1. Data controller

We are the data controller for the processing of the personal data we receive about you. You will find our contact details below:

Konverto Performance ApS
Company reg. no. (CVR): 45602052
Address: Dunkerquegade 17, 2th, 2150 Nordhavn, Denmark
Email: support@konverto.dk

If you have questions about our processing of your personal data, you are always welcome to contact us.

2. Purposes of the processing

We process personal data for the following purposes:

2.1 Lead handling and customer service

When a potential customer fills in a contact form, for example via Facebook Lead Ads or TikTok lead forms, we process the information in order to contact that person and deliver the requested service. The legal basis is GDPR article 6(1)(b) (performance of a contract) and (f) (legitimate interest in responding to enquiries).

2.2 Email communication and automation

We use automated systems to handle email correspondence on behalf of our customers. This includes receiving, categorising and replying to emails. The legal basis is GDPR article 6(1)(b) (performance of a contract with our customers) and (f) (legitimate interest in efficient customer service).

2.3 SMS communication

We send SMS messages to leads and customers as part of the follow-up process. SMS is only sent where there is an existing customer relationship or consent. The legal basis is GDPR article 6(1)(a) (consent) or (f) (legitimate interest based on an existing customer relationship).

2.4 Software-assisted communication

We use artificial intelligence from OpenAI (OpenAI LLC) and Anthropic (Anthropic PBC), both in the USA, for: drafting suggested replies to email and SMS, assessing enquiries, support chat, analysis of customers' websites, transcription and analysis of phone calls, building company profiles from public sources, and extracting appointments from emails. In that connection, names, message content, email and SMS text, phone numbers, audio recordings of calls and company information may be processed. Data is transferred encrypted (TLS) to the providers' APIs. Under OpenAI's and Anthropic's standard terms for their APIs, data is not used to train their models. The legal basis is GDPR article 6(1)(f) (legitimate interest in efficient communication and quality assurance).

This also includes your AI assistant getting to know your own business from your website, your ads and your own conversations, including automatic assessment of finished conversations, as described in section 13.3.

2.5 Telephony and call recording

Our platform includes telephony via Twilio. When a lead calls your company's dedicated phone number, or when a lead is called from our dialer, the conversation is recorded (both parties). The recording is stored with Twilio in the USA, and an audio URL as well as a transcription is stored in our system. The transcription is made by OpenAI (Whisper) and may be analysed by AI for the purpose of summaries, quality assessment and follow-up suggestions. For incoming calls, your company can choose to play a spoken message stating that the call is recorded. For outgoing calls no automatic message is played, and it is the person placing the call who is responsible for informing the other party about the recording. We process the following: phone numbers, audio recording, transcription, call duration, direction and time. The legal basis is GDPR article 6(1)(f) (legitimate interest in documentation and quality assurance).

3. What personal data do we process?

We process the following categories of personal data:

3.1 Contact details

Name, email address, phone number, address and company information (including company registration number).

3.2 Communication data

Content of emails and SMS messages, times of communication and reply history.

3.3 Lead data

Information collected via contact forms, including which service is requested, the time of the enquiry and the source (for example Facebook Lead Ads or TikTok lead forms).

3.4 Connected integrations

If you connect email services, we may process:

• Gmail metadata and email content
• Outlook metadata and email content
• Email from other providers (via IMAP/SMTP)

3.5 Automatically collected data

Cookies, IP address, browser type, device information, interaction logs and authentication tokens. See section 15 on cookies below.

3.6 Mobile app - push notifications

When you install our mobile app and allow notifications, we collect and store a unique device token that is used to send you relevant notifications (for example about new emails, bookings or chat replies). The token cannot be used to identify you across apps or websites. You can turn notifications off at any time in your device settings.

For sending push notifications we use:

• Firebase Cloud Messaging (FCM, Google LLC) for both iOS and Android. On iOS, Firebase passes the notification on to the Apple Push Notification Service (APNs).

