Privacy Policy

If you do not agree with this Privacy Policy, please do not use the Services. By creating an account, connecting a platform, or otherwise interacting with funnls, you agree to the practices described here. Any words capitalized but not defined here have the meaning set out in our Terms of Service.

1. Who we are

funnls is a secure AI platform that automates complex marketing workflows for direct-to-consumer brands. We help small e-commerce teams generate brand books, ad creative, and marketing assets and optionally publish them to connected platforms (Shopify, Meta, Google, Klaviyo, others). Our company is Funnls AI LLC, and we are headquartered in the United States at 5229 NW 5th Ave, Miami, FL 33127. You can reach us at support@funnls.ai.

We process your Personal Data in accordance with applicable United States privacy laws, including the Utah Consumer Privacy Act, the California Consumer Privacy Act, and – where they apply to you – the GDPR and UK GDPR.

2. What we collect

2.1 Information you give us

When you sign up: your name, email, password (hashed), workspace name, and any optional details you provide (role, business stage, how you heard about us). You may also give us information by filling in forms on our websites or by corresponding with us by phone, email, or otherwise – including when you subscribe to the Services, participate in a survey or promotion, or report a problem. This may include your postal address, phone number, billing and payment-card information, and a personal description or photograph. We also store content that you upload or provide to the Services in order to deliver the features and functionality of the Services.

2.2 Information from connected platforms

When you connect a third-party platform via OAuth, we read data from that platform on your behalf. Specifically:

• Shopify – under the scopes you grant (read_products, read_orders, read_all_orders, read_customers, read_themes, read_content, write_products, write_themes, write_content, and related read/write scopes for discounts, files, inventory, locations, marketing events, publications, draft orders, and price rules): your store metadata, product catalogue, order history, customer records, theme assets, content pages, and any writes funnls performs on your authorization (such as drafting product copy, updating themes, or creating discount codes).
• Meta (Facebook + Instagram) – via the Marketing API under the scopes you grant (ads_read, pages_read_engagement, business_management, and others as you authorize): your ad accounts, campaigns, ad sets, ads, performance metrics, page metadata, and business assets.
• Google (Ads, Analytics 4) – campaign and analytics data scoped to the accounts you authorize.
• Klaviyo – under the scopes you grant via OAuth (or via a Klaviyo private API key if you choose the manual connection path): campaigns, flows, segments, profiles, lists, templates, catalogs, coupons, custom objects, composer drafts, images, events, metrics, tags, subscriptions, forms, web feeds, webhooks, data privacy controls, tracking settings, and conversations. Read and write across these resources so funnls can build campaigns and flows on your behalf in addition to reading performance data.
• Other platforms – equivalent read-scoped data for any additional platform you choose to connect.

We request scopes only for the resources funnls needs to deliver its marketing-operations features. funnls is designed as a control plane for your marketing stack – we request both read and write scopes upfront so you can authorize once and let funnls build campaigns, flows, ads, and store updates on your behalf rather than re-prompting you for each action. You can revoke any connection at any time from Settings → Integrations or directly inside the connected platform’s dashboard. Disconnecting stops new reads and writes immediately.

2.3 Information we collect automatically

Like most web services, we collect basic technical telemetry – IP address, browser type, internet service provider, device, pages visited, timestamps, referring and exit URLs, operating system, and similar log data – for security, debugging, and product analytics. We may combine this automatically collected log information with other information we collect about you in order to improve the Services, our marketing, and site functionality.

2.4 Information we receive from other sources

We may receive information about you from individuals or corporate entities which are subscribers to the Services (“Subscribers”) where you are designated a user of their workspace. We may also receive information about you if you use any other website or service we operate. We work closely with third parties – including subcontractors for technical, payment, and delivery services, advertising networks, analytics providers, and search information providers – and may receive information about you from them, subject to your agreements with them.

3. Cookies and tracking technologies

We use first-party cookies and similar technologies for authentication, session continuity, content personalization, analytics and performance measurement, and to give you access to secure areas of our site. You can control the use of cookies at the individual browser level. If you reject cookies you may still use our site, but your ability to use some features or areas may be limited.

Technologies such as cookies, tags, and scripts are used by funnls and by our marketing partners, affiliates, and analytics or online customer-support providers. We use them to analyze trends, administer the site, track movement around the site, and understand our user base as a whole. We may receive reports based on the use of these technologies on both an individual and an aggregated basis.

In the EEA, the UK and Switzerland, analytics and advertising cookies are only set after you accept them in the cookie banner. Elsewhere they are on by default, and off if you decline in the banner or your browser sends a Global Privacy Control signal. You can change your answer at any time by clearing cookies for this site.

4. How we use your data

• Provide the Services – generate brand books, analyze campaigns, surface insights, draft email and SMS content, generate ad creative, and (where you authorize it) publish content back to your connected platforms.
• Bill for the Services – process payments and maintain billing records.
• Improve the product – measure feature usage, identify bugs, develop and update functionality, carry out research or surveys, and improve user experience using aggregated and de-identified data.
• Personalize the Services – present content in the most effective manner for you and your device, and tailor your use of our applications and platforms.
• Communicate with you – respond to support requests, resolve bugs and queries, send service updates, and (only if you opt in) marketing communications. You can unsubscribe from marketing emails at any time via the link in each email.
• Security & compliance – detect abuse, prevent fraud and criminal activity, protect the security of our systems, comply with legal obligations, and protect the rights, privacy, safety, or property of our users, funnls, our affiliates, or any third party.

We do not sell your personal data. We do not use your connected- platform data to train shared AI models that other customers can access. Brand-level data and campaign data stay scoped to your workspace.

