ConveyLoop

Privacy

Your data, your rights, our responsibility.

Base Recursion LLC does business as ConveyLoop. This policy explains what data we collect, why we collect it, how we use and share it, and what rights you have — wherever you are in the world.

Last updated: October 14, 2026

1. Introduction

Base Recursion LLC, doing business as ConveyLoop (“ConveyLoop,” “we,” “our,” or “us”), provides ConveyLoop, an AI-powered marketing automation platform (the “Service”) that includes campaign orchestration, closed-loop optimization, local SEO workflows, media generation and publishing, third-party integrations, billing, and related features. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use the Service, or interact with us in any way. ConveyLoop does not share your information with any other Base Recursion product (section 7).

Who is responsible for your data. Base Recursion LLC is responsible for the personal data described in this policy: its “controller” under the EU and UK General Data Protection Regulation (GDPR), and the “business” under California’s privacy law. For personal data about other people that you put into ConveyLoop, we act on your behalf instead (section 8). You can reach us through the contact methods in section 16.

We never sell your data. ConveyLoop does not sell, rent, or share your personal information for cross-context behavioral advertising. This applies to every user, regardless of location, to the maximum extent permitted by applicable law (including the California Consumer Privacy Act / California Privacy Rights Act).

2. Information We Collect

We collect information in the following categories:

  • Account data. Email address, authentication identifiers (e.g., hashed passwords), the name of your organization and your role in it, project metadata, plan/subscription tier, and the time zone your browser reports when you sign up (or, if it reports none, one estimated from your IP address), used as the default time zone for scheduling posts.
  • Billing & transaction metadata. Subscription status, plan selection, invoice history, and payment timestamps. All payment card processing is handled by Stripe — we never store your full credit card number, CVV, or bank account details on our servers.
  • Usage data & logs. Our hosting provider’s request logs record your IP address, browser and device type, operating system, the pages you visit, timestamps, referring URLs, and the requests your actions in the Service make. Our error and performance monitoring (Sentry) runs on our servers and records details of requests that fail or are sampled for performance, including what was sent with a failed request (with passwords removed), and the errors the app reports from your browser (section 13). We also collect security and anti-abuse signals such as bot-detection headers, and we keep IP addresses in rate-limit counters for about a day.
  • Customer Content. Marketing inputs you provide (brand information, prompts, target keywords, audience descriptions), campaign configurations, media assets you upload, and any content or Output generated through the Service.
  • Facts from your website. ConveyLoop crawls the website you give it and records facts about your business — such as what you sell, your pricing, and your team — and uses them to ground what it writes.
  • Business locations you add. If you add a business location in Local SEO, you type in its details yourself — such as its name, address, phone number, website, opening hours, categories, and time zone. ConveyLoop uses them to draft your Google Business Profile posts, which you publish to Google yourself, and to compare them with your website so it can flag name, address, phone, or opening-hours inconsistencies.
  • Integration data. When you connect third-party accounts (e.g., Google Search Console, Google Analytics 4, WordPress, GitHub, GitLab, Bitbucket, an online store or payment account for revenue tracking, or social media posting services), we receive and store analytics metrics, content identifiers, site and repository metadata, order details, and other data made available through those integrations within the scopes you authorize.
  • Integration credentials. OAuth tokens, refresh tokens, and API credentials necessary to maintain your third-party connections. These are stored using encryption and access controls and are used solely to operate the integrations you have enabled.
  • Communications. If you contact us — through the in-app feedback form, the contact page, or by email to support@conveyloop.com — we keep what you send, your email address and, if you give it, your name, to answer you and improve the Service. For an email, we also keep the addresses it was copied to and the names of any attachments. We send an automatic acknowledgement to the address you used.
  • Legal acceptance records. When you sign up, you accept our Terms of Service and confirm you have read this Privacy Policy, and you do so again each time either one changes (section 15). Each time, we record the time, the version of each document, your email address, and related metadata (your IP address and browser) for compliance purposes.