3.7 Mobile app - technical data

Our mobile app automatically collects the following technical data:

• Device type and model
• Operating system and version (iOS/Android)
• App version
• Pseudonymous diagnostic and stability data (crash reports) that may contain technical identifiers and that is processed by Sentry in order to improve the app's stability

This data helps us ensure the app's stability and improve the user experience. We do NOT collect precise location data, contacts, photos or other data from your device without explicit permission.

4. Recipients of personal data

We disclose or entrust personal data to the following categories of recipients:

4.1 Data processors

We use a number of data processors who process personal data on our behalf. We have entered into data processing agreements with all of our data processors to ensure that your data is processed securely and in accordance with the GDPR. Our main data processors are:

• Supabase Inc. (database and data storage), USA, with EU SCCs
• OpenAI LLC (AI-assisted communication), USA, with EU SCCs
• Anthropic PBC (AI-assisted extraction of appointments from email), USA, with EU SCCs
• Twilio Inc. (SMS, telephony, call recording and provisioning of phone numbers), USA, with EU SCCs
• Google LLC (email integration via the Gmail API, calendar integration via the Google Calendar API, push notifications via Firebase Cloud Messaging and Google Analytics), USA, with EU SCCs
• Microsoft Corporation (email and calendar integration via Microsoft Graph), USA, with EU SCCs
• Meta Platforms (lead collection and ad measurement), USA, with EU SCCs
• Resend Inc. (transactional emails, for example welcome emails and notifications), USA, with EU SCCs
• Functional Software, Inc. (Sentry) (error and stability monitoring on web and in the app), USA, with EU SCCs
• Hostinger International Ltd. (web hosting and server infrastructure), Lithuania (EU)
• Stripe Inc. (payment handling and subscription management), USA, with EU SCCs

4.2 Our customers' businesses

When we process leads on behalf of our customers, the relevant information is passed on to the business in question, which is an independent data controller for the further processing.

If a customer connects their TikTok ad account, we receive leads from the customer's TikTok forms. TikTok processes the information as an independent controller under the customer's own agreement with TikTok.

5. Transfers to third countries

Some of our data processors are located in the USA (including OpenAI, Anthropic, Supabase, Twilio, Google, Microsoft, Meta, Resend, Sentry and Stripe). We ensure that the transfer takes place in accordance with the GDPR by using the European Commission Standard Contractual Clauses. We have assessed that there are adequate safeguards for the protection of your personal data.

6. Storage of personal data

We store your personal data for as long as it is necessary to fulfil the purposes for which it was collected. Specifically, the following applies:

• Lead data: Deleted after 24 months without activity, unless a customer relationship arises
• Email correspondence: Stored for up to 5 years for documentation purposes
• SMS logs: Stored for 12 months
• Call recordings and transcriptions: Stored for as long as the account is active and the associated lead exists. They are deleted when the associated lead is deleted (including by the automatic lead deletion after 24 months) or when the account is deleted.
• Device tokens for push notifications: Stored for as long as the account is active and deleted when the account is deleted.
• Removed team members: The name, email address and phone number of a team member who has been removed from a company account are deleted 90 days after the removal.
• What the AI has learned: Follows the lead it was learned from. Examples are deleted 12 months after the oldest message they are based on at the latest. Everything is deleted when the account is deleted
• TikTok deliveries: The content of the raw delivery from TikTok is deleted after 30 days. The lead itself follows the rule for lead data.
• Accounting records: Stored for 5 years pursuant to the Danish Bookkeeping Act
• Webinar sign-ups: Deleted 30 days after the webinar, or 24 months after it if you have consented to emails after the webinar. See section 18.

Users may request deletion at any time.

