Privacy

The short version

Conformly is a portfolio demo built in public. It reads public storefront pages, stores what it found, and keeps as little about you as the features need. Do not rely on it for anything that matters to your business.

What a scan collects

• The URL you submit, and the public pages of that store that Conformly fetched (up to 12).
• Those pages stored as text: titles, headings, links, buttons, form labels, script sources, image alt text, meta tags and body text. No cookies are set on the store and no forms are submitted.
• The findings: verdicts, evidence quotes, citations and suggested fixes.
• For anonymous scans, your IP address is used to limit how many free scans can be started from one address.

How long it is kept

• Anonymous scans, with their crawled pages and findings, are deleted 30 days after the scan. Until then anyone with the private link can open the report, so share it with care.
• Scans made from an account are kept as history until you delete them or close the account.

What an account stores

• Your email address and sign-in details, held by the authentication provider.
• Your organisation, its members, monitored sites, notes on findings and plan.
• Change alerts sent for monitored sites.

Who processes it

• Vercel hosts the site and records anonymous page-view analytics.
• A hosted Postgres database and its authentication service store accounts, scans and findings.
• Groq, with Google Gemini as a fallback, classifies sentences that look like environmental claims. Only those sentences are sent, never your account details. Free-tier model providers may use inputs to improve their products.
• Stripe runs checkout in test mode. No real card is charged and no real payment is taken.
• Resend delivers alert emails only when demo delivery is switched on. Otherwise email lands in an in-app outbox and is not sent.

Model calls

Every model call is logged with the model, the prompt version and the token counts, so it can be reviewed. No model is involved in any verdict other than the green-claims check.

Your choices

To have your account or scans deleted, or an anonymous report removed before the 30 days are up, contact the maintainer through the project’s GitHub repository. Do not post a report link in a public issue: anyone with the link can open the report.