Privacy Notice

FlowScan is operated by Convert Scale Ltd (Конвърт Скейл ООД), the data controller, registered in Bulgaria, EU — ul. Balgarska Morava 64, fl. 3, Vazrazhdane, Sofia 1303; company / UIC number (EIK) 208747277. Data-protection contact: [email protected] (general support: [email protected]).

This notice explains what we collect, why, and what we do with it. Because we sometimes obtain personal data about a business contact without collecting it directly from that person, we provide this notice under Article 14 GDPR (and Article 13 where you submit a page yourself). Public accessibility of data does not make it unregulated.

Two scan modes. Mode A — you submit a URL (Art. 13). Mode B — we scan a publicly advertised page we discovered ourselves via public ad libraries (Art. 14). In both modes we may submit the page's public, login-free lead form using a generated alias email on a domain we own plus fictional, non-real placeholder data, then monitor that alias inbox to grade the follow-up sequence. We never create accounts, never log in, never bypass logins or paywalls, and never submit payment or checkout forms. The source of Mode-B data (Art. 14(2)(f)) is publicly accessible advertiser pages and public ad libraries operated by ad platforms. For outreach we use the business contact address published on the business's own website.

What we collect

• URLs you submit for scanning and the publicly-rendered page content our scanner captures.
• During a scan, FlowScan renders the page in a browser and captures a temporary image (screenshot) of it as part of automated analysis. These images are never published; shown only inside the report for that scan, and they are covered by the same retention rule as the scan record they belong to.
• When we scan a page, we keep a copy of its visible text, a list of the web addresses it loads, and a picture of its first screen on a phone, for up to 18 months, so we can measure pages over time and improve our checks, and we show that picture of the first screen inside the report for that page. We never publish these copies. We don't keep them for health or medical pages. A business can ask us to delete them at any time through the privacy contact above.
• Your email address so we can deliver your report and related correspondence.
• Intake uploads you choose to share — screenshots, CSV exports, ad creatives, documents — for analysts preparing your audit or strategy session.
• Google Analytics data, if you choose to connect it. Connecting is optional; you can upload a CSV export instead. With read-only access to the one Google Analytics 4 property you pick, we read the last 90 days once, as four summary reports: traffic sources, landing pages, device types and conversion events. These are totals about your website, not data about individual visitors. We use them only to prepare your own audit and strategy brief, which we draft with Microsoft Azure OpenAI acting as our processor. They are kept with your order and never sold, used for advertising, or combined with other customers' data. Right after that one read we hand the access back to Google and keep no Google credentials. Until then you can disconnect on your intake page, and you can ask for the data to be deleted at [email protected]. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• How a report page is used. When a FlowScan report is opened we record on our own servers that it was opened and how the visit arrived (an email link, a campaign link, another website, or directly), how long it was on screen, how far it was scrolled, which findings came on screen, which finding was expanded and which of its buttons were used, with the browser's user-agent string and a random identifier for that page visit (your IP address is not kept with it). Each record is linked to the report, and so to the business and the address the report was sent to. We use it to tell people apart from automated email-security scanners and to see whether reports are useful. Our own team's views of a report are marked as ours and left out of every count. Nothing is stored on your device for this: the identifier lives only in the page's memory while the page is open and is gone when you close or reload it, which is why this recording runs whatever you choose in the cookie banner. The link to the report is removed when the scan record is deleted, 18 months after the scan; the unlinked record of what was done on the page is not deleted.
• Payment metadata (order ID, plan, amount) via Stripe. We never see or store card numbers.
• Booking details if you schedule a session via Calendly.

When you buy something. At checkout we record the country of your billing address, the country of your payment card, your IP address and the country we derive from it, and the date and time you accepted our terms. We keep these together with the invoice because tax law requires us to show which country a sale belongs to, and because a payment record must be kept complete and unchanged. On our accountant's advice we keep it for ten years from 1 January of the year after the sale (we are established in Bulgaria). If the sale is later corrected, refunded, or a dispute about it is resolved, the ten years run from 1 January after that instead. We keep it longer while a tax inspection, audit, court case, chargeback or correction concerning that sale is still open. We use them for nothing else. They are not shared with anyone except our payment processor (Stripe), our accountant, and the tax authorities when required.

Why we collect it

Everything above is used to produce your funnel audit and strategy brief, deliver it to you, handle billing, and provide customer support. Our lawful bases are contract performance (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) — operating a B2B funnel-intelligence product; a Legitimate Interests Assessment (LIA) is on file and a summary is available on request. Cold B2B outreach also relies on Art. 6(1)(f), subject to your absolute right to object. Aggregated data, once irreversibly anonymised, falls outside GDPR. We do not use your data to train external models and we do not sell it.