7. Your rights

Under the General Data Protection Regulation you have a number of rights in relation to our processing of information about you:

• Right of access: You have the right to obtain access to the data we process about you, as well as a range of further information.
• Right to rectification: You have the right to have inaccurate data about yourself corrected.
• Right to erasure: In special cases you have the right to have data about you deleted before the time of our ordinary general deletion.
• Right to restriction: In certain cases you have the right to have the processing of your personal data restricted.
• Right to object: You have the right to object to our processing of your personal data, including to marketing.
• Right to data portability: In certain cases you have the right to receive your personal data in a structured, commonly used and machine-readable format.

You can exercise your rights by contacting us at support@konverto.dk.

8. Complaint to the Danish Data Protection Agency

You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you are dissatisfied with the way we process your personal data. You will find the contact details of Datatilsynet at www.datatilsynet.dk.

9. Security

We have implemented appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes encryption of data in transit (TLS/HTTPS), encryption of sensitive tokens and passwords at rest, access restriction at database level (Row Level Security), regular security updating of systems and ongoing monitoring for security incidents. Our database is hosted with a provider that encrypts storage at disk level.

10. Responsibility for communication

Konverto provides a technical platform for automated communication. Customers are fully responsible for content, accuracy, compliance, legal basis, required consent, marketing legislation and email and SMS rules. Konverto cannot be held liable for communication sent via the platform.

For telephony, the customer is responsible for informing the other party that the conversation is being recorded, to the extent required by law. For incoming calls the customer may choose to have an automatic message about the recording played. For outgoing calls no automatic message is given, and the customer must inform the other party about the recording.

11. Role as data processor

Konverto acts as data controller for users visiting our website, and as data processor for customers who use our system to process leads and communication.

When Konverto is used to send messages to leads, the customer remains the data controller and Konverto acts solely as data processor under the instruction of the customer and in accordance with the GDPR and the data processing agreement.

12. Changes to the privacy policy

We reserve the right to update this privacy policy. In the event of material changes we will inform you by email or on our website. The latest version will always be available at konverto.dk.

13. Email API Services - limited use

Our use of information received from email APIs complies with the respective provider's limited use requirements.

13.1 Supported providers

• Google Gmail (via the Gmail API)
• Microsoft Outlook (via the Microsoft Graph API)
• Other providers (via IMAP/SMTP)

13.2 What data we access

• Reading and sending emails on behalf of the user
• Email metadata (sender, recipient, subject, time)
• Email content for processing and replying

13.3 How data is used

• To send and receive emails as part of our automated communication platform
• Data is used solely for the purposes the user has approved
• Emails are processed so that your AI assistant can reply to them
• Conversations with your leads are also used so that your AI assistant gets to know your own business, as described below. The only purpose is to improve the replies your leads receive

Your AI assistant gets to know your business

Your AI assistant continuously gets to know your business, so that the replies to your leads become more accurate and sound more like your business. This happens automatically and requires nothing from you. What the AI learns about your business is used only in replies for your own business. The only exception is anonymous figures about the form of the conversations, for example how long the messages are and in which order things happen. We may use these across businesses, but only when our agreement with you covers it, and they never contain text from the conversations. We never use what the AI learns to train general AI models or for advertising, and we do not sell it.

Your website and your ads are the source of truth

Facts about your business, such as prices, promises, service area and jobs your business does not take on, are taken by the AI only from your website, your ads, the information you have entered yourself, and your own answers to our questions. Facts are never learned from conversations with leads. We read the public pages of your website again every week, and a piece of information is used only if it appears word for word on the page. If you remove information from the page, the AI stops using it after the next reading. We retrieve your ads through your Facebook connection and from Meta's public Ad Library. The website and the ads are also used to match your business's tone, for example how short and how informal the writing is.

