Conviflo Privacy Policy

Effective date: July 23, 2026. Last updated: July 23, 2026.

This policy explains how Blackledge Media LLC, doing business as Conviflo (legal@conviflo.com), handles personal information. Conviflo wears two hats, and this policy covers both:

1. Conviflo as controller — for our website visitors and our customers (the businesses that build funnels with us).
2. Conviflo as processor — for respondents: people who fill out a funnel ("Flo") that one of our customers built. For respondent data, the customer whose funnel you used is the controller; their privacy policy governs why your data was collected and how it is used. This section explains what our platform does with it on their behalf.

Part A — Customers and website visitors (Conviflo as controller)

What we collect

• Account data: name, email, password (stored as a hash by our authentication provider), workspace and brand details you enter.
• Billing data: your plan, subscription status, and billing history. Payments are processed by Stripe; card numbers never touch our systems. Charges appear as CONVIFLO.
• Usage data: product actions (e.g., publishing, settings changes), device/browser type, and log data used to operate and secure the Service.
• Communications: support requests and emails you send us.

How we use it

To provide and improve the Service, process payments, provide support, send transactional messages (receipts, security and service notices), send product updates you can opt out of, prevent fraud and abuse, and comply with law. We do not sell personal information.

Sharing

Only with service providers that run the platform (see "Subprocessors" below), professional advisers, or authorities when legally required, or in connection with a business transfer (we'd notify you).

Part B — Respondents (Conviflo as processor)

When you complete a funnel built by a Conviflo customer, the platform processes on that customer's behalf:

• Your answers, including contact details you enter (such as name, email, phone, address). Partial progress is saved as you go, so a customer may receive what you entered even if you don't finish — including contact details once you've provided them.
• Booking details if the funnel offers appointment scheduling (delivered to the customer's calendar system, e.g., GoHighLevel).
• Visit context: page views, funnel progress/drop-off, UTM campaign parameters and referrer, and a per-visit session identifier.
• Lead-value signals: a value the customer assigns to responses for their own ad measurement.
• Spam protection: your IP address is used transiently to rate-limit abuse — we store only a salted hash of it, not the raw address; we also use timing checks and hidden fields. These protections never add marketing data.
• Cookies and trackers: the platform itself stores your cookie-consent choice in your browser (localStorage). Customers may additionally configure third-party tags on their funnel — such as Meta Pixel, Google Tag Manager, or Microsoft Clarity — which set their own cookies under the customer's responsibility. Funnels can show a cookie banner; where the customer enables the accept/decline banner, declining prevents those third-party tags from loading during your visit.

Where your data goes: to the customer who built the funnel, and to destinations that customer configured (their CRM, webhook endpoints, ad platforms' measurement APIs). Conviflo does not use respondent data for its own marketing and does not sell it.

Your rights as a respondent: direct requests (access, correction, deletion, objection) to the business whose funnel you used — they control the data. If you contact us instead at legal@conviflo.com, we will forward your request to that customer and assist them in honoring it.

Subprocessors and service providers

Data is hosted and processed primarily in the United States.

Security

Access to customer data is scoped by row-level security; public funnel traffic can only read published content; submissions are written server-side through hardened endpoints; webhooks are signed; server-side secrets are never sent to browsers. No system is perfectly secure, but security is designed in, not bolted on. If a breach affects your personal information, we will notify you as required by law.

Retention

• Account and billing records: for the life of the account and as required for tax/legal purposes.
• Respondent data: retained while the customer's account holds it — customers control deletion of their Leads. After account termination, data is deleted in the ordinary course following the export window described in the Terms (30 days).
• Salted IP hashes for rate limiting: used only as short-window abuse counters; they are never joined to marketing or profile data.

Children and health information

The Service is for business use, and funnels must not target or knowingly collect data from children under 13. The Service is not a HIPAA-compliant environment: we do not sign Business Associate Agreements, and Protected Health Information must never be collected through it.

A United States service

Conviflo is operated from the United States, processes data in the United States, and is directed to United States businesses and audiences. We do not target the Service to, and it is not intended for use by, residents of the European Economic Area or the United Kingdom, and we do not offer a Data Processing Addendum or Standard Contractual Clauses. California residents: we do not sell or share personal information as defined by the CCPA/CPRA; the rights described above are available via legal@conviflo.com.

Changes and contact

We'll post updates here and, for material changes affecting customers, give notice by email or in-app. Questions and requests: legal@conviflo.com · Blackledge Media LLC (d/b/a Conviflo), United States.