Privacy Policy

Last updated 2026-07-09

How funnnl processes data on your behalf to run go-to-market plays. Plain English, and it describes what the product actually does — not aspirational boilerplate.

What we process

funnnl runs go-to-market plays on your behalf. To do that we process business contact and company information — names, work email addresses, job titles, employers, public professional profiles, and website-visit signals — sourced from third-party enrichment, verification, intent, and scraping providers, and from the CRM you connect. We also process your own account data (name, email, workspace membership) to run the service. We store the minimum needed to run and show you your plays. We do not sell your data, and we do not use your contact data to train AI models.

Controller, processor, and legal basis

For your account data, funnnl is the controller. For the business-contact data your plays process, you are the controller and funnnl is your processor — you decide who to reach and on what basis. Our lawful basis for processing is the performance of our contract with you and our and your legitimate interest in business-to-business outreach, subject to your responsibility to have a lawful basis for the outreach itself.

Sends go from your own accounts

When you turn on real sends, emails go through your connected mailbox and LinkedIn actions run through your connected LinkedIn account — never a funnnl address. You are the sender of record and responsible for the content you approve. Every outbound message passes a human approval gate, daily rate limits, and a duplicate-send guard before it goes out.

Website-visitor identification (US-only for people)

Person-level website identification is applied only to US traffic. For everywhere else, identification is company-level only and no personal data is resolved — this rule is enforced in code, not configuration, so it cannot be switched off for a non-US visit. This keeps person-level identification out of GDPR/POPIA jurisdictions by design.

Sub-processors

Running a play may involve data-processing sub-processors for hosting, enrichment, email verification, buying-intent, scraping, LinkedIn actions, CRM sync, and notifications. Core infrastructure processes your workspace data by default; data providers receive real data only once you connect the tool or turn on real sends — until then everything runs on realistic simulated data and nothing leaves your workspace. The full, current list is on our Sub-processors page.

Logging and security

We do not write prospect or personal data into application logs — log lines carry workspace and record identifiers only, never names, emails, or message content. Provider credentials live with our OAuth broker or in encrypted environment configuration, never in our database, client code, logs, or error messages. Access to workspace data is scoped to your organization at the database layer; one workspace can never read another's data.

Retention

We keep workspace data for as long as your workspace is active, and only as long as needed to run your plays and meet legal and billing obligations. When you delete your workspace, its data is erased immediately (see below). Billing records may be retained where law requires.

Your rights

Depending on your region (GDPR in the EU/UK, POPIA in South Africa, CCPA/CPRA in California and similar US state laws), you and the individuals whose data you process have rights to access, correct, delete, restrict, or object to processing of personal data, and to data portability. To exercise a right, or to ask us to action a request on behalf of one of your contacts, contact hello@funnnl.com. We respond within the timeframe your applicable law requires.

Deleting your workspace

A workspace admin can delete the workspace at any time from Settings. Deletion is immediate and irreversible: it cascades across every table and permanently erases the workspace — accounts, contacts, signals, runs, approvals, sequences, credit ledger, conversations, connections, and settings — and removes the organization from our authentication provider. Data held by sub-processors you connected (for example your CRM) is not affected, as it lives in your own accounts.

International transfers

funnnl and some sub-processors operate in the United States and the European Union, so your data may be processed outside your country. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses. Our primary application database is hosted in the European Union.

Contact

Questions, requests, or a data-processing agreement: hello@funnnl.com. See also our Terms of Service.