Your own conversations provide examples and reveal gaps

The AI learns from your own written conversations with leads:

• what your leads typically ask about, and which words they themselves use for the job
• examples of replies that worked, because the lead replied, said yes or booked a time
• examples of replies that did not work, and conversations where the AI and the lead misunderstood each other. We use these only to test the AI before a change is put into use. The AI does not see them when it writes
• questions from your leads that your website does not answer

Before an example is stored, we remove names, phone numbers, email addresses, addresses, licence plates, company names, times, dates and prices, or replace them with placeholders. From phone calls we use only the fact that a call took place, when and for how long. The content of the call and the voice are not used. Test leads are not counted. Every example is checked automatically before it is put into use, and is removed again automatically if the AI's replies afterwards show signs of getting worse, for example more misunderstandings or more leads opting out.

Automatic assessment of conversations

When a conversation has ended, an AI model automatically assesses how it went, and whether a lost lead was due to the AI's reply or to something on the lead's side. The assessment is made with AI from OpenAI as described in section 2.4. It is used only to find the examples mentioned above and to monitor the quality of the AI's replies. The assessment is about the AI and not about the lead. It is never used to make decisions about the lead and does not change how the lead is treated.

Our staff may read an individual conversation to check that an assessment is correct. Conversations we have received through Gmail are read by a member of staff only if you have given permission.

Questions for you

If a lead asks about something your website does not answer, your AI assistant may put the question to you, so that it can answer correctly next time. We ask rarely and never about something your website already answers. You do not have to answer. If you do, the answer is stored in your knowledge bank and used in the AI's future replies. The question may include the lead's own question. If the lead is deleted, questions containing the lead's name, email, address or phone number are deleted as well.

Deletion of what has been learned

• Examples and anything else learned from a conversation are deleted together with the lead. Examples are deleted 12 months after the oldest message they are based on at the latest, also when they come from email
• If you disconnect your Facebook connection, or Meta asks us to delete your data, we immediately delete the ads we retrieved through the connection and everything the AI has derived from them, and the tone is recalculated from your website. A nightly job also deletes anything still belonging to a connection that no longer exists
• Ads in Meta's public Ad Library are public and may still be used, also after you have disconnected your Facebook connection
• If you disconnect your email, examples already learned from conversations with your leads remain and are deleted together with the lead as described above
• Your website is public, and there is no connection to disconnect. If you remove a page, its information disappears at the next weekly reading
• If you stop being a customer, or delete your account, everything the AI has learned about your business is deleted
• You can ask us at any time to switch off the learning for your business. The AI then no longer uses what it has learned in its replies
• Data from Google services is also used here only within the requirements in section 13.7

13.4 Storage and security

• OAuth tokens (Google/Microsoft) and IMAP/SMTP passwords are encrypted with strong encryption (AES) and stored securely in the database
• Email content is only logged to the extent necessary to maintain conversation history
• Tokens and passwords are deleted automatically when the user disconnects the integration

13.5 Sharing of data

• Email data is not shared with third parties beyond the data processors listed in section 4
• Data is transferred to AI services (OpenAI and Anthropic) for generating replies, transcription and analysis of communication as described in section 2.4

13.6 Deletion

• Users can disconnect the email integration via the platform at any time
• On disconnection, all tokens and passwords are deleted immediately
• Conversation history is deleted automatically when the user's account is deleted, or on request pursuant to section 7

13.7 Google API Services

Our use of Google APIs complies with Google's Limited Use Requirements.

13.8 Microsoft API Services

Our use of the Microsoft Graph API complies with Microsoft's API Terms of Use.

13.9 Calendar integration

You can connect your own calendar at Google, Microsoft or Apple, so your AI assistant can see when you are busy. The connection is used for reading only. The following applies to calendar data:

