Privacy Policy

1. Introduction

This Privacy Policy explains how Convilyn, operated by CoreNovus, collects, uses, and protects your information when you use our file conversion service.

Operator: CoreNovus
Location: Taiwan

Throughout this Privacy Policy, references to "we," "us," "our," or "the Service" refer to the Convilyn service and CoreNovus.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, and password when you create an account
• Payment Information: Processed securely by Paddle (our Merchant of Record); we do not store your full payment card details
• Uploaded Content: Files you upload for conversion or processing
• Communications: Messages you send to support

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and interactions with the Service
• Device Information: Browser type, operating system, and device identifiers
• Log Data: IP address, access times, and referring URLs

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process your file conversions and deliver results
• Process payments through Paddle and manage subscriptions
• Communicate with you about service updates and support requests
• Ensure security, prevent abuse, and troubleshoot issues
• Comply with legal obligations

4. File Processing and Storage

Files you upload are processed on our servers to perform the requested conversion. We implement the following practices:

• Uploaded files are removed from processing storage once your job completes; copies are retained only where our security and legal obligations require it
• Converted files are available for download for a limited time, then deleted
• We do not access, view, or use your files for any purpose other than providing the service and meeting our security and legal obligations
• Files are transmitted using encrypted connections (HTTPS/TLS)

5. AI Processing and Sub-processors

When you use Convilyn's AI-powered features, your inputs and the converted outputs are processed by AI models hosted on third-party infrastructure. We disclose every sub-processor that handles your content:

• AWS Bedrock (Amazon Web Services): infrastructure that hosts the AI models used for conversions. Data is processed in the AWS region serving your account.
• Anthropic Claude (via AWS Bedrock): the AI model that performs document, image, and code transformations on your inputs.
• Paddle: payment processing and Merchant of Record (covered in Section 6).

Anthropic does not train its AI models on inputs or outputs sent through AWS Bedrock. Your data is not used to improve any third-party model. This commitment is documented in the AWS Bedrock data-protection terms and in Anthropic's Commercial Terms.

A current list of all sub-processors is maintained on our Sub-processors page. We will notify you of material changes to that list.

6. Payment Processing

All payments are processed by Paddle.com Market Limited, which acts as our Merchant of Record. This means:

• Paddle collects and processes your payment information directly
• We never receive or store your full credit card number
• Paddle handles tax calculation and compliance
• Your payment data is subject to {paddlePrivacyLink}

7. Information Sharing

We do not sell your personal data. We may share information in the following circumstances:

• Service Providers: Third parties who help us operate the Service (e.g., hosting providers, Paddle for payments)
• Legal Requirements: When required by law, court order, or government request
• Protection: To protect our rights, privacy, safety, or property, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice provided)

8. Data Retention

We retain your information only as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

• Account data is retained while your account is active
• Uploaded files are deleted shortly after processing
• Converted files are deleted after the download period expires
• Some data may be retained longer if required by law

9. Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure server infrastructure
• Access controls and authentication
• Regular security assessments

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Opt out of marketing communications
• Export your data in a portable format

To exercise these rights, please contact us at support@convilyn.com.

11. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it promptly.

If your jurisdiction requires a higher minimum age or parental consent for using online services, those local regulations take precedence.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

13. The Convilyn Browser Extension

The Convilyn extension for Chrome is optional and installed separately. It is covered by this policy, and it handles three kinds of data:

• Download details — when you start a download, the extension reads that download's URL and filename to decide whether Convilyn can convert it. This happens in your browser and is not sent to us.
• File contents — only after you accept the conversion prompt does the extension fetch the file and upload it for processing. If you decline, or the prompt times out, nothing leaves your browser and your original download continues.
• An API key for this browser — connecting the extension creates a key named for that browser, stored by the browser and never shared with web pages. Your password and login session are never given to the extension. You can revoke the key at any time from your console.
• Site access is requested per site, when you ask for it, rather than at install time. The extension does not read pages you have not pointed it at.
• Form rescue — when you right-click a page and ask Convilyn to fix a file a form will not take, the extension reads that page's file inputs: the formats the field accepts, the field name, and the name, size and type of the file you chose. It reads no other field's value and nothing else on the page, and its access is limited to that one tab until you navigate away.
• Files uploaded by the extension are processed and retained exactly as described in section 4; the extension adds no separate storage.

14. The Convilyn Android App

The Convilyn app for Android is optional and installed separately. It is covered by this policy. It is a companion for an account you already have — it cannot start a conversion — and it handles four kinds of data:

• An API key for this device — pairing stores a key that identifies the device to your account. It is held in the operating system's keystore, scoped so that it is not included in device backups and does not sync to any other device. The app never receives your password or your login session.
• The camera, and only to read the pairing code — the camera is opened solely to scan the pairing QR code. No photo or video is recorded, kept, or sent anywhere, and the app requests no microphone permission at all. Pairing can be completed by pasting the key instead, in which case the camera is never opened.
• The conversions already on your account — the app reads your existing jobs so it can show what each file became. It creates no conversions of its own.
• Files saved to the device — a finished file is downloaded into storage private to the app, and leaves it only when you choose to hand it to another app through the system share sheet. The app sends no copy anywhere.
• The app contains no advertising, no usage analytics, and no in-app purchase. It does send crash and error reports to Sentry (listed on our Sub-processors page), so that failures on real devices can be found and fixed. A report carries technical details of the failure — such as the error and where in the app it happened, the in-app events leading up to it, and the app, device and operating-system versions. Before a report leaves the device, the pairing key is masked, email addresses are replaced, and the signature parameters are removed from any file download link. Files it downloads were processed and retained exactly as described in section 4; the app adds no separate storage of its own.
• Unpairing forgets the key on that device and lets you choose whether to keep or delete the files downloaded to it. Kept files stay on the device: they appear again if the device is paired with the same account, pairing it with a different account deletes them, and they can be deleted at any time from the app's pairing screen. If a key is revoked from your console, the device forgets it the next time it connects to Convilyn and keeps its downloaded files until they are deleted from the pairing screen or the app is uninstalled. Neither unpairing nor deleting files revokes the key — a device that has been lost cannot be the thing that revokes its own credential — so revoke it from your console.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the effective date. Your continued use of the Service after such changes constitutes acceptance of the revised Privacy Policy. Most recent change: section 14 now describes crash and error reporting in the Android app and what happens to downloaded files when a device is unpaired or its key is revoked, and Sentry has been added to our Sub-processors page.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

CoreNovus
Email: support@convilyn.com