Privacy policy.

Who this is from

FunnelSights is operated from the State of New Mexico, United States, and is the data controller for the personal data described in the next section.

Privacy questions and requests about your own data are handled by us directly — get in touch and we will answer.

No data protection officer has been appointed. The product does not carry out the large-scale monitoring or special-category processing that would require one, and if that changes this policy will say so before it does.

Two roles, and why the difference matters to you

FunnelSights handles personal data in two separate capacities, and which one applies changes who you ask for what.

For the people who sign up and use the product, we are the controller. We decide what account data is held, why, and for how long, and this policy is our notice to you about it.

For the analytics data collected from visitors to a customer’s website, that customer is the controller and we are their processor. We hold it on their instructions, and we do not decide what it is used for. If you are a visitor to a site that uses FunnelSights and you want data about you dealt with, the operator of that site is who to ask. We will help them answer you, but we cannot answer for them.

What we hold about you as controller

• Account records: your name, your email address, and your password stored only as a scrypt hash at OWASP’s recommended cost — never the password itself.
• Workspace records: the sites you have added, and who else has been given access to them.
• Session records: a short-lived access token, and a rotating refresh token held in an httpOnly cookie and stored as a digest, so that a session can be revoked.
• Correspondence: what you send us by email or through support, kept so that we can answer it and refer back to it.
• Measurement of this website: we run our own tracker on this site, on exactly the cookieless terms described on the privacy page.
• Billing records: which plan a workspace is on, when it renews, and whether the last payment succeeded — together with the identifier Paddle uses for the subscription.

Payment is taken by Paddle, and your payment details are held by Paddle rather than by us. A card number never reaches FunnelSights and there is nowhere in the product it could be stored. What comes back to us is the state of the subscription — the plan, the renewal date, and whether the last payment went through — which is what the account and the fee terms run on. The billing and refund policy sets out the cycle, the renewal dates and how a refund is asked for.

What we process for our customers

The analytics data — every field a pageview records, how a visitor is counted without a cookie, and how long each store is kept — is set out field by field on the privacy page. That page is written against the implementation and checked against it, so this policy points at it rather than paraphrasing it into a second version that can drift.

The properties that matter for this policy: nothing is written to or read from a visitor’s device, IP addresses and user agents are used to compute a rotating hash at ingest and are never stored, the salt rotates every 24 hours and is deleted after 48 — after which the hash cannot be recomputed by anyone, including us — and the domain is inside the hash, so data about the same person on two different sites cannot be joined.

Two things are worth naming separately, because they are fields a customer controls rather than defaults we set: custom event properties, which can hold whatever the customer chooses to put in them, and captured site-search terms, which are lowercased and stripped of email addresses and long digit runs at ingest but are still text a visitor typed.

Why we process it, and on what legal basis

• To provide the service you signed up for, including keeping your workspace and reports available — performance of our contract with you, Article 6(1)(b).
• To keep accounts and data secure, to detect and prevent abuse of the service, and to keep it running — our legitimate interests, Article 6(1)(f).
• To answer what you write to us — performance of the contract where it concerns your account, and our legitimate interests otherwise.
• To meet obligations the law places on us, including answering a lawful request from an authority — legal obligation, Article 6(1)(c).
• For anything you switch on yourself, such as a Google connector or the optional model features — your consent, Article 6(1)(a), which you withdraw by switching it back off.

For the analytics data we process on a customer’s behalf, the legal basis is theirs to determine and to state to their own visitors. We do not determine it and we make no claim that using FunnelSights removes a consent requirement: a cookieless design is a property of the software, not a conclusion about anyone’s obligations.

Google user data, and the limits on it

FunnelSights can connect to Google Analytics 4, Google Search Console and Google Ads. Those connectors ship behind a single switch that is off. Until you turn it on and complete Google’s own consent screen, nothing in your workspace contacts a Google API and no Google data reaches us.

FunnelSights’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice that means:

• Google data is used only to provide and improve the features you connected it for, and is shown only inside your own workspace.
• It is not transferred to anyone else, except as necessary to provide those features, or where the law requires it.
• It is not used for advertising of any kind, and it is never sold.
• No human reads it, except with your explicit permission, for a security investigation, to comply with the law, or where it has been aggregated and is used to run the service.
• It is not used to train a general-purpose model, ours or anyone else’s.
• Disconnecting a connector revokes our access and stops any further retrieval.

The same limits apply to the Calendly connector, which sits behind the same switch and retrieves booking aggregates with a credential you supply.

Automated decisions, and the model features

Content Recommendations is rule-based. It reads your own aggregated figures and raises cards from deterministic detectors, so the same numbers always produce the same advice. No model is involved and no profile of any individual is built — the data model does not hold one to build from.

The optional model features are off until you turn them on, and while the switch is off nothing in the product sends anything to a model: not a summary, not a sample, not a prompt. When it is on, what is sent is the aggregated report figures included in the prompt, and it is sent to answer your question and for no other purpose. Your analytics data is not pooled across customers and is not used as training material.

There is no automated decision-making producing legal or similarly significant effects on anyone, within the meaning of Article 22.