• Providers: Google Calendar via the Google Calendar API with read-only access to events and to the list of calendars (calendar.events.readonly and calendar.calendarlist.readonly), Microsoft Outlook via the Microsoft Graph API with read-only access (Calendars.Read), and Apple iCloud via CalDAV with an app-specific password that you create yourself at Apple. Technically the password also allows writing, but we only use it to read
• What we read: the email address of the connected account, the list of calendars on the account (id, name, colour, owner and what access you have to it) and, only in the calendars you choose, each event's start and end time, title, event type (for example birthday or working location), whether it is marked as busy or free, whether it is cancelled, your own response to an invitation, the organiser (email address and, at Microsoft, name) and the event's id. Apple's iCloud always sends the whole event, but we only use these fields. We read from 90 days back and as far ahead as your AI assistant may book, at least 30 and at most 365 days
• Why: the busy times are blocked, so your AI assistant never offers or books a time on top of an appointment you already have, and they are shown in the calendar in your account, so you have the overview. Event type, status, response, organiser and id are only used to filter: free, cancelled and declined events, birthdays, working location and events Gmail added by itself do not count as busy, and bookings already in your account are not counted twice
• What we store: the email address of the account, the calendar list, which calendars you have chosen and, for each busy event, the date, start, end, title (at most 120 characters) and the colour of the calendar. Organiser, response and id are not stored. Description, location, the names and addresses of attendees and attachments are never stored, and at Google and Microsoft we do not fetch them at all
• How long: while the connection works, the busy times are kept up to date every minute, at Google and Microsoft also immediately when the provider reports a change, and events more than 90 days in the past are deleted automatically. Everything else is only kept for as long as the calendar is connected
• We never create, change or delete anything in your calendar through this connection. If new bookings appear in your calendar, they arrive as an ordinary invitation, not through this connection
• Titles and other details from your calendar are not sent to AI services. Your AI assistant is only told which times are free
• We do not sell calendar data, do not share it with third parties and never use it for advertising or to train AI models. It is only stored in our database at Supabase (see section 4)
• Access keys (OAuth tokens) and Apple's app-specific password are encrypted with AES-256 before they are stored, and they are never sent to your browser or app
• Deletion: when you press Disconnect under Integrations, we immediately delete the access keys, the email address, the calendar list and all busy times from the calendar, and we ask the provider to stop its change notifications. If the account is deleted, all calendar data is deleted at the same time. You can also remove the access at Google, Microsoft or Apple. We can then no longer read the calendar, but the times we have already stored remain and still block until you disconnect in the app or delete the account
• The use and transfer of information received from the Google Calendar API adheres to the Google API Services User Data Policy, including the Limited Use requirements, as described in 13.7. The use of the Microsoft Graph API follows 13.8

14. SMS API Services

14.1 Provider

We use Twilio (Twilio Inc.) for sending and receiving SMS messages and for telephony. Twilio is located in the USA, and the transfer takes place on the basis of the European Commission Standard Contractual Clauses (EU SCCs).

14.2 What data we process

• Phone numbers
• SMS content
• Time of sending and receiving

14.3 Storage

• SMS logs are stored for 12 months
• When a user account is deleted, all SMS history is deleted

15. Cookies

We use cookies on our website to ensure that the platform works correctly and to improve your experience. On your first visit a cookie banner is shown where you can choose which cookies you accept.

15.1 Necessary cookies

These cookies are necessary for the website to work and cannot be switched off in our systems. They are usually only set in response to actions you take, such as logging in or filling in forms.

• Session cookies: Keep you logged in during your visit. Expire when the browser is closed.
• Authentication tokens: Verify your identity and access to your account. Stored securely and encrypted.
• Cloudflare bot protection (__cf_bm): Set by our hosting provider (Supabase/Cloudflare) when video is streamed from our pages, to protect against abuse and bots. Expires after 30 minutes.
• Calendly (booking calendar): When you open our booking calendar, it is delivered by Calendly LLC in an embedded frame, which sets cookies necessary for the calendar to work. See Calendly’s own cookie policy for details.

15.2 Functional cookies

These cookies make it possible to remember your preferences, such as language and theme (light/dark mode).

15.3 Marketing cookies

These cookies are set only if you give consent via our cookie banner. They are used to measure the effect of our ads and to understand how visitors interact with our website.