3. How We Use Your Information, and Our Legal Bases

Where the GDPR applies, we may use personal data only with a legal basis for each use. Ours are: contract — the use is needed to provide the Service you signed up for under our Terms of Service; legitimate interests — the use serves a reasonable interest of ours that we have weighed against your rights and interests; and legal obligation — the law requires it. We do not rely on consent for anything we do today. We use the information we collect for the following purposes:

  • Provide and operate the Service — including campaign workflows, content generation, publishing to the channels you connect, optimization cycles, local SEO features, media creation, and analytics. Legal basis: contract.
  • Authenticate users and maintain accounts — verify identity, manage sessions, check that you can access each project you open, and prevent unauthorized access. Legal basis: contract.
  • Generate Output and run AI features — process your inputs through AI models to produce marketing copy, social posts, SEO pages, media, recommendations, and analytics summaries. Legal basis: contract.
  • Billing and transactions — process payments, manage subscriptions, enforce quotas, and handle invoicing and tax obligations. Legal basis: contract, and legal obligation for the tax records the law requires. We keep billing records longer than the law requires (section 10) for our legitimate interest in resolving billing questions and legal claims.
  • Prevent fraud and abuse — detect and respond to security threats, bot activity, spam, and violations of our Terms of Service. Legal basis: legitimate interests — keeping the Service, our customers, and ourselves safe.
  • Support, troubleshooting, and improvement — respond to your requests, diagnose issues, monitor reliability, and develop new features. Legal basis: contract for supporting customers; legitimate interests for answering anyone else who writes to us, for drafting replies with AI (section 4), and for keeping the Service reliable and improving it.
  • Communicate with you — send emails about your account and the Service: verification and security messages, billing notices, alerts that need your attention, support replies, a weekly performance report (section 12), and a notice when our Terms or this policy change (section 15). We do not send marketing emails. Legal basis: contract.
  • Keep a record of what you agreed to — the versions of our Terms of Service you accepted and of this policy you confirmed reading (section 2). Legal basis: legitimate interests — being able to show what was agreed.
  • Comply with legal obligations — meet applicable legal, regulatory, and tax requirements, respond to lawful requests, and enforce our agreements. Legal basis: legal obligation, and legitimate interests for enforcing our agreements.

What you must give us. To create an account you must give us an email address and a password, and to subscribe you must give our payment processor your payment and billing details: we cannot provide the Service without them. Everything else, such as connecting other accounts, is up to you, and only the features that need it are affected if you leave it out.

No automated decisions about you. ConveyLoop automates marketing work for your business — what to write, publish, and change, in the mode you choose. It does not make decisions about you as a person based solely on automated processing that have legal or similarly significant effects on you, and it does not profile you.

4. AI & Machine-Learning Processing

To generate Output (such as marketing copy, social posts, SEO content, images, and analytics summaries), ConveyLoop transmits portions of your Customer Content and inputs to third-party AI models. We send only the data reasonably necessary to produce the requested Output and take steps to minimize the scope of information transmitted where feasible.

  • Text and analysis. Writing, fact-checking, and analysis use language models from Anthropic (Claude) and OpenAI (GPT). Search and duplicate detection use embedding models from Google, with OpenAI’s as a fallback. Every one of these requests goes through OpenRouter, an AI gateway, and is routed only to hosts that have committed not to store it or use it to train models (zero data retention). For the models we use today, those hosts include Google Cloud Vertex AI, Amazon Bedrock, and Microsoft Azure. OpenRouter does not store the content of these requests; it keeps only metadata such as their size, timing, and cost.
  • Images and video. Images and videos are generated through Magic Hour, which runs the generation model ConveyLoop picks for each piece. ConveyLoop uses only models made by Google and OpenAI for this: today, Google’s Veo for video and OpenAI’s image models for images. Magic Hour and Google or OpenAI receive the prompts and images used to make the media, and process them under their own terms and privacy policies. These requests do not go through the zero-data-retention routing described above.
  • Support messages. When you write to ConveyLoop (in the app, through the contact form, or by email), a Claude model reads your message to sort it and draft a reply, routed like text and analysis: through OpenRouter, only to zero-data-retention hosts. A person at ConveyLoop reviews every reply before it is sent. For a message sent from inside the app while you are signed in, the draft may also draw on basic facts about your account, such as your plans and recent errors, so that it is accurate; nothing about an account is used for a contact-form or email message.