Who else can see it

Every third party that can access data we process is named in the sub-processor register, together with what it does, what it can reach, and whether it is in the request path today or only reachable behind a switch that is off. The register is the list, not a sample of it, and we publish changes to it.

Three are worth naming here because they are in the path by default: our hosting provider, which runs the application and the database and whose edge terminates TLS — so it sees request IP addresses in transit, the ones FunnelSights itself never writes down — our transactional email provider, which receives account names and email addresses in order to deliver invitations and digests, and Paddle, which takes the payment and holds the payment details that go with it.

We do not sell personal data, and we do not share it with advertising networks or data brokers. There is no such recipient on the register and there is no mechanism in the product to become one.

Where it is processed, and transfers out of the EEA

FunnelSights runs in the United States: the application services and the Postgres database holding your data. For visitors and customers in the EEA, the UK or Switzerland, that is an international transfer, and it needs an appropriate safeguard under Chapter V — standard contractual clauses, or another mechanism recognised for the country involved.

How long we keep it

• Hash salts: 48 hours, then deleted, after which a visitor hash cannot be recomputed at all.
• Raw analytics events: 180 days by default, then purged.
• Daily aggregates, which is what the reports actually read: 16 months.
• Account and workspace records: for as long as the account exists.
• Correspondence: for as long as it is useful to answer and refer back to.
• Billing records: for as long as the subscription exists. The invoices themselves are Paddle’s records, kept under Paddle’s own retention rather than ours.

Having it deleted

Separately from the retention periods above, which run on their own, you can ask us to delete your data at any time. Write to us. We complete a deletion within 30 days of receiving the request, which also meets the one-month period Article 12(3) sets for answering an erasure request under Article 17.

A deletion covers your account record, the workspaces you own, and the analytics data held for the sites inside them. It does not reach the record of a payment Paddle holds as the seller of that transaction, which is Paddle’s to keep. Export anything you want to keep before asking, because it is not reversible. If you are a member of a workspace somebody else owns, we can remove you from it, but the workspace and its data belong to the account holder and only they can ask for those.

If you are a visitor to a customer’s website rather than an account holder, send the request to that website’s operator: they are the controller and we act on their instruction. For a visitor there is usually nothing to find in any case — after 48 hours the hash that stood for the visit cannot be recomputed by anyone, so no identifier is left to search on.

Your rights

If we are the controller of data about you — which is the case if you hold an account — you have the following rights, and exercising any of them costs nothing and will not affect the service you receive:

• Access: to be told whether we hold data about you, and to receive a copy of it (Article 15).
• Rectification: to have inaccurate data corrected, and incomplete data completed (Article 16).
• Erasure: to have data deleted where one of the grounds in Article 17 applies.
• Restriction: to have processing limited while a dispute about it is resolved (Article 18).
• Portability: to receive the data you gave us in a structured, commonly used, machine-readable form, and to have it sent to another controller where that is technically feasible (Article 20).
• Objection: to object to processing based on our legitimate interests, on grounds relating to your situation (Article 21).
• Withdrawal of consent: at any time, for anything we do on the basis of consent, without affecting what was lawful before you withdrew it (Article 7(3)).

To exercise any of them, write to us. We answer within one month of receiving the request, the period Article 12(3) allows, and will tell you if a complex request needs longer and why.

You can also complain to a supervisory authority — in the EEA, the authority for the country you live or work in or where you think the problem happened; in the UK, the Information Commissioner’s Office. You do not have to raise it with us first, though we would rather you did, because we can usually fix it faster.

If the data concerns your visit to somebody else’s website rather than your own account, we are the processor and not the controller. Ask the operator of that website; we will support them in answering within the same timeframe.

Cookies and what is stored on a device

The analytics product writes nothing to a visitor’s device — no cookie, no local storage, nothing read back. That is the whole point of it, and it is the one claim this site tests against the code on every build.

The product’s own dashboard is a different matter, because it has to keep you logged in. Signing in sets a refresh token in an httpOnly cookie, which is strictly necessary to provide a service you asked for and is not used to track you anywhere. Signing out ends it.

This marketing website sets no cookie at all. It is measured with FunnelSights itself, on the terms described above, which is why there is no consent banner on it.

Children

FunnelSights is a business tool, sold to the operators of websites, and it is not directed at children. We do not knowingly hold account data about anyone under 16. If you believe a child has created an account, write to us and we will remove it.

Security

Workspaces are isolated in the database itself by Postgres row-level security rather than by a filter in application code, and a query without a valid workspace claim returns nothing. Passwords are hashed with scrypt at OWASP’s floor, with a twelve-character minimum. Access tokens are short-lived and refresh tokens rotate and are stored as digests, so a session can be revoked. Removing someone from a workspace takes effect on their next request.

Changes to this policy

This version takes effect on 19 September 2026. If we change it in a way that affects you — a new purpose, a new recipient, a shorter or longer retention — we will say so on this page and, where the change is significant, tell account holders directly before it takes effect. We will not apply a new purpose to data already collected without a basis for doing so.