Privacy Policy

This Privacy Policy explains how Conversion Matters ("the Service," "we," "us," or "our") collects, uses, stores, and protects information when you use our content and social media management platform, including our use of Google user data accessed through Google Sign-In and Google Drive integration.

By using the Service, you agree to the practices described in this policy. If you do not agree, do not use the Service.

1. Information We Collect

1.1 Information from Google Sign-In

When you log in with your Google account, we receive:

• Your name
• Your email address
• Your Google account profile picture (if available)
• A unique Google account identifier

We use this information solely to create and manage your account, authenticate your login, and identify you within the Service.

1.2 Information from Google Drive (Limited Scope)

The Service requests access to Google Drive under the restricted drive.file scope. This means:

• We can only access files that the Service itself creates on your behalf, or files you explicitly select and authorize through Google's file picker.
• We cannot access, view, or list any other files in your Google Drive.
• We cannot see your Drive folder structure, other documents, or files unrelated to the Service.

Within authorized files, we read and write content necessary to operate features such as the content calendar, script editor, competitor benchmarking log, and content pillar organization.

1.3 Information You Provide Directly

This includes content you input into the Service, such as scripts, captions, content plans, competitor notes, and any information submitted for AI evaluation.

1.4 Payment Information

New users currently receive free access during this introductory period. Once paid subscription tiers are introduced, payment will be processed by a third-party payment processor (to be named at launch). We do not directly store your full payment card details; the processor will handle this in accordance with its own privacy and security practices.

1.5 Automatically Collected Information

We may collect limited technical data such as login timestamps, browser/device type, and basic usage logs (e.g., which features are accessed) to maintain and improve the Service.

2. How We Use Your Information

We use collected information to:

• Authenticate and manage your account
• Operate core features (content calendar, script editor, benchmarking, content pillars)
• Send your submitted content to Google's Gemini API for AI-assisted evaluation, when you use that feature
• Process subscription billing
• Maintain, troubleshoot, and improve the Service
• Communicate with you about your account, service updates, or support requests
• Comply with legal obligations

We do not sell your personal information or your content to third parties.

3. Google API Limited Use Disclosure

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google user data (including Drive file contents accessed via drive.file scope) to provide and improve the features of the Service that you have directly requested.
• We do not use Google user data for advertising purposes.
• We do not allow humans to read Google user data unless: (a) we have your affirmative consent for a specific case (e.g., support troubleshooting), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized.
• We do not transfer Google user data to third parties except as described in Section 4 (AI Processing) or as required to provide the Service you requested, or as required by law.

4. YouTube API Services

4.1 Our Social Publisher feature uses YouTube API Services to allow you to upload videos directly to your YouTube channel.

4.2 By using our YouTube integration features, you are agreeing to be bound by the YouTube Terms of Service.

4.3 In addition to our normal procedures for deleting stored data, you can revoke our application's access to your YouTube and Google account at any time via the Google security settings page.

4.4 Please refer to the Google Privacy Policy for more information on how Google treats your data.

4.5 We do not collect, store, or share your YouTube channel data (such as views, subscribers, or videos). The API is strictly used in a one-way capacity to upload video files you explicitly submit via our Social Publisher form.

5. TikTok API Services

5.1 Our Social Publisher feature uses the TikTok Direct Post API to allow you to upload videos directly to your TikTok account.

5.2 By using our TikTok integration features, you are agreeing to be bound by the TikTok Terms of Service and the TikTok Privacy Policy.

5.3 You can revoke our application's access to your TikTok account at any time via the TikTok app settings (Settings & Privacy > Security and login > Manage app permissions).

5.4 We do not collect, store, or share your TikTok account data (such as views, followers, or videos). The API is strictly used in a one-way capacity to upload video files you explicitly submit via our Social Publisher form.

6. AI Processing via Gemini API

4.1 When you use the AI-assisted content evaluation feature, the content you submit (e.g., a script or caption) is transmitted to Google's Gemini API for processing and analysis.

4.2 This transmission is separate from your Drive file access and is governed additionally by Google's Gemini API terms and privacy practices.

4.3 We do not use your content submitted to Gemini for training our own models, and we do not retain a separate copy of this content beyond what is necessary to display the evaluation results back to you.