These commitments are set out in each provider’s own terms, which ConveyLoop does not control. Providers may change over time; if a change affects what this section says, we will update it.

5. Connected Accounts, OAuth & Third-Party APIs

ConveyLoop allows you to connect third-party accounts — including Google (Search Console and Analytics 4), WordPress, Git hosts (GitHub, GitLab, and Bitbucket), online stores and payment accounts for revenue tracking (Stripe, Shopify, WooCommerce, and Google Analytics 4 ecommerce data), and social media posting/scheduling services — so the Service can read analytics and metrics, manage content, and/or publish on your behalf.

  • Scope-limited access. When you authorize a connection, we request only the permissions (OAuth scopes) necessary to deliver the specific integration feature. For example, Google Search Console access is limited to the webmasters.readonly scope, and Google Analytics access is limited to analytics.readonly. Some providers offer no narrower option: GitLab has no permission short of its broad api scope that lets ConveyLoop commit to your repository, so a GitLab connection uses that scope.
  • Google Business Profile. ConveyLoop does not connect to Google Business Profile accounts yet and requests no access to them. The business locations it uses are the ones you add by hand (section 2). We will update this policy before ConveyLoop connects to Google Business Profile.
  • Token storage & use. OAuth tokens and API credentials that ConveyLoop holds are stored with encryption and used solely to maintain the integration, refresh access when required, and perform the actions you have requested. We do not use integration data or credentials for any unrelated purpose.
  • Social media accounts. Social media accounts are connected through Post For Me, a social publishing service. When you connect an account, the platform asks you to authorize Post For Me, which holds that access and publishes the posts you approve on ConveyLoop’s behalf, under its own privacy policy. Bluesky works differently: you enter your handle and an app password, which ConveyLoop passes to Post For Me without storing it. ConveyLoop stores only each account’s identifier, name, and platform, whether it is a business or personal account, and when its connection status changed.
  • Revocation. You may disconnect any integration at any time from within ConveyLoop or by revoking access directly through the third-party provider. Upon disconnection, we delete the stored credentials for that integration. GitHub connects through the ConveyLoop app installed on your GitHub account; disconnecting removes our credentials, but the app stays installed until you uninstall it in your GitHub settings.
  • No advertising use. ConveyLoop does not use data received from Google or any other connected provider to build advertising profiles, serve ads, or sell or monetize user data. Data from connected accounts is disclosed only as needed to provide the Service, comply with law, or at your direction.

Google API Services User Data Policy. ConveyLoop’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

  • Service providers and subprocessors. We use trusted third-party providers to operate the Service, including: Supabase (database, authentication, file storage, and serving the images on pages you publish), Vercel (hosting, edge network, and bot protection), Stripe (payment processing), Resend (sending email, and receiving email sent to support@conveyloop.com), Microsoft 365 (our email, including the support@conveyloop.com mailbox), Sentry (error and performance monitoring on our servers, which can include the contents of a request that failed), Inngest (running background work, including the content that work produces), OpenRouter (AI gateway) and the zero-data-retention AI model hosts it routes to (see section 4), Magic Hour and the Google and OpenAI image and video models it runs (see section 4), and Post For Me (publishing to the social media accounts you connect). These providers receive only the data necessary to perform their function and are contractually obligated to protect it. This list may change as we improve the Service.
  • Not with other Base Recursion products. ConveyLoop has its own accounts and its own database, and we do not share your information with any other Base Recursion product or service (section 7).
  • Third-party platforms you connect. When you authorize an integration, data is transmitted to or from that platform at your direction.
  • Legal disclosures. We may disclose information if required by law, court order, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, investigate fraud, or respond to a government request.
  • Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email or prominent notice before your information becomes subject to a different privacy policy.

7. ConveyLoop Is Separate From Other Base Recursion Products

ConveyLoop has its own accounts, its own sign-in, and its own database. Your ConveyLoop account is used only for ConveyLoop. We do not share your account, or anything else in ConveyLoop, with any other Base Recursion product or service.

