Privacy Policy

Conversion Protocol ("we", "us", "our") operates the website conversionprotocol.ai and the Conversion Protocol Chrome extension (together, the "Service"). The Service provides AI-powered SEO and conversion-rate-optimization audits of public web pages.

For privacy questions, contact us at john@johnstewart.ai.

Account information. When you sign up, we collect your email address and an encrypted password. Optionally, your name.

Authentication tokens. After login, an access token is stored locally in your browser (web app) or in chrome.storage.local (extension) to keep you signed in. It is never shared with third parties.

Website content you audit. When you submit a URL or trigger an audit from the extension, we fetch the public content of that page (HTML, text, images, metadata) and pass it to our analysis pipeline and large language model providers. We store audit results, scores, and the source URL in your account.

Payment information. Paid plans are processed by Stripe. We never see or store your card details — only a customer ID and subscription status.

Usage data. Standard server logs (IP, user agent, timestamps) and product analytics for security, billing limits, and improving the Service.

What we do NOT collect. No browsing history, no keystroke or click tracking, no location data, no health or financial information beyond Stripe customer IDs, no personal communications.

• To run audits, generate AI rewrites, and return results.
• To authenticate you and keep your session active.
• To enforce free-tier and paid-tier usage limits.
• To process payments and manage subscriptions via Stripe.
• To send transactional emails (password resets, billing, signup confirmation) via Resend.
• To monitor security, debug issues, and improve the Service.

We do not sell your data, use it for advertising, train public AI models on it, or use it to determine creditworthiness or for lending purposes.

We rely on the following processors to operate the Service. Each is bound by their own privacy policy and a data-processing agreement where applicable:

• Supabase — authentication, database, and backend functions (US/EU hosting).
• Stripe — payment processing.
• Firecrawl — fetching public page content for audits.
• Google (Gemini) and OpenAI — large language model inference for analysis and copy generation. Audit content is sent to these providers and is not used by them to train public models.
• Resend — transactional email delivery.
• Lovable / Vercel-class hosting — static site hosting and edge runtime.

The Conversion Protocol Chrome extension requests these permissions, and only for these reasons:

• activeTab, tabs, scripting — to read the current page's URL and DOM when you explicitly run an audit, inspect an element, or toggle the heatmap overlay.
• storage — to keep your session token and audit history locally.
• host_permissions: <all_urls> — required so the extension can audit any page you choose to audit.

Page content is only sent to our servers when you explicitly trigger an action (audit, inspect, extract, compare). The extension does not track your browsing in the background. URL hashes are checked against our patches database only when you navigate, to apply saved page improvements you previously created.

Account data is retained until you delete your account. Audits and reports are retained until you delete them or close your account. Server logs are retained for up to 90 days. Stripe billing records are retained as required by tax and accounting law (typically 7 years).

Depending on your jurisdiction (GDPR, CCPA, UK GDPR), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing.

To exercise any of these, email john@johnstewart.ai. We respond within 30 days.

Data is encrypted in transit (TLS) and at rest. Database access is gated by row-level security policies so users can only see their own audits. Passwords are hashed by Supabase Auth. We do not store payment card data.

Our processors may store data in the United States and the European Union. By using the Service, you consent to this transfer.

The Service is not directed to anyone under 16. We do not knowingly collect data from children.

We may update this policy. Material changes will be announced via email or an in-app notice at least 7 days before they take effect. The "Last updated" date at the top reflects the latest revision.

Questions, requests, or complaints: john@johnstewart.ai