Legal
Privacy policy
How CVRLanding collects, uses and protects personal data about its customers and website visitors, and how it handles the data customers collect on their landing pages.
This document is a draft
We wrote it for the CVRLanding preview build. It has not yet been reviewed by legal counsel for the countries we serve, and it will change before launch. It is not legal advice.
On this page
Who this policy covers
This policy explains how CVRLanding handles personal data. We play two different roles, depending on whose data it is:
Controller
- Whose data
Account holders and workspace members, visitors to cvrlanding.com, people who contact support, and billing records
- What applies
This policy
Processor
- Whose data
Visitors, leads, bookings and orders on landing pages that our customers publish
- What applies
The customer’s own privacy notice, and our data processing terms with that customer
| Our role | Whose data | What applies |
|---|---|---|
Controller | Account holders and workspace members, visitors to cvrlanding.com, people who contact support, and billing records | This policy |
Processor | Visitors, leads, bookings and orders on landing pages that our customers publish | The customer’s own privacy notice, and our data processing terms with that customer |
If you submitted a form on a landing page built with CVRLanding, the business that runs that page decides how your data is used. Please contact that business first; we help it respond.
Controller details
The legal entity that operates CVRLanding and acts as controller, with its registered address, will be named here before launch.
What we collect
Account data: your name, email address, password (stored only as a hash), language and security settings such as two-factor authentication.
Google sign-in: if you choose it, the basic profile Google shares, such as your name, email address and account ID. We never see your Google password.
Workspace and usage data: workspaces, roles, invitations, projects, settings and the actions you take in the app, including audit log entries.
Content you submit: prompts, chat messages, imported URLs, uploaded files, brand assets and page content.
Support messages: what you write to us and our replies.
Billing data from Paddle: your plan, subscription status, and transaction and invoice records. Paddle handles your payment details; we never receive full card numbers.
Technical logs: IP address, browser and device details, timestamps and errors, used to run and protect the service.
How we use it
We use personal data to:
provide the service, including building, publishing and measuring pages and running the AI features you request
secure accounts and the platform, prevent fraud and abuse, and keep audit logs
manage subscriptions, credits and billing records with Paddle
answer support requests
send transactional email through Resend, such as verification codes, password resets, billing notices and the lead or booking notifications you set up
improve the product using aggregated usage statistics
meet legal, tax and accounting obligations and enforce our terms
We do not sell personal data.
Legal bases in the EEA and UK
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
Contract
- Used for
Providing your account, workspaces, pages, AI features, billing and support
Legitimate interests
- Used for
Security, fraud prevention, service logs and aggregated product improvement
Consent
- Used for
Anything we ask your permission for, such as optional cookies if we ever add them
Legal obligation
- Used for
Tax and accounting records, and lawful requests from authorities
| Basis | Used for |
|---|---|
Contract | Providing your account, workspaces, pages, AI features, billing and support |
Legitimate interests | Security, fraud prevention, service logs and aggregated product improvement |
Consent | Anything we ask your permission for, such as optional cookies if we ever add them |
Legal obligation | Tax and accounting records, and lawful requests from authorities |
Where another law, such as Vietnam’s personal data protection law, requires your consent for a particular use, we ask for it.
AI providers
When you use an AI feature, we send the AI providers that CVRLanding configures what they need to carry out your request: your prompt, relevant page content and assets and, for conversion analysis, aggregated and redacted metrics.
Personal data of your leads, such as names, phone numbers and email addresses, is not sent to AI providers by default. Please avoid putting personal data into prompts.
Where available, we prefer provider settings that exclude API data from model training. Provider terms differ and change, so we cannot promise this for every provider.
Who we share data with
We share personal data only as needed to run CVRLanding:
Our infrastructure: the service runs on servers we operate, with self-hosted PostgreSQL, Valkey and MinIO. The hosting provider will be named here before launch.
Paddle: processes payments, taxes and invoices as merchant of record, and is an independent controller of the data it collects at checkout.
Resend: delivers our transactional email.
Google: confirms your identity if you choose Google sign-in.
AI providers: as described above.
Ad platforms: Meta, Google and TikTok receive events from a landing page only when the customer who runs it connects their pixels, on that customer’s instructions and subject to the visitor’s consent.
Authorities: when the law requires it.
A successor: if CVRLanding is merged, acquired or sold, under the protections of this policy.
For the data customers collect on their pages, the data processing terms explain how sub-processors are used.
International transfers
Personal data may be processed outside the country where you live, including by the providers listed above. Where the law requires it, we protect these transfers with safeguards such as the European Commission’s standard contractual clauses or the UK equivalent.
Vietnam’s personal data protection rules set their own conditions for transferring data abroad, including an impact assessment. We will meet the requirements that apply to us before launch; this work is not yet complete.
How long we keep data
Account and workspace data
- Kept for
While your account exists, then for a limited period so you can export data and we can resolve disputes
Billing records
- Kept for
As long as tax and accounting law requires
Technical logs
- Kept for
A short period, longer only to investigate a security incident
Support messages
- Kept for
As long as needed to resolve your request
Data your pages collect
- Kept for
As the customer sets in its retention settings; session replays for 14 to 90 days, depending on the plan
| Data | Kept for |
|---|---|
Account and workspace data | While your account exists, then for a limited period so you can export data and we can resolve disputes |
Billing records | As long as tax and accounting law requires |
Technical logs | A short period, longer only to investigate a security incident |
Support messages | As long as needed to resolve your request |
Data your pages collect | As the customer sets in its retention settings; session replays for 14 to 90 days, depending on the plan |
Deleted data remains in encrypted backups until those backups rotate out on their normal schedule.
Security
Our safeguards include:
TLS encryption for data in transit
encryption at rest for sensitive fields such as phone numbers and email addresses, and encrypted backups
isolation between workspaces, enforced in the API, database, storage and background jobs
mandatory two-factor authentication for CVRLanding administrators, and optional two-factor authentication for users
audit logs of sensitive actions, including any support access to a workspace
masking of form inputs and personal data in session replays
No system is perfectly secure, and we do not claim any third-party security certification. If a breach affects your personal data, we will notify you and the authorities as the law requires.
Your rights
Depending on where you live, including Vietnam, the EEA, the UK and parts of North America, you may have the right to:
access your personal data and get a copy
correct inaccurate data
delete your data
receive your data in a portable format
object to or restrict some processing
withdraw consent at any time, without affecting earlier processing
complain to your data protection authority
To make a request, write to support@cvrlanding.com with ‘Privacy request’ in the subject. We may need to verify your identity, and we respond within the time the law requires. You can also export workspace data and delete your account yourself in settings.
Visited a landing page?
If your data was collected on a landing page built with CVRLanding, contact the business that runs that page. It controls your data, and we help it respond to your request.
Cookies
The cvrlanding.com website and the app use only a few cookies and browser storage entries, for language, theme, workspace and sign-in, and set no analytics or advertising cookies in this build. The Cookie policy lists them all.
Children
CVRLanding is a service for businesses and is not directed at children. We do not knowingly collect personal data from children; if you think a child has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy when our practices or the law change. If a change is significant, we tell account holders by email or in the app before it takes effect.
Contact
For privacy questions or requests, write to support@cvrlanding.com with ‘Privacy request’ in the subject.
Questions about this document? Email support@cvrlanding.com.