If we offer a way to connect products. Base Recursion LLC may in the future offer a service that brings its products together. If it does, connecting ConveyLoop to it will be optional. ConveyLoop will share information with that service, or use information from it, only with your consent, and you will be able to withdraw that consent at any time. We will update this policy before any such sharing begins.

We never sell your data.

8. Personal Data About Your Customers & Contacts

Some of the data you put into or connect to ConveyLoop is personal data about other people — for example:

  • people named on your website, such as your team or customers quoted in testimonials, which ConveyLoop may record as facts about your business;
  • the shoppers in an online store or payment account you connect for revenue tracking. The order notifications we receive include shoppers’ names and contact details. ConveyLoop keeps only the order details it needs to attribute revenue (such as the order number, the amount, and the page and campaign that led to the sale), not the shopper’s name, contact details, or browser.

We process this data on your behalf and on your instructions, to provide the Service to you: for it, we are your “processor” under the GDPR and your “service provider” under California law, and we do not use it for any purpose of our own. Your business decides why it is processed, is responsible for its legal basis, and is responsible for having the right to share it with us, including giving any notices the law requires. If you are one of those people and have a question about your data, please contact the business that holds it; you can also contact us (section 16).

9. International Data Transfers

ConveyLoop is available worldwide. Your information may be stored and processed in the United States and in other countries where ConveyLoop or its service providers operate. These countries may have data-protection laws that differ from those of your jurisdiction.

Where required by applicable law (for example, transfers from the European Economic Area, the United Kingdom, or Switzerland), we rely on appropriate safeguards, which may include European Commission-approved Standard Contractual Clauses or equivalent mechanisms, to ensure an adequate level of protection for your personal data. You may request a copy of applicable safeguards through the contact methods in section 16.

10. Data Retention

We keep your information for as long as your account has a paid plan, to provide the Service.

  • When your plan ends. When your account’s last paid plan ends — because you cancelled or because payment failed — you can still sign in for 60 days to a download-only view, where you can download your data, resubscribe, contact us, or delete your account. At the end of those 60 days we automatically and permanently delete your account, your projects and generated content, and the files we host for you, including images on pages you published.
  • When you delete your account. You can delete your account and its data at any time before then (Account → Danger zone). Deletion is immediate and permanent, and ends any subscription at once, without a refund.
  • If you never complete checkout. An account created at sign-up that has not completed checkout within 30 days is deleted automatically, with the sign-up details we hold for it. You can sign up again whenever you are ready.
  • Backups. Deleted data may remain in our database backups for up to 7 days.
  • Billing and tax records. Invoices, payment and tax records, the billing details our payment processor holds, and the records of each version of our Terms of Service you accepted and of this Privacy Policy you confirmed reading are kept separately from your content for 10 years. They are not deleted with your account.
  • Support requests. A request sent from your account is deleted with it. Every request, including those sent through the contact page or by email, is deleted after two years.
  • Data exports. A download you create is deleted after 7 days.
  • Accounts that never had a paid plan are kept until you delete them.

You can download your data from inside the app after re-entering your password: from Account → Your data, or, after your plan ends, from the download-only view you see when you sign in. We never send your data by email. If you can’t sign in, you can ask for your data through the contact methods in section 16; we will confirm your identity first. Copies in our service providers’ logs expire on their own schedules. Once data is deleted it cannot be recovered.

11. Security

We implement administrative, technical, and physical safeguards designed to protect your information. Our hosting and database providers encrypt data in transit (TLS) and at rest, and we additionally encrypt the credentials for the accounts you connect. We also use row-level database access controls, a check on every request that you can access the project it concerns, rate limiting, input validation, webhook signature verification, error monitoring, and automated bot protection.

Despite our efforts, no method of electronic storage or transmission over the internet is 100 % secure. We cannot guarantee absolute security. If you become aware of a security vulnerability, please tell us at once through the contact page (topic: Security) or by email to support@conveyloop.com.