5. AI providers

funnls uses third-party AI providers (such as Anthropic and OpenAI) to generate brand-book content, ad copy, email and SMS drafts, and other AI outputs. When we send a prompt to one of these providers, the prompt may include relevant context from your workspace (e.g. brand name, product descriptions, campaign metrics) so the output is tailored to your brand. We use enterprise APIs that, per the providers’ current terms, do not retain prompts for model training. We do not send your connected-platform raw data (full customer lists, full order history) to AI providers – only the minimum context needed to complete the requested task.

6. How we share data

We share personal data with the following categories of recipients, only as needed to operate the Services:

• Infrastructure providers – Vercel (hosting), Supabase (database, storage, authentication, Vault for OAuth tokens), Inngest (background jobs).
• Connected platforms you authorize – when you authorize funnls to publish content (e.g. push a campaign to Klaviyo, create an ad on Meta, update a Shopify theme, generate a discount code), we send the relevant data to that platform on your behalf.
• AI providers – see Section 5 above.
• Analytics providers – privacy-respecting product-analytics tooling for measuring usage and debugging.
• Business partners, vendors, and suppliers – for the performance of any contract we enter into with you or with a Subscriber.
• Legal / compliance – when required by law or to protect rights, property, or safety, including in response to lawful requests by public authorities.

We require all subprocessors to maintain appropriate security and confidentiality measures. We may also disclose Personal Data in the event we sell or buy any business or assets, or if funnls or substantially all of its assets are acquired by a third party, in which case the Personal Data we hold about our customers will be one of the transferred assets.

7. Where we store data

funnls primarily stores data in the United States via Supabase (PostgreSQL + Storage). All information you provide is stored on secure servers in a controlled environment with limited access, and payment transactions are made using encrypted technology. If you are located in the EEA, UK, Switzerland, or another jurisdiction with cross-border-transfer rules, transferring your data to the United States is permissible under applicable mechanisms (e.g. Standard Contractual Clauses) and we take steps to ensure adequate protection.

Where we have given you (or you have chosen) a password that lets you access parts of the Services, you are responsible for keeping it confidential. Please do not share a password with anyone. No transmission of information over the internet is completely secure; any transmission is at your own risk.

8. How long we retain data

We retain your personal data for as long as your workspace is active, plus a reasonable period afterward to comply with legal obligations and resolve disputes. When you delete your workspace or your account, we delete or anonymize personal data within 30 days, except where retention is required by law (e.g. tax records, billing history). Connected-platform tokens are revoked immediately on disconnect.

9. Security

We use industry-standard safeguards: TLS 1.3 in transit, AES-256 encryption at rest, OAuth tokens stored encrypted in Supabase Vault (never in plaintext), least-privilege access controls, audit logging, automated daily backups with point-in-time recovery, and regular dependency review. We conduct quarterly access reviews to confirm that only authorized personnel retain administrative privileges. Critical vulnerabilities are remediated within 72 hours of confirmation; high-severity issues within 7 days. We notify affected users of any confirmed personal-data breach within 72 hours where required by GDPR Article 33 or applicable state law. No system is perfectly secure; if you believe your account has been compromised, contact support@funnls.ai immediately.

10. Your rights

Depending on where you live, you may have rights regarding your personal data, including the right to:

• Access – get a copy of the personal data we hold about you. We will make commercially reasonable efforts to provide you reasonable access to the personal data we maintain.
• Correct – update inaccurate or incomplete data.
• Delete – ask us to erase your data (see Data deletion).
• Restrict / object – limit how we process your data or object to specific uses, including the right to ask us not to process your personal data for marketing purposes.
• Portability – receive your data in a structured format.
• Withdraw consent – where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, email us at support@funnls.ai. We respond within 30 days.

10.1 Opt-out preference

You may stop receiving our marketing emails at any time by following the unsubscribe instructions included in those emails, by changing your email preferences in your account settings, or by contacting us by email or postal mail.

10.2 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know the categories and specific pieces of personal information we have collected, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of any sale or sharing for cross-context behavioural advertising. funnls does not sell personal information. We share limited data with advertising partners such as Meta and Google to measure our own ads, including hashed contact details when you create an account. To opt out, decline cookies in the banner, send a Global Privacy Control signal from your browser, or email support@funnls.ai.

10.3 EEA / UK residents (GDPR)

If you are in the EEA or UK, our lawful bases for processing are: performance of a contract (to provide the Services you requested), legitimate interests (to operate, secure, and improve our Services), consent (where applicable, e.g. marketing emails), and compliance with legal obligations. You have the right to lodge a complaint with your local supervisory authority.

11. Third-party links

Our site may from time to time contain links to and from the websites of partner networks, advertisers, or affiliates. If you follow a link to any such website, please note that each has its own privacy policy and that we do not accept responsibility or liability for those policies. We encourage you to read them before submitting any Personal Data.

12. Testimonials

We may display personal testimonials from customers on our site, along with other endorsements. If you wish to have your testimonial removed, please contact us at support@funnls.ai.

13. Children

The Services are designed for businesses and are not directed at individuals under 18, and we do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

14. Integration

This Privacy Policy, as updated, together with the Terms of Service, the User License Agreement, and any confirmation of sale or purchase order, contains the entire understanding of the parties with respect to its subject matter and supersedes all prior agreements and understandings between the parties with respect to that subject matter.

15. Changes to this policy

We may update this Privacy Policy from time to time in response to changing legal, regulatory, technical, or business developments. When we do, we’ll change the “Last updated” date at the top and, for material changes, notify you by email or in-product notice. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

16. Contact

Questions, requests, or concerns about this Privacy Policy or our data practices: email support@funnls.ai or write to us at:

Funnls AI LLC
5229 NW 5th Ave
Miami, FL 33127