Privacy policy

Last updated: November 7, 2026

This policy explains how Harper Labs LLC ("Convella," "we," or "us") handles personal information when you visit Convella, use our publishing tools, or interact with a website or newsletter hosted for one of our customers. It is a notice about our practices, not a request for blanket consent. Where consent is required, we ask separately.

Who we are and how to contact us

Convella is operated by Harper Labs LLC, with operations in Alabama, United States. Our business mailing address is Harper Labs LLC, 701 Tillery Street, Unit 12-2332, Austin, TX 78702, United States. Contact andrew@convella.com for privacy questions and access, correction, export, or deletion requests.

For our own account administration, billing, support, security, and marketing, we determine how personal information is used. When a publisher uses Convella to manage readers, members, and newsletters, the publisher generally determines those purposes and we process the information on its behalf. A publisher's own privacy notice also applies. Contact the publisher about its content, membership charges, and use of your information; we can help route requests where appropriate.

Information we process

• Account and contact information: name, email address, account identifiers, profile image, authentication information, team permissions, preferences, support correspondence, and settings you save. Google sign-in and YouTube connections are described separately below.
• Content and source material: videos or audio you upload or ask us to retrieve, transcripts, images and screenshots, prompts, writing instructions, website details, articles, metadata, and generated outputs. These can contain personal information, including someone's image or voice. Upload only material you are entitled to provide.
• Publisher audience information: reader names, email addresses, account identifiers, newsletter selections and opt-outs, imported lists, membership status, and related activity. Publishers can access information associated with their own audience.
• Billing information: selected plans, subscription and customer identifiers, payment status, transaction amounts, invoices, and information needed to support payments. Stripe processes payment-card details; Convella does not receive or store full card numbers or security codes. Publishers' paid memberships use connected payment accounts.
• Technical and engagement information: IP addresses and request/device information handled by our infrastructure, security and diagnostic logs, website/article activity, email delivery failures and complaints, and newsletter open/click events where tracking is enabled. Email images and rewritten links can report opens and clicks to an email provider and the publisher; blocking remote images may limit open tracking but does not prevent link tracking.
• Product analytics: Mixpanel uses a browser identifier and activity events. For signed-in users, events may be associated with an account identifier, name, and email.

Information comes from you, publishers and their authorized team members, connected services, public sources you direct us to use, and your interaction with the service. We do not require sensitive information such as health records, government identification documents, or payment-card credentials in content. Do not upload such information unless the service is appropriate for your intended use and you have the necessary rights and lawful basis.

How we use information

We use information to authenticate accounts; build and host websites; transcribe and transform source material; generate, edit, and publish articles; carry out enabled automations; deliver newsletters and membership access; process subscriptions and usage; provide support; prevent abuse; and maintain and improve the service. Publishing content can make it available to visitors, search engines, and other third parties according to your website settings. Newsletter recipients can retain or forward delivered content.

Where the GDPR or UK GDPR applies, our legal bases depend on the activity: performing our contract for account and paid service delivery; legitimate interests in security, fraud prevention, support, and proportionate service administration; legal obligations for applicable financial and compliance records; and consent for optional marketing or tracking where required. Publishers determine the lawful bases for the audience information we process on their instructions. You may object to processing based on legitimate interests and may withdraw consent without affecting earlier lawful processing.

AI and transcription

To provide requested features, we send relevant source material and instructions to AI, transcription, and content-retrieval providers. This can include transcripts, prompts, screenshots, images, or audio. Our generation paths use providers such as OpenAI and Google; other configured model or transcription paths may use Anthropic and Deepgram. Provider access and retention depend on the selected service and applicable provider terms. We do not promise that every provider uses zero retention. Do not put information in a prompt or source file that you are not authorized to have processed this way. The separate restrictions on Google and YouTube user data below take precedence.

Emails and your choices

When you create an account, we use your email address to send sign-in and security messages, website/article status notifications, trial and subscription notices, invoices, and usage information. We also send onboarding messages, product tips, feature announcements, and offers related to Convella, subject to applicable marketing laws. You can stop marketing emails through the unsubscribe link in those messages or by contacting andrew@convella.com. Unsubscribing from marketing does not stop messages needed to administer your account or provide a requested service. Creating an account does not replace consent where the law requires it.

A publisher's newsletters are separate from Convella's marketing. Use a newsletter's unsubscribe link to stop that newsletter. Contact the publisher to manage other newsletter subscriptions. Unsubscribing from newsletters does not itself cancel a paid membership or delete a member account. Publishers are responsible for having permission or another applicable lawful basis for their lists and for responding to reader requests.

