Privacy

Privacy policy

Last updated October 27, 2026

The short version

Unfunnel is a funnel builder operated by Tenek LLC. Account holders build funnels; visitors fill them in. We store what is needed to run the product, we never sell personal data, we never train AI models on it, and the data a funnel collects belongs to the account that built it. This policy covers unfunnel.io, the app, the API and every funnel we host.

If you have an Unfunnel account

We collect:

Your email address, name and password (stored hashed), to sign you in and to reach you about your account. If you turn on two-factor authentication, the secret for that too.
The funnels, brand assets, uploaded images, settings and workspace details you create. Uploads are stored in our database provider's file storage.
Billing details, handled by Stripe. We keep your Stripe customer and subscription IDs and your plan; we never see or store your card number.
Basic usage data: which pages of the app you open, errors you hit, and, for each AI request and API call, when it happened, what it did, and whether it worked. This is what the usage and API pages show you.
Server logs with your IP address, browser type and the time of each request, used for security, rate limiting and debugging.
Emails we send you about your account, new leads, weekly summaries and product changes, and whether they were delivered. You can turn the notification emails off in Settings.

Teammates you invite to a workspace can see everything in that workspace. Leaving a workspace removes that access.

When you use AI drafting

AI drafting and editing use Anthropic's Claude API. When you use them we send Anthropic the instruction you typed, the funnel document being drafted or edited, and, when drafting from a website, the text, colours and fonts read from the website you named. Anthropic processes that request under its commercial API terms: it does not use the content to train its models, and it keeps it only for the short period those terms allow for abuse monitoring.

We do not store your instructions or the AI's responses beyond the funnel you save. We keep only a usage record per request: the time, the mode, the model, the token counts and the cost.
We never send leads, visitor answers or your billing details to the AI.
The website read, in onboarding and when drafting from a website, fetches your public pages the way a browser would and may copy your logo into your workspace's image library.

The AI disclosure has the full picture.

If you connect Claude or another AI tool

On every plan, you can connect an AI assistant such as Claude to one workspace. When you do:

The assistant can read and change only the workspace you chose when connecting: its funnels, leads, metrics and images.
We record each request it makes (the action, the time and whether it worked) so you can see usage on the API page. We do not store your conversations with the assistant.
What the assistant receives back, such as lead details, is handled by its provider under their own privacy policy, not ours.
You can disconnect it at any time from the API page in Unfunnel or from the assistant's settings. Access also ends if you leave the workspace.

If you connect Google Ads

Connecting Google Ads to a funnel means signing in with Google and allowing Unfunnel to manage your Google Ads conversions and send conversion data on your behalf. With that access we:

List the Google Ads accounts your Google login can reach, so you can choose one.
Create a conversion action in the account you choose for each event the funnel sends, and read back its tag and label, which go into your funnel.
Send the funnel's conversions to those actions from our servers, with the visitor data described under “If you filled in a funnel” below.
Read whether the account has accepted Google's customer data terms, so the editor can tell you when enhanced conversions are off.

We also receive the email address of the Google login you used, to show who connected the account. We keep the sign-in's refresh token, encrypted with a key that lives only on our servers, and nothing else from your Google account. We do not read your campaigns, ads, spend or billing, and we use what Google gives us only to provide this feature to you: never for advertising, never sold, never to train AI models, and never read by people except with your permission, for security, or where the law requires it. Disconnecting Google Ads in the app deletes the token and tells Google to revoke it; you can also remove Unfunnel's access at any time from your Google Account's security settings.

Unfunnel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you filled in a funnel built with Unfunnel

The business that published the funnel decides what it asks you and is the controller of your answers. Unfunnel processes that data on their behalf and does not use it for anything else. When you complete a funnel we store:

The answers you gave, including any name, email or phone number you typed.
Which advert brought you there, if you arrived from one, so the business can measure its advertising.
Your IP address and browser type in server logs, used to stop abuse and to rate limit.
If the business connected an ad platform (Meta, ChatGPT Ads or Google Ads), the steps you completed are reported to that platform so its ads are measured: from your browser, by the platform's own pixel or tag, and from our servers, with the advert click that brought you there, your IP address, your browser type and a hashed version of your contact details. Hashing means the platform receives a fingerprint, not the plain text. Each platform handles that data under the business's own account and the platform's terms.
If you ticked a consent box, the wording you agreed to, when, the page it was on, your IP address and your browser type, kept with your answers as evidence of that consent.

A funnel may load its fonts from Google Fonts, which means your browser requests the font files from Google and Google sees your IP address in that request. The business chooses the fonts.

To see, correct or delete what a business holds about you, contact that business. Their contact details are on the funnel or in the message they sent you. If you cannot reach them, write to us and we will pass the request on or act on it where we are able to.

Cookies

On unfunnel.io, meaning this website and the app, visitors in the UK, the EU, the rest of the European Economic Area and Switzerland are asked first: analytics and advertising cookies stay off until you choose Accept, and Reject keeps them off. Everywhere else they are on unless you reject them. You can change your answer any time from Cookie settings, at the foot of every page and in Settings in the app. Rejecting later deletes the cookies listed under analytics and advertising below.

Always on, because the site cannot work without them:

uf_consent (Unfunnel): remembers your cookie choice. 6 months.
uf_region (Unfunnel): whether to ask you, worked out from your country. Until you close your browser.
sb-…-auth-token (Supabase, our sign in provider): keeps you signed in. Up to 400 days, removed when you sign out.
tl_org (Unfunnel): which workspace the app shows you. 1 year.
Cloudflare Turnstile, on sign up and log in, checks that you are a person, and Cloudflare, which runs our network, may set __cf_bm to tell people from bots (30 minutes).

In the app, once you are signed in:

crisp-client/… (Crisp, our support chat): keeps your conversation with us open between visits. Up to 6 months.

Analytics and advertising, only with your consent where you are asked:

_ga and _ga_… (Google Analytics): tell one visit from the next so we can count returning visitors. 2 years. Before you accept, Google Analytics only receives cookieless page views that cannot tell visitors apart.
_fbp (Meta pixel): a browser ID that lets Meta measure our ads. 90 days.
_fbc (Meta, written by us or the pixel): the ad click that brought you here. 90 days.
tl_eid (Unfunnel): a random visitor ID sent with our own ad events so Meta can count a sign up once. 90 days. We also keep the ad campaign you arrived from in your browser's local storage for the same purpose.

Without your consent we also do not send your sign up or payment to Meta from our servers. Plausible, which counts visits, sets no cookies and keeps no personal data, so it runs for everyone.

None of this runs on a funnel a business has published. A funnel sets a first-party cookie that records the advertising click ID for attribution and can show its own cookie notice; the business that built the funnel decides whether it appears and which pixels and tags it loads (Meta, ChatGPT Ads, Google Ads), each of which sets its own cookies once it does.

Who we share with

Only the services that run the product, each receiving only what it needs. This is also our sub-processor list for the data processing terms in our terms of service:

Render (hosting and server logs), United States.
Supabase (database, authentication and file storage), United States.
Stripe (payments and invoices).
Resend (account, lead and summary emails).
Anthropic (AI drafting and editing, including drafting from a