12. Your Rights & Choices

Depending on your location and applicable law, you may have some or all of the following rights with respect to your personal information:

  • Access — download your data yourself at any time (Account → Your data), or request a copy of the personal information we hold about you.
  • Correction / Rectification — correct most of your data yourself: your email address and your organization’s name in Account, your projects’ details in project setup, and the business locations you added in Local SEO. To correct the facts ConveyLoop learned from your website, update your website and re-crawl it in project setup (Crawl & Facts). For anything else, ask us and we will correct it.
  • Deletion / Erasure — delete your account yourself at any time (Account → Danger zone), or ask us to. That deletes your organization, its projects, the content ConveyLoop made for you, and the files we host, at once. You can also ask us to delete particular data without closing your account. We keep only billing and tax records and the records of what you accepted, for 10 years (section 10), and deleted data may remain in our backups for up to 7 days.
  • Restriction of processing — ask us to keep your data but stop using it while a question about its accuracy, or about our use of it, is resolved. You can also limit what ConveyLoop does yourself: have it wait for your approval before acting, disconnect a channel or integration, or cancel a plan.
  • Data portability — receive your personal data in a structured, commonly-used format: the download in Account → Your data is one or more zip files holding CSV files, your generated pages, and your media (a media file too large to include is linked instead).
  • Objection — object to a use of your data that serves our own legitimate interests rather than providing the Service you signed up for, such as security monitoring, error reporting, or improving the Service. We will stop unless we have compelling reasons to continue, such as keeping the Service secure. We do not use your data for direct marketing.
  • Withdrawal of consent — nothing we do today relies on consent (section 3). If we ever ask for your consent, for example to connect ConveyLoop to another Base Recursion service (section 7), you can withdraw it at any time, and withdrawing does not affect what was done before. Separately, you can stop ConveyLoop using any account you connected by disconnecting it.
  • Disconnecting integrations — disconnect any connected account at any time in project setup (Distribution & Integrations), or revoke ConveyLoop’s access in that service’s own settings. We then delete the credentials we held for it (section 5).
  • Emails — we send only emails about your account and the Service: sign-in and security messages, billing notices, alerts when something needs your attention (such as a connection that stopped working), replies to your support requests, a weekly performance report for your projects, and a notice when our Terms or this policy change. We do not send marketing emails; if we ever do, each will include an unsubscribe link.

EEA / UK residents: You also have the right to lodge a complaint with your local data-protection supervisory authority if you believe your rights have been infringed.

U.S. state privacy rights (California, Virginia, Colorado, Connecticut, and others): In addition to the rights above, you may have the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. As stated above, ConveyLoop does not sell or share personal information for cross-context behavioral advertising. To exercise your rights, write to us through the contact page (topic: Data request), by email to support@conveyloop.com, or through the in-app feedback form. We will verify your identity before processing any request and respond within the timeframe required by applicable law. You may also have an authorized agent make a request for you; we will ask the agent for proof that you authorized them, and may ask you to confirm your identity with us directly. We will not discriminate against you for exercising any of these rights, and we offer no financial incentives for personal information.

California notice. In the past 12 months we collected the following categories of personal information, from you, from your browser or device, from the accounts you connect, and from the website you give us to crawl. We used each for the purposes in section 3, disclosed each for those purposes only to the service providers in section 6 and to the platforms you connect, kept each as section 10 describes, and sold or shared none of it:

  • Identifiers — your email address, your account ID, and your IP address.
  • Customer records — your name if you give it to us, and the billing address and payment card details our payment processor collects for us.
  • Commercial information — your plans, purchases, and invoices.
  • Internet or other electronic network activity — request logs, the pages you visit and the actions you take in the Service, and error reports (section 2).
  • Approximate location — a time zone, from your browser or estimated from your IP address. We do not collect precise geolocation.
  • Professional information — your organization’s name and your role in it.
  • Audio, electronic, or visual information — images and videos you upload.
  • Sensitive personal information — your account sign-in (email address and password), and the payment card details our payment processor collects for us. We use them only to sign you in, keep your account secure, and take payment, so there is nothing for a right to limit their use to apply to.

We do not draw inferences from your personal information to build a profile about you.

We may decline requests where permitted by law — for example, where fulfilling a request would infringe another person’s rights or where we are legally required to retain certain data.

