 database and R2 object storage). Payment data is processed and stored by Stripe in the United States. Page analytics events are stored by Tinybird in the United States (AWS us-west-2). Requests to the built-in AI pass through OpenRouter in the United States to the chosen model's provider, which may process them in the United States, China, or another country, depending on the model. When Convika's team uses Claude for a page you asked for, Anthropic processes your answers and the page in the United States. When the team uses Claude to write you a letter about your pages or to read your reply, Anthropic processes the pages, your account's data, and the reply in the United States. When the team reads the pages stored in your account with Claude, Anthropic processes them in the United States. When Convika uses Claude for the workshop page's questionnaire and your application, Anthropic processes your answers, what you applied for, your company's name, your role, your email address, and anything else you wrote in the United States. When the team writes its notes on how you use Convika with Claude, Anthropic processes your pages and your account's data in the United States. GitHub stores the notes and the letter drafts in the United States. When Convika checks a page with Google Web Risk, Google may process the page's address and the addresses in it in any country where Google or its subprocessors have facilities, the United States included; Web Risk offers no choice of country. When Convika sends a page's address to IndexNow, the search engines that take part in it may process the address in the countries where they are based: the United States (Microsoft Bing, Amazon), South Korea (Naver), the Czech Republic (Seznam.cz), Russia (Yandex), and Singapore (Yep).

What order pages record, and shops' details, are stored in Cloudflare (D1 database). A buyer's details that go to a shop outside Japan are handled in the shop's country. Card payment information is also handled in the country of the Stripe company the shop has its agreement with, and in the countries Stripe's privacy policy names. Records of requests for a seller's details are stored in Cloudflare (D1 database) too. Scrapeless's privacy policy names its operator, NST LABS TECH LTD., but not the country where it is based or where it processes the questions, so Convika can't name that country, and it may be outside Japan. The AI services that answer may process the questions in the United States or other countries. Fly.io, Inc. is based in the United States. Convika's redirect server runs on its servers in Tokyo, Japan, and stores no visitor data; Fly.io's network may first receive a visitor's connection at its location nearest the visitor, in Japan or another country, and pass it on to Tokyo. Let's Encrypt (Internet Security Research Group) issues the certificates in the United States.

