Privacy Policy

Last updated 2026-11-04 (UTC)

This policy covers this website and the ConversionCat API, CLI and routing file. ConversionCat is operated by the ConversionCat team ("we"). We act as controller for data about visitors of this website and as processor for the data our customers send us about visitors of their own sites.

What we collect

• Visitor records. A random visitor id (the ccat_vid cookie), the variants shown, a session marker, the conversion events of the experiment, and segment values: device class (mobile or desktop), country code from the hosting network, new or returning.
• Traffic source. UTM tags, the name of an ad click id parameter (for example gclid, never its value), and the referring host name.
• Wallet links. When a customer site links a visitor to a wallet address, we store the address and read public Robinhood Chain data about it to credit onchain goals.
• Projects. A project name, a hashed project key, experiment settings, usage counters and USDG payment transactions.

We do not collect names, email addresses or IP addresses, and we do not use the data to build profiles across sites. The same visitor on two customer sites gets two unrelated ids.

Why, and on what basis

To route visitors, measure conversion rates and attribute them to sources (legitimate interest of the site owner in measuring its own pages, or consent where the site asks for it), to bill usage (contract), and to keep the service secure (legitimate interest).

Retention

Assignment cookies last 90 days and the visitor id cookie one year. Records stay as long as the project exists; deleting a project deletes its records within 30 days. Payment records are kept as long as accounting law requires.

Processors

Vercel (hosting and the routing runtime), Neon (Postgres database) and the public Robinhood Chain RPC. Data may be processed in the United States under standard contractual clauses.

Your rights (GDPR)

You can access, correct, erase or export your data, restrict or object to processing, and complain to your data protection authority. Refusing cookies in the banner sets ccat_optout; you then see the default page and nothing is recorded. Browsers sending Global Privacy Control get the same treatment. For requests about a customer site, contact that site first; the site owner can delete a whole project at once with its key (see the FAQ in the docs). To reach us, write to our X account.

Changes

We will post changes here with a new date. See also the Cookie Policy and the Terms.