13. Cookies, Browser Storage & Tracking

EU and UK law (the ePrivacy Directive and the national laws that carry it out, such as the UK’s PECR) let a website store information on your device, or read it from there, without asking first only when that is strictly necessary to provide a service you asked for. The rule covers cookies and also your browser’s local and session storage. ConveyLoop stores only items of that kind, and nothing for analytics, advertising, or tracking, so it does not need to ask, and it does not show a cookie banner. This is everything it stores:

  • Sign-in session (cookies named sb-…-auth-token, sometimes split into parts ending .0, .1) — set when you sign in, by the sign-in library of our authentication provider, Supabase, on our own domain. It keeps you signed in. It lasts up to 400 days, is renewed as you use the app, and is removed when you sign out.
  • Email-change check (cookies named sb-…-code-verifier) — set only when you change your sign-in email (Account → Change email). It proves the confirmation link was opened in the browser that asked for the change. It is removed when the link is opened in that browser or when you sign out, and otherwise expires within 400 days.
  • Account set-up check (cl_obs) — set on signed-in pages. A signed cookie, holding your account’s ID, that remembers your account is fully set up so each page doesn’t have to check again. It lasts 30 minutes.
  • Social connection (pfm_connect_project, and sometimes pfm_connect_identity or pfm_connect_move) — set while you connect a social media account. They remember which project the connection is for, and for some platforms which kind of profile or which move you chose, while you visit the platform and come back. They last 15 minutes and are removed when you return.
  • Bot check — set by our hosting provider, Vercel, on the sign-in and sign-up pages when it checks that a visitor is not a bot. Vercel sets its name and how long it lasts.
  • Payment fraud prevention (Stripe’s cookies, such as __stripe_mid and __stripe_sid) — set by our payment processor, Stripe, only when a payment form opens: when you subscribe at sign-up or add a project. Stripe uses them to prevent fraud and sets how long they last. When you update your payment method, you go to Stripe’s own billing page, where Stripe’s cookie policy applies.
  • Sign-up progress (session storage: pending_signup_email and pending_signup_plan) — your email address and the plan you chose, remembered between sign-up and the page where you verify your email. They are removed when you verify, and when you close the tab.
  • Email link hand-off (local storage: conveyloop-auth-event) — when you open a verification link from one of our emails, written and removed at once to tell the ConveyLoop tab you already had open to carry on. It holds no personal data.

We do not use analytics cookies, advertising cookies, social-media tracking pixels, or any other form of cross-site or behavioural tracking on the client side.

Our error and performance monitoring (Sentry) runs only on our servers: nothing from it is loaded in your browser. If the app hits an error in your browser, our own code sends the error’s message and technical details, and the path of the page you were on (never its query string), to our servers, which record it there. This sets no cookies and stores nothing on your device. The optional ConveyLoop Metrics snippet our customers may install on their own sites records page signals (views, clicks, form submissions) one event at a time: the page’s path, the kind of site the visitor came from, campaign tags, and device type. It works without cookies, without stored visitor or session identifiers, and without fingerprinting, and it does not store the visitor’s IP address.

Do Not Track. We do not track you across other websites, so there is nothing for a browser’s Do Not Track or Global Privacy Control signal to turn off, and the Service does not change its behavior when it receives one.

You can clear or block cookies and site storage in your browser settings; however, blocking the items described above may prevent you from signing in, connecting accounts, or completing payments.

14. Children’s Privacy

The Service is not directed to individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please tell us through the contact methods in section 16.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we do, we change the “Last updated” date at the top of this page, and the next time you open the app we ask you to confirm you have read the new version before you continue. If you have an active plan, we also email you once to let you know. Every customer is asked about every change, and we keep a record of each version you confirmed (section 2). For everyone else, such as visitors to our website, the updated policy applies from the date it is posted.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, email us at support@conveyloop.com or write to us through the contact form on our website. You don’t need an account, or to be signed in, to use the contact form. If you are signed in, the in-app feedback form reaches the same place. We do not offer support by phone.

Every message receives an automatic acknowledgement, so you know it arrived; several messages sent close together may share one. We answer privacy requests within the deadlines set by applicable law.