ConversionLabs ("ConversionLabs," "we," "us," or "our") is a B2B paid-media marketing agency. We operate advertising campaigns and build performance-reporting dashboards on behalf of the clients who engage us. This Privacy Policy explains what data we access through third-party advertising and CRM platforms, why we access it, how we store and protect it, and the choices and rights available to the people and organizations whose data we handle.
This policy applies to our internal reporting applications and integrations — including our marketing performance dashboard — which connect to platform APIs such as the LinkedIn Marketing API, Google Ads, Google Analytics 4, Google Search Console, and HubSpot.
ConversionLabs is the data controller for the information described in this policy that we hold for our own business operations, and acts as a data processor / service provider on behalf of our clients with respect to advertising and CRM data belonging to those clients' accounts. Where we process data on a client's behalf, that processing is governed by our services agreement with the client.
This policy covers data we access via authorized API connections to advertising and marketing platforms in order to produce reporting and manage campaigns for clients whose accounts we are permitted to access. It does not cover the independent privacy practices of those third-party platforms (for example LinkedIn, Google, or HubSpot), each of which maintains its own privacy policy and terms.
Our reporting tools are designed to read aggregated advertising, analytics, and CRM performance data. We request the minimum access necessary for reporting and campaign management. Depending on the platform and the client engagement, the data we access may include:
We do not access private messages, connection lists, or personal profile content beyond what a platform exposes for advertising and analytics reporting, and we do not use these connections to build, enrich, scrape, or resell contact or profile databases.
LinkedIn Marketing API. We access LinkedIn advertising data solely to produce performance reporting for the clients whose LinkedIn ad accounts we are authorized to manage. Through the LinkedIn Marketing API we read advertising account, campaign, and reporting data (such as spend, impressions, clicks, and conversions) and, where applicable, aggregated organic company-page metrics. We use LinkedIn data only for the reporting purposes described in this policy.
In connection with our use of the LinkedIn Marketing API, we specifically commit that we:
LinkedIn members and account administrators may revoke our access at any time (see Access revocation), after which we cease accessing their data and delete stored LinkedIn data as described in Retention.
Google (Google Ads, Google Analytics 4, Google Search Console). We access Google advertising, analytics, and search data through a single authorized Google OAuth connection to report on paid and organic performance. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the reporting features described here, do not transfer it except as necessary to provide those features or as required by law, and do not use it for advertising to consumers or sell it.
HubSpot. We access CRM data through an authorized HubSpot private-app connection to attribute leads, deals, and pipeline outcomes to marketing activity. This data is used only for reporting and campaign management for the client that owns the HubSpot account.
We use the data we access to:
We do not use the data for automated decision-making that produces legal or similarly significant effects on individuals, and we do not sell personal information.
Where the EU/UK GDPR or similar laws apply, we process data on the basis of: performance of our contract with the client; our and our clients' legitimate interests in measuring and improving marketing performance; consent, where required (for example, where a platform obtains authorization from an account administrator); and compliance with legal obligations.
We share data only as follows: with the client that owns the relevant advertising or CRM account, as part of the reporting we provide to them; with service providers (such as our cloud hosting provider) that process data on our behalf under confidentiality and data-protection obligations; and where required by law, legal process, or to protect our rights. We do not sell, rent, or trade data, and we do not share platform data with any party for that party's own independent marketing or enrichment purposes.
Our reporting applications are hosted on secure cloud infrastructure. API credentials and OAuth tokens are stored as protected server-side environment variables and are never exposed to end users or embedded in client-side code. Data in transit is encrypted using TLS/HTTPS. Access to production systems and credentials is limited to authorized ConversionLabs personnel on a need-to-know basis. We cache platform data only as needed to render reports and apply reasonable technical and organizational measures to protect it against unauthorized access, alteration, or disclosure.
We retain platform data only as long as necessary to provide reporting for the relevant client engagement, or as required by law. Cached reporting data is refreshed on a rolling basis and superseded data is discarded. For LinkedIn data, we additionally observe LinkedIn's prescribed maximum storage and caching durations and apply the most restrictive limit that applies (for example, advertising account and reporting data retained no longer than one year, and non-authenticated member profile data cached no longer than 24 hours). When an authorization is revoked, or when a client engagement ends, we delete or irreversibly de-identify the associated platform data — including any stored LinkedIn data and OAuth tokens — within a reasonable period, typically no more than 30 days, unless a longer period is required to comply with legal obligations.
Any authorizing user or account administrator may revoke our applications' access at any time, directly from the granting platform:
Revoking access immediately stops future data collection. You may also email us (see Contact) and we will disconnect and delete the associated data.
Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, to data portability, and to withdraw consent. Because much of the data we hold belongs to our clients' accounts, requests from an individual whose data appears in a client's account may be directed to that client as controller; we will assist our clients in responding. To exercise any right, contact us as described below. You also have the right to lodge a complaint with your local data-protection authority.
To request deletion of data we hold about you or your organization, email liam@conversionlabshq.com with the subject line "Data Deletion Request" and enough detail for us to identify the relevant account or records. We will confirm receipt, verify the request, and delete the applicable data within 30 days, except where retention is required by law. Revoking access at the platform level (see Access revocation) will also trigger deletion of the associated stored data.
Our reporting dashboards are access-controlled tools used by ConversionLabs and its clients. They use only the cookies or equivalent local mechanisms strictly necessary to keep an authenticated session active. We do not use advertising or cross-site tracking cookies in these tools.
ConversionLabs and its infrastructure providers may process data in countries other than the one in which you reside, including the United States and Canada. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers of personal data.
Our services are directed to businesses and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where changes are material, take reasonable steps to notify affected clients. Continued use of our services after an update constitutes acceptance of the revised policy.
For any question about this policy, our data practices, access revocation, or a data-deletion request, contact:
ConversionLabs
Email: liam@conversionlabshq.com
Website: conversionlabshq.com