Legal
Privacy notice
Plain English, no dark patterns. This notice covers visitors to this website, customers of ConformTrail, the public websites we read, and the people we write to. It describes what we do with data, and like everything else we publish it is not legal advice.
Effective date: 2026-09-06. Operator: Keydams (Andreas Adams, Nueva Colombia, Paraguay), established in Paraguay.
Who is responsible
Keydams (Andreas Adams, Nueva Colombia, Paraguay) operates ConformTrail and decides how the data described here is processed. Contact: support@conformtrail.com. Postal address: not yet published. Tax identification: 8997514-6. The operator page has the rest of the operator data.
If you visit this website
This site sets no analytics cookies and embeds no third-party trackers. Our server keeps standard request logs (IP address, time, page, user agent, referrer) to run and secure the service; they are deleted after 14 days. Logged-in customers get one signed session cookie, which is needed for the login to work.
If you use the free scan, one line is written to our event log: the domain you entered, the number of patterns observed, and the date. Not your address, not the pages, not a single observation. Nothing about the scanned site is stored, and the result is shown to you and to nobody else.
If you are a customer
We store the email address the order was made with, the name of your firm, the website and the public pages you asked us to read, the observations and reports produced for them, and the token that makes a report link work. Card details never reach us: Lemon Squeezy acts as merchant of record and processes the payment, returning a customer identifier, which offer was bought and whether it is paid and running.
If we test a website
We fetch public pages only, obey robots.txt, keep to one request per second per host and
identify ourselves as ConformTrailBot/1.0 (+https://conformtrail.com/bot). We never log in, never submit a
form and never upload anything. Screenshots are taken of public pages only and never of
filled-in form fields or personal data. Details are on the crawler
page.
If we contacted you
We write to the businesses whose public website we read. Here is exactly how that works.
- Where the address comes from. Publicly available business sources: public registers of the trade the business is in, the business’s own website and its imprint or contact page, and public business directories. We do not buy contact lists, and we do not guess addresses in bulk.
- What we store. Business contact data only: name, role, business email address, employer, the public websites we associated with that employer, and the messages exchanged. No private addresses, no special categories of data.
- Why. Our legitimate interest in offering a business service to the business that would use it. Every message says who is writing, from which company, and carries a postal address and a one-click unsubscribe link, as US commercial email law requires.
- How to stop it. Use the unsubscribe link in any message, or write to support@conformtrail.com. Unsubscribing takes effect immediately: the address goes on our suppression list, any running sequence is stopped, and we do not contact you again.
- What we keep afterwards. Only what is needed to keep the promise not to write again — a one-way hash of the address on the suppression list. The contact record itself is deleted.
How long we keep things
| Data | Kept for |
|---|---|
| Screenshots of scanned pages | 90 days. For a customer’s own sites they are kept while the account is open. |
| Raw scan data (findings, page inventories, PDF inventories) | 12 months. |
| Report links (the token in the address of a report) | 60 days; for a Module 1 report 60 days. After that the link stops working. |
| Contact records of people who never replied | 6 months, then deleted. |
| Addresses that bounced | Deleted immediately; only a one-way hash stays on the suppression list. |
| Suppression list (unsubscribes, bounces, portfolio clients) | Kept indefinitely as hashes — that is what makes the opt-out permanent. |
| Server request logs | 14 days. |
| Customer account data, reports and invoices | While the account is open, then as long as tax and accounting law requires. |
Who else processes data for us
- Lemon Squeezy — merchant of record, card payments and receipts.
- Postmark — transactional email: sign-in links, reports, alerts, receipts.
- Instantly — sending and tracking of business outreach email.
- Anthropic — the classifier: extracts of the public pages we read, and replies we receive, are sent for a yes-or-no classification and a draft answer. Nothing goes there to train a model.
- Hetzner — hosting of the application and the database.
- Cloudflare — DNS and reverse proxy in front of the application.
A service with no credentials configured is switched off and receives nothing. We do not sell personal data and we do not share it for advertising.
Your rights
Write to support@conformtrail.com to ask what we hold about you, to have it corrected or deleted, to object to our use of it, or to get a copy. We answer within 30 days. If you unsubscribed, the hash on the suppression list stays — deleting it would let a later import write to you again; tell us if you would rather have it removed anyway.
Changes
When this notice changes materially we say so on this page and, for customers, by email before the change takes effect.