How long we keep it

• Identifier-bearing scan / outreach records: active period up to 18 months, then irreversibly anonymised (identifiers stripped and the linking key destroyed).
• Inbound alias-inbox emails: transient; deleted after grading (maximum 30 days).
• Suppression (opt-out) list: kept indefinitely but minimal, solely to honour objections.
• Aggregated anonymised benchmark data: kept indefinitely (non-personal).
• Payment and invoice records, including the location evidence described above: ten years from 1 January of the year after the sale, on our accountant's advice under Bulgarian accounting and tax rules (if the sale is later corrected, refunded, or a dispute about it is resolved, the ten years run from 1 January after that) — extended while a tax inspection, audit, court case, chargeback or correction concerning the sale is still open — and then deleted.

Who we share it with

We share the minimum necessary with service providers that help us run FlowScan:

• LLM providers (for generating analysis and brief content from scan + intake data).
• Email provider (Resend) for delivering your report, sequence, and transactional mail.
• Stripe for payment processing.
• Calendly if you book a strategy session.
• Microsoft (Clarity) for the session recording described below, if you accept analytics cookies.
• Google (Analytics 4 and Tag Manager) for the site-usage measurement described below, if you accept analytics cookies.
• Meta (the Meta Pixel), when we run Meta ads, for the advertising measurement described below, if you accept marketing cookies.
• Hosting and infrastructure providers that run our servers.

We do not sell your data to advertisers, brokers, or anyone else.

Cookies, analytics and session recording

We use Microsoft Clarity to record anonymised session interactions — clicks, scrolling and page navigation — so we can see where this site confuses people, and Google Analytics 4 to measure page views and site usage, loaded through Google Tag Manager as the container. If you are in the EEA, the UK or Switzerland, or we cannot tell where you are, none of them load unless you accept analytics cookies. Everywhere else, until you make a choice in the cookie banner, we measure visits without cookies, on the basis of our legitimate interest in knowing how this site is used: Google Analytics 4 runs with Google's Consent Mode denying all storage, so it sets no cookie and receives only cookieless pings (no advertising use); Clarity does not run until you accept, wherever you are. Choosing Reject, or a Do Not Track signal from your browser, turns this off: that is your right to object (Art. 21 GDPR), and it is honoured at once. We tell where you are from the country Cloudflare attaches to your request; our server keeps no record of the IP address that request came from. Our web server also keeps ordinary access logs (your IP address, the full address you requested, the page you came from, the time and your browser) for security: they are deleted from the server after 15 days, and the copies inside our nightly server backups are normally gone within a week after that. Accepting analytics cookies loads Clarity and lets both use cookies; you can change or withdraw that choice at any time from the cookie settings on this site. Clarity is set to mask what you type into form fields. Recordings are kept for 30 days; after that Microsoft keeps a small sample (1% of recordings, or 10 a day) for up to 9 months, then deletes it. We do not use recordings to identify individuals. Microsoft acts as a processor for this and its own privacy statement applies to the data it holds.

When we run Meta ads, we use the Meta Pixel (Meta Platforms Ireland Ltd.), loaded through Google Tag Manager, to measure that advertising: page views, starting a scan and asking for a report by email. It loads only after you accept marketing cookies, and we send Meta nothing from our servers (no Conversions API). Meta's own privacy policy applies to the data it receives.

Do not sell or share my personal information

We do not sell personal information. Advertising tags (the Meta Pixel, and the information our servers send Meta) run only after you accept marketing cookies, in every region. If you use the "Do not sell or share my personal information" link at the foot of our pages, or your browser sends a Global Privacy Control signal, we treat it as an opt-out of any sale or sharing: advertising stays off on that device even if you accept marketing cookies, and a marketing choice you gave before is withdrawn.

Your rights

You can ask us to show you the data we hold about you, correct anything that is wrong, or delete it entirely; you may also restrict or object to processing, and request portability. Email [email protected] from the address on file and we will action the request within one month. You have an absolute right to object to direct marketing (Art. 21(2)) — we stop immediately and add you to the suppression list. You can also unsubscribe from the link in any email we send.

Contact & complaints

Convert Scale Ltd — [email protected] (general support: [email protected]). You may also complain to the Bulgarian Commission for Personal Data Protection (CPDP) — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; [email protected]; +359 2 915 3580; cpdp.bg — or your own EU / EEA supervisory authority.