• Meta Pixel (Facebook): Used to measure conversions from Facebook and Instagram ads. Sets cookies via the facebook.com domain. Data is processed by Meta Platforms Ireland Ltd. and may be transferred to the USA under the EU Standard Contractual Clauses (EU SCCs). Read more in Meta's privacy policy.

15.4 Statistics cookies

These cookies are set only if you give consent via our cookie banner. They are used to understand how visitors interact with our website so that we can improve the user experience.

• Google Analytics 4 (Google LLC): Used to measure anonymised visit statistics, page views and conversions (signup and demo view). Sets the cookies _ga and _ga_JM6LWGSVQF on the konverto.dk domain. We have enabled IP anonymisation. Data is processed by Google LLC and may be transferred to the USA under the EU Standard Contractual Clauses (EU SCCs). Read more in Google's privacy policy.

15.5 First-party form measurement (konverto.dk)

When you fill in and submit a contact form on our website, we record the information you enter yourself (typically name, email, phone number and your message) as well as which page the form was sent from, so that we can follow up on your enquiry. The measurement is done with a first-party script that sets no cookies and shares no data with third parties. The processing is carried out by Konverto as data controller with the legal basis in GDPR article 6(1)(f) (legitimate interest in being able to respond to enquiries).

15.6 Your choices

On your first visit a cookie banner is shown where you can choose between "Accept all" (including statistics and marketing cookies) or "Necessary only". Your choice is saved so the banner is not shown again. You can change your choice at any time by deleting your cookies in the browser and reloading the page. Necessary and functional cookies do not require consent, as they are necessary for the operation of the website.

For logged-in users we record your cookie choice together with your user ID so that we can document your consent. For visitors who are not logged in, the choice is stored locally in your browser only.

16. Contact

Konverto Performance ApS
Email: support@konverto.dk
Website: konverto.dk

17. Data deletion - mobile app

If you have installed our mobile app and want your data deleted, you can:

1. Log in to the app and go to Settings → Delete account, or
2. Send a request to support@konverto.dk from the email you used to create the account

We process deletion requests within 30 days. Please note: if you delete your account, you lose access to all of your data, including conversation history, contact details and settings.

See also our dedicated page on data deletion at /data-deletion.

18. Webinar sign-ups

When you sign up for a free webinar at konverto.ai/webinar, Konverto Performance ApS is the data controller.

18.1 Purposes and legal basis

• First name and email address: Used to give you a seat and to send you the confirmation, the join link, reminders and the replay. The legal basis is GDPR article 6(1)(b) (performance of a contract).
• Consent to emails after the webinar: Only if you have ticked the box yourself do we use your email address to send you emails after the webinar about Konverto's AI assistant, including offers and future webinars. We store the time and the version of the text you saw, so that the consent can be documented. The legal basis is GDPR article 6(1)(a) (consent). You can withdraw your consent at any time by writing to support@konverto.dk. This does not change the emails we have already sent.
• Where you came from: The page or campaign you came from, and your answer if you tell us where you heard about the webinar, are used to see which channels bring sign-ups. The legal basis is GDPR article 6(1)(f) (legitimate interest in measuring our marketing).
• Hash of your IP address and browser details: We store a hash of your IP address, not the address itself, and your browser's identification (user agent). The hash is used to limit the number of sign-ups from the same network, and both are used to find automated sign-ups. The legal basis is GDPR article 6(1)(f) (legitimate interest in protecting the form against misuse).

18.2 Storage

• The hash and the browser details are deleted 30 days after you signed up.
• The rest of your sign-up is deleted 30 days after the webinar.
• If you have consented to emails after the webinar, we keep your sign-up for 24 months after the webinar, for as long as you have not withdrawn the consent. If you withdraw it, your sign-up is deleted once 30 days have passed since the webinar.

Supabase and Resend process the data as data processors, see section 4. Your rights are described in section 7.