Digital24 LTD — convert24.co
Last updated: 24 August 2026
1. Introduction
This Privacy Policy explains how Digital24 LTD collects, uses and protects your personal data when you use https://convert24.co and app.convert24.co (the “Service”).
We comply with the EU General Data Protection Regulation (GDPR) and, as a company established in the United Kingdom, with the UK GDPR and the Data Protection Act 2018.
2. Who is responsible for your data
Data Controller
Digital24 LTD
Registered in England and Wales, company number 12728844
Kemp House, 160 City Road, London EC1V 2NX, England
Email: info@convert24.co
3. What we collect
3.1 Information you give us
- Name
- Email address
- Account credentials (password stored in hashed form)
- Subscription status and billing history
3.2 Payment information
Payments are processed by Stripe. We do not receive or store your full card number. We hold a payment reference, the last four digits, the card brand and the country. Stripe acts as an independent controller for the payment data it processes.
Stripe Privacy Policy: https://stripe.com/privacy
3.3 Technical and usage data
- IP address
- Browser and device type
- Time zone
- Approximate location at country level
- Pages viewed and actions taken within the Service
- Conversion history (number, type and timestamp of conversions — not file contents)
3.4 Purchase record
When you complete a purchase, we keep a record of the transaction, of the checkout page as it was shown to you, and of the technical details of that session.
We use this only to answer questions about a charge and to handle payment disputes. It is not used for marketing or profiling, and it is not shared with anyone except where we need to respond to a payment dispute or a legal request.
3.5 Files you upload
Files are processed only to perform the conversion you requested. We do not read, index, analyse or use file contents for any other purpose, and we do not use them to train any model.
Uploaded files and converted output are deleted from our systems within 24 hours. Conversion is carried out by a third-party processing provider on servers located in Europe; their systems block access 24 hours after conversion and permanently delete the files within 72 hours, with no backups kept.
4. Legal bases (Article 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the Service, managing your account and subscription | Performance of a contract — Art. 6(1)(b) |
| Transactional emails (payment confirmation, trial reminder, cancellation confirmation) | Performance of a contract — Art. 6(1)(b) |
| Tax, accounting and consumer-law record keeping | Legal obligation — Art. 6(1)(c) |
| Fraud prevention, security and system integrity | Legitimate interests — Art. 6(1)(f) |
| Keeping the purchase record described in section 3.4, to answer questions about charges and defend disputes | Legitimate interests — Art. 6(1)(f) |
| Analytics, session recording and advertising cookies | Consent — Art. 6(1)(a) |
Where we rely on legitimate interests, we have assessed that our interest in preventing fraud and being able to explain and defend a charge does not override your rights, because the data involved is limited to what is necessary for that purpose and is not used for anything else. You may object at any time (see section 9).
5. How we use your data
- To create and manage your account
- To process your trial, subscription and payments
- To perform file conversions
- To send transactional emails about your account and billing
- To provide customer support
- To answer questions about a charge and to handle payment disputes
- To detect and prevent fraud and abuse
- To keep records required by tax and consumer law
- To improve the performance and usability of the Service
We do not send marketing newsletters or promotional emails, and we never sell your personal data.
6. Cookies, analytics and session recording
We use:
- Google Analytics — usage statistics
- Google Ads — advertising measurement and conversion tracking
- Microsoft Clarity — session recordings and heatmaps, which capture mouse movement, scrolling and navigation
Microsoft Clarity records how you interact with our pages. Recordings are used only to improve the Service and are not used to identify you personally. Fields containing sensitive information, including payment fields, are masked.
These tools load only after you consent through our cookie banner. You can change or withdraw your consent at any time through the banner or through the cookie settings link in our footer. Strictly necessary cookies, which keep you logged in and secure your session, do not require consent.
Microsoft Privacy Statement: https://privacy.microsoft.com
Google Privacy Policy: https://policies.google.com/privacy
7. Who we share data with
We share personal data with the following providers, who process it only on our instructions under written data processing agreements:
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Payment processing and subscription billing | Name, email, payment data |
| Cloud hosting, database and application providers | Running the Service, storing your account and the purchase record described in section 3.4 | Account data, usage data, email, payment reference, checkout image, technical data |
| A third-party file conversion provider | Performing the file conversions you request | Uploaded files, deleted as described in section 3.5 |
| Brevo | Transactional email delivery | Name, email address |
| A payment dispute management provider | Handling chargebacks and payment disputes | Transaction data, email, dispute records |
| Analytics and advertising | Usage data, cookie identifiers | |
| Microsoft | Session analytics (Clarity) | Interaction data, cookie identifiers |
We may also disclose data to legal or regulatory authorities where we are required to do so by law.
8. Where your data is stored
We choose European hosting regions wherever our providers offer them, and file conversion is carried out entirely on servers located in Europe.
Some of the companies listed in section 7 are established outside the European Economic Area, including in the United States, and their staff may access data from there in order to operate and support their services. Where that happens, the transfer is protected by:
- the EU-US Data Privacy Framework, where the provider is certified;
- Standard Contractual Clauses approved by the European Commission, together with supplementary measures where required;
- the European Commission’s adequacy decision for the United Kingdom, for data reaching us as controller.
If you would like more information about these safeguards, contact us at info@convert24.co.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- rectify inaccurate data
- erase your data (“right to be forgotten”)
- restrict processing
- data portability — receive your data in a machine-readable format
- object to processing based on legitimate interests
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
To exercise any of these, email info@convert24.co. We respond within one month. We do not charge for this and we do not ask for more identification than is necessary to confirm it is you.
You also have the right to lodge a complaint with a supervisory authority — the data protection authority in your EU country of residence, or the UK Information Commissioner’s Office (ico.org.uk).
10. How long we keep your data
| Data | Retention |
|---|---|
| Uploaded files and converted output | Deleted from our systems within 24 hours; permanently deleted by our conversion provider within 72 hours |
| Account data (name, email, subscription status) | For as long as you have an account with us. You may ask us to delete your account at any time and we will do so. |
| Invoices and transaction records | 6 years — required by tax and accounting law |
| The purchase record described in section 3.4 | 6 years from the date of the purchase, so that we can explain and defend a charge if it is later questioned |
| Support correspondence | 2 years from the last message |
| Analytics data | As configured in each tool, and no longer than 14 months |
Where we are required to keep invoices or purchase records after you close your account, we keep only those records and nothing else.
11. Automated processing and fraud prevention
We use automated checks, including tools provided by our payment processor and our payment dispute provider, to detect fraudulent payments and abusive use of trials. These checks may flag a transaction or an account for review.
A flag does not by itself block your account. Where a decision would significantly affect you — for example, declining a refund or suspending an account — a person reviews it, we tell you in writing, and you may contest the decision by replying to that message and ask for it to be reviewed again.
12. Data security
We use HTTPS encryption in transit, encrypted storage, hashed passwords, restricted internal access on a need-to-know basis, and automatic deletion of uploaded files from our systems within 24 hours. The purchase record described in section 3.4 is held in private storage that is not publicly accessible.
No online system is completely secure. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR.
13. Children
The Service is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact info@convert24.co and we will delete it.
14. Changes to this Policy
We may update this Policy. The date at the top shows when this version took effect, and previous versions are available on request.
15. Contact
Digital24 LTD
Registered in England and Wales, company number 12728844
Kemp House, 160 City Road, London EC1V 2NX, England
info@convert24.co