Privacy Policy

Convertopia is operated by Andrei Sidorenko, an individual trading as HexaDev. For the purposes of the GDPR, Andrei Sidorenko is the data controller.

Privacy enquiries: support@convertopia.it.com

Account data. Your email address, a hashed password, your display name if you provide one, your plan, and the date you registered. If you sign in with Google or GitHub, the account identifier and basic profile information that provider returns.

Files. The files you upload and the converted output they produce.

Technical data. IP address, browser user-agent, timestamps, conversion type and file size. Used to enforce quotas, prevent abuse, and diagnose failures. Where an IP address is used purely to count a daily quota, it is stored as a truncated one-way hash rather than the address itself.

Purchase data. We do not collect or store payment card details. Payments are handled by Gumroad, Inc. as merchant of record. From Gumroad we receive only your purchase email, your plan and subscription status, and an order identifier — enough to give you the access you paid for.

Uploaded and converted files are deleted automatically once your plan’s retention window expires — see the pricing page and our Terms for the current periods. Deletion removes the objects from our storage and is permanent. A scheduled cleanup process runs regularly and storage lifecycle rules act as a backstop.

Account data is kept while your account exists and deleted within 30 days of you deleting your account.

Technical logs are kept for a short operational period and then discarded.

Purchase records are kept for as long as tax and accounting rules require.

We use the following service providers, who process data on our behalf:

• Railway — application hosting
• Cloudflare (R2) — file storage and delivery
• Gumroad, Inc. — payment processing and merchant of record

We do not sell your personal data. We do not share it for advertising or profiling. We may disclose data where we are legally required to.

Some of the providers above are based outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, those transfers are covered by the safeguards those providers make available, such as standard contractual clauses.

If you are in the EEA or UK you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on it;
• complain to your national data protection authority.

To exercise any of these, email support@convertopia.it.com from the address on your account. We respond within one month.

Traffic is encrypted in transit over HTTPS. Passwords are stored hashed, never in plain text. The storage bucket is private and never publicly readable: downloads are served either through our own authenticated endpoint or through a signed, time-limited link. Access to production systems is restricted.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as the law requires.

We use cookies that are strictly necessary to keep you signed in and to keep your session secure, plus one that remembers your light or dark theme preference. These do not require consent. If we add analytics or other non-essential cookies in future, we will ask for your consent first and update this page.

The Service is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. Material changes will be announced by email or a notice on the site before they take effect. The date at the top always reflects the current version.