- Account data: Retained while your account is active, plus 30 days after deletion (recovery grace period) - Sign-in sessions (with each sign-in's IP address and User-Agent): a session expires 7 days after you sign in, and while you use it, its end moves to 7 days from then, at most once every 24 hours. It is deleted when you sign out, or when it is used after it has expired; resetting your password or turning on two-step verification, among other actions, also deletes your sessions on other devices; a session that expires unused stays until the account is deleted - Subscription history, cancellation reasons and comments included: kept with your account data, and deleted with it; the reason you choose, and what the team's notes say of your comment, are kept as the line on those notes below says - Light's record (its Stripe IDs, status, amounts, paid period, refunds, and how it ended): kept with your account data, and deleted with it - The count of wrong passwords and the stop's end: until the next right password or a new password, or until your account data is deleted - Two-step verification's secret and backup codes: until you turn it off or your account data is deleted. A backup code is deleted once used, and all of them when you make new ones - The country and browser language of your sign-up: kept with your account data - A workspace's time zone, the time zone it is switching to, and when its owner last changed it: while the workspace exists - A page's language and the country it was made from: until the page is deleted - The record of each page made in a workspace: deleted with the first page the workspace makes more than 2 days after it, or with the workspace - A workspace's monthly limit on page view overage: while the workspace exists (which member saved it is removed when that member's account is deleted) - Records of requests to Convika's servers (Cloudflare Workers Logs, with the IP address, User-Agent, and approximate location): 7 days - Keyed hashes behind the limits on password reset and verification emails: deleted within 2 days - Page analytics events, which carry visitor IDs: 3 months in Cloudflare Workers Analytics Engine, and 400 days in the raw event archive in Cloudflare R2 and in Tinybird - Records of AI services fetching published pages: 3 months in Cloudflare Workers Analytics Engine - Daily counts of AI services fetching published pages (per page, host, path, AI service, kind, and whether the address was on the AI service's published list, with nothing that identifies a person): until the page is deleted - Google Search data for pages on convika.page (daily counts and search queries per page, with nothing that identifies a person): until the page is deleted - Per-site daily visitor identifiers in Tinybird: 400 days - Daily key behind visitor IDs without analytics consent (landing pages, convika.com, and the dashboard): 2 days after its day begins - Daily page view counts for convika.com and the dashboard: kept indefinitely - Daily counts of clicks on convika.com's sign-up and log-in links, of uploads from its upload box, its HTML viewer, and its copy page, and of pages made on its template pages without an account, and of translations started, translated games shown, presses of the button that keeps a game, and requests copied on its game translation page, which hold no visitor IDs: kept indefinitely - Daily counts of convika.com's language bar, shown and clicked on the first page of a visit, for each pair of the page's language and the language offered and for what it offered, which hold no visitor IDs: kept indefinitely - The record of each use of the Free Rebuild Tool and the Free HTML Publishing Tool, and of each page made from a template without an account (what section 1 says Convika keeps; the page, its preview link, the IP address hashes, and the IP address with its network operator and location are deleted when section 1 says, and only the country stays in the record): kept indefinitely - A game file translated without an account, and its translation: 24 hours after the translation, unless you keep the game by signing up (the record of the try that section 1 describes is kept indefinitely, without the file, the IP address hashes, or the IP address with its network operator and location) - The IP address, network operator, and approximate location of each request those tools and the template pages accepted, with its page and time: 90 days, whether or not the page was kept - Daily counts of the views that showed each page's line offering to make your own copy, which hold no visitor IDs: kept indefinitely - Daily counts of opens of preview links, which hold no visitor IDs: kept indefinitely - Which page each copy was made from: kept with the record of the copy until that page is deleted - Which template and which page a page made from a template came from: until that page is deleted (when the page it came from is deleted, only the reference to it is removed) - Daily counts of how many times a template line was shown and clicked (no visitor ID): until the page is deleted - Gallery records (each page's status, the automatic check's results, who decided and when, the version reviewed, and why a page was taken out): until the page is deleted - When you chose Public at publishing, and the "Don't show this page in the gallery" setting: until the page is deleted - Daily counts of clicks on the gallery's cards (no visitor ID): kept indefinitely - Images of a page's screen taken for the gallery: deleted when the page stops being listed or is deleted (by the next day at the latest when the listing stops because a password is set, the page is unpublished, or a new version is published; when you delete your account, with your account data) - Rows behind their unique visitor counts, each pairing a one-way hash of a visitor ID with the pages and sources it was counted under that day: 2 days after their day - Daily page analytics totals (counts per page, referrer, device, country, and UTM parameter, with no visitor IDs): kept indefinitely, so long-term charts keep working - Page requests: deleted with the account that sent them or with their workspace - Notes on how each account uses Convika, the files of what was read for them, and drafts of letters about your pages: deleted within 2 days after the account is deleted; earlier versions of the notes and the drafts stay in the history of Convika's code repository - A workspace's record in a Convika bar experiment: kept linked to the workspace for at most 180 days after the experiment starts, then deleted (if the workspace is deleted sooner, its ID is removed from the record at once) - Per-view records of the Convika bar wording comparison: kept for 3 months in Cloudflare Workers Analytics Engine after they are recorded, then deleted - Workshop applications and answers to the free diagnosis: deleted a year after you send them - Email addresses given for the aio-cycle skill: deleted a year after you send them - Form entries: Kept until the page's owner deletes the form or the page, or the workspace is deleted. The sender's IP address and User-Agent stored with an entry are cleared after 90 days (its country, and a mark of whether it came from a known bot, stay with the entry; the request that sent it is kept as the records of requests to Convika's servers are, above) - The record of whether each entry was emailed (the entry's and the form's IDs, the time, and how many it went to): Kept until the workspace is deleted, even after the form is, since the month's limits count it - Data pages save for all their visitors: until the page's owner deletes it or the page is deleted, as it is with the account; kept while the page is unpublished - Audit logs: 1 year - Results of the automatic abuse check: until the page is deleted - A buyer's name, phone number, email address, postal code, address, country, note, preferred date and time, and referring site's address: deleted 2 years after the order. 30 days before that, Convika reminds the shop it can export its orders as CSV. They are deleted at once, earlier, when the shop deletes them from the order screen or deletes its workspace - The rest of an order's record (number, items, amounts, status history, referring UTM parameters) and the shop's details: kept until the shop's workspace is deleted - The record of an address a shop added to receive order notices (the address, when its confirmation email was sent, and whether it confirmed or declined): kept until the shop's workspace is deleted, even after the page or its order settings are deleted, so the same address isn't sent confirmation emails again and again - Records of requests for a seller's details (the requester's email address, when they asked, which shop and page, and whether the email went out): deleted 365 days after the request. The request's IP address and country are cleared 90 days after it. They are kept for these periods even if the shop deletes its workspace - For orders paid by card, what is needed to answer a dispute (the order's items and amounts, the version of the final confirmation screen, and the records of acceptance and shipping): kept 180 days from the payment, even after the shop deletes the buyer's details or its workspace - The record of Convika's fees (order number, date, amount, fee, shop): kept 7 years, as the law requires. It holds no buyer names or contact details - The record of consents to the card payment terms (workspace, the consenting member's user ID, the terms' version, and the time): kept as the contract record for fees while the workspace exists and 5 years after it is deleted. The user ID stays in this record even if the member deletes their account - AI answer check: the questions, brand names, and domains you save, until you change them or the workspace is deleted; each answer, together with the question as it was asked, the answer's text, cited addresses, and results, for 13 months after it was asked, even if you change or remove the question, or until the workspace is deleted - AI answer check's suggested questions: the questions and brand names the built-in AI returned, until the next suggestions replace them or the workspace is deleted - Redirect of addresses without www: visitors' IP addresses and requests are not stored (the redirect server keeps no access log); each address's certificate stays on the redirect server and is no longer renewed once its domain is disconnected