Browser storage and tracking

Cookies and browser storage support authentication, security, requested functionality, and preferences. We also use analytics and referral tools to understand service use and attribution. Mixpanel uses browser storage and activity events; shared site/application integrations include Plausible analytics, Rewardful referral attribution, Microsoft Clarity session analytics, and Google Tag Manager. Session analytics can collect interaction information such as clicks and scrolling. LocalStorage is a storage technology even though it is not a cookie. These tools may receive browser/device information, identifiers, and activity data; particular tags depend on the page and configuration.

You can use browser settings to block or delete cookies and site storage, and browser or provider controls to restrict tracking. Blocking storage can affect sign-in and other features. These controls do not necessarily stop all server-side processing. Contact us about tracking or privacy requests at andrew@convella.com. This notice is not itself consent to tracking where consent is required.

Publisher websites may have their own analytics, embeds, or custom code, subject to the publisher's settings and notice. Third-party embeds can contact their providers when loaded. Your browser controls may not cover all processing by third-party websites or a publisher's own tools.

Who receives information

We share information as needed to deliver the features you request and operate the service. Relevant recipients include:

• Google/Firebase for authentication, database, storage, and infrastructure, and Vercel for hosting and application delivery;
• AI, transcription, and retrieval providers for the content processing described above;
• SendGrid and Mailgun for service messages, newsletters, delivery, and applicable engagement/suppression information;
• Stripe and PriceOS for payment and subscription administration, including publisher membership payments where applicable;
• Mixpanel, Plausible, Microsoft Clarity, Google Tag Manager, and Rewardful for the analytics, tag delivery, and attribution described above; search, domain-setup, and diagnostics providers such as Algolia, Entri, and Better Stack when those features are used;
• the publisher and authorized team members for that publisher's website and audience, and recipients or visitors of content you choose to distribute;
• professional advisers, authorities, or other recipients when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a business transaction subject to applicable protections.

Publisher audience data is processed to provide the publisher's service; it is not a license for Convella to market unrelated products to those readers. This policy does not authorize selling customer lists or sharing Google/YouTube user data for advertising. Any new materially different use requires the disclosures and choices required by applicable law.

Retention, deletion, and security

Retention depends on the purpose and data category. We retain account and website information while providing the service and when needed to support a retained account or website. Cancelling a plan stops renewal but does not itself request deletion; content may remain available to restore service. Publisher audience records remain subject to the publisher's instructions and applicable obligations.

When deletion is requested, we assess the request, verify identity as needed, and remove or deidentify information we are no longer required or permitted to retain. Financial records, evidence of consent or transactions, opt-out/suppression information, security records, and information needed for disputes or legal obligations may need to be retained. Logs, backups, and provider copies follow their applicable retention and deletion processes; deletion is not a promise of instant removal from every backup. Copies already published, indexed, or delivered to recipients may be outside our control.

We use access controls and other technical and organizational measures appropriate to the information and service. No service or method of transmission is completely secure. Do not rely on Convella as your sole backup of source material or published content.

International processing

We operate in the United States and use providers that may process information in the United States and other countries. Where a transfer is restricted by applicable data-protection law, an appropriate transfer mechanism and any required safeguards are necessary, such as applicable adequacy arrangements or standard contractual clauses. Contact us to request information about the safeguards relevant to your data. Using this service or accepting this notice is not blanket consent to a restricted transfer.

Your privacy rights

Depending on your location and the applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; and opt out of legally defined sale, sharing, or targeted advertising. You may also have a right to appeal a denied request and complain to your local data-protection authority. These rights can have exceptions, and we may need proportionate information to verify a request. An authorized agent may contact us with evidence of authority. We do not discriminate against you for exercising applicable rights.

Send requests to andrew@convella.com, identifying your account or the publisher website involved. Please do not email passwords or full payment-card information. If we act on a publisher's behalf, we will direct or assist the request through that publisher. We respond within the time required by the law applicable to the request, and explain any permitted extension or refusal.

For California residents where the CCPA applies, the categories and purposes described above include identifiers and contact information, commercial information, internet/network activity, user-provided audio/visual content, and account access information. Collection depends on the features used. We use account credentials for authentication and security, not to infer sensitive characteristics. We do not use this policy to claim that every listed category was collected or sold from every person. Contact us about a category-specific request or sale/sharing opt-out at the email address above.

Children

Convella publisher accounts require an adult who is at least 18. Convella is not directed to children under 13 and we do not knowingly collect their personal information. Publishers must not use Convella to operate a service directed to children under 13 or knowingly provide their personal information. Contact us if you believe a child under 13 has provided information so we can investigate and take appropriate deletion steps.

Changes to this notice

We update this notice when our practices change and identify the revision date above. We provide a prominent notice or email for material changes before they take effect where required, and obtain any required consent for a new use.