4.4 Avoid submitting sensitive personal data (financial details, health data, government ID numbers, etc.) through the AI evaluation feature unless necessary.

6.5 Bring Your Own Key (BYOK) Data Storage: If you choose to provide your own API key to bypass limits, it is encrypted in transit and at rest using AES-256-GCM encryption. The API key is stored securely in our database and is used exclusively to fulfill your direct AI content generation requests. You can manually delete your API key from our systems at any time via your dashboard settings.

7. File Privacy and Sharing

5.1 All files created through the Service are private by default. No one — including the Conversion Matters team — can view a file's contents unless you actively choose to share it.

5.2 Sharing is entirely controlled by you through Google Drive's native sharing settings. If you share a file (e.g., to collaborate with a client or teammate), those recipients can view or edit it according to the permission level you set.

5.3 You may revoke sharing and revert a file to private at any time. This immediately removes access for previously shared recipients going forward, though we cannot control content that a recipient may have already copied, downloaded, or cached before access was revoked.

5.4 Because your data lives in your own Google Drive, we do not have independent standing access to read your file contents outside of the automated processes needed to operate features you actively use (e.g., saving your calendar edits).

8. Data Storage and Retention

6.1 Your content. Your content data (scripts, calendars, benchmarking logs, etc.) is stored in your own Google Drive, not on our servers, for as long as you maintain those files.

6.2 Account and technical data. We retain account metadata (e.g., login credentials reference, subscription status, usage logs) for as long as your account remains active.

6.3 After account deletion. Upon account deletion, we delete associated account metadata and cached data within 30 days. Your Drive files are unaffected and remain fully under your control, since we never held a separate copy.

6.4 We cannot delete your backup files. Because your content and backup spreadsheet files live in your own Google Drive, we have no ability to delete them on your behalf, including after account cancellation or deletion. If you want these files removed, you'll need to delete them yourself directly in Google Drive.

6.5 Payment records. Billing records may be retained longer where required for tax, accounting, or legal compliance purposes.

9. Data Sharing with Third Parties

We share information only in the following circumstances:

• Google Gemini API — for AI evaluation features, as described in Section 4
• Payment processor — for subscription billing, as described in Section 1.4
• Legal compliance — if required by law, regulation, legal process, or governmental request
• Business transfers — in the event of a merger, acquisition, or transfer of the project, subject to continued adherence to this policy or a comparable one

We do not sell personal data or content for advertising or marketing purposes.

10. Your Rights and Choices

8.1 Revoke Google access. You may revoke the Service's access to your Google account at any time via your Google Account permissions page.

8.2 Access and control your data. Since your content lives in your own Drive, you retain direct access and control over it at all times, independent of the Service.

8.3 Account deletion. You may request deletion of your account and associated metadata by contacting us at claryon.ai@gmail.com.

8.4 Correction. You may update your account information (e.g., name, email) through your account settings or by contacting us.

11. Data Security

9.1 We apply reasonable technical and organizational measures to protect account and metadata we hold, including secure authentication practices for Google Sign-In.

9.2 As an early-stage student project without a dedicated formal security infrastructure, we cannot guarantee absolute security, and no method of transmission or storage is completely secure. Use the Service with this in mind, particularly for highly sensitive client data.

12. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will take steps to delete the associated data.

13. International Data Transfers

Data processed through Google's infrastructure (Sign-In, Drive, Gemini API) may be processed on servers located outside Indonesia, in accordance with Google's own data processing practices.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or via the email associated with your account. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact Us & Business Details

For questions about this Privacy Policy, data handling, or to exercise your rights described above, contact:

Conversion Matters
Email: claryon.ai@gmail.com
Instagram: @conversionmatters
Address: Jalan Sultan Agung 90A, Semarang

16. Cookie Policy

What are cookies? Cookies and local storage are small data files placed on your device to help websites function properly and securely.

How we use them: We use "Strictly Necessary" local storage to keep you logged into your account (via Google/Firebase Auth), remember your last active spreadsheet, and save your UI preferences (like completing the onboarding tour). If you choose to use the BYOK feature, we also temporarily cache your API key in local storage. We do not use any tracking, marketing, or third-party analytics cookies.

Consent: By using the Service and logging in, you consent to our use of these essential functional storage methods as they are required for the App to operate.