You have the following rights regarding your personal data:

- Access: View your personal data - Correction: Update inaccurate data - Deletion: Delete your account and associated data - Data Portability: Export your data - Withdrawal of Consent: Revoke previously given consent

To exercise these rights, contact us at tomoya.fujita@fluxenic.com.

A buyer can ask either the shop or Convika to disclose, correct, or delete their details. The shop can delete a buyer's details from the order screen. To ask Convika, email tomoya.fujita@fluxenic.com with the order number. Write to the same address if you can't reach the shop or the shop doesn't respond.

For details on how we use cookies, please see our Cookie Policy.

The Service is not intended for children under 13, and they may not use it (Terms of Service, section 2). If we learn that a user is under 13, we will promptly delete their account and the personal information we have collected from them. If you are under 18, you may use the Service only with the consent of a parent or legal guardian.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on our website. Your continued use of the Service after such notice constitutes acceptance of the updated policy.

Convika is operated by Fluxenic Inc. (株式会社Fluxenic). The business operator that handles your personal information through Convika is:

- Name: Fluxenic Inc. - Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo, Japan - Representative: Tomoya Fujita, Representative Director

Until October 20, 2026, Tomoya Fujita ran Convika as a sole proprietorship. On October 21, 2026, the Convika business passed to Fluxenic Inc. by a business transfer, and with it Fluxenic Inc. took over your personal information. Fluxenic Inc. handles that information only within the purposes it was used for before the transfer (section 2).

If you have any questions about this Privacy Policy, please contact us at tomoya.fujita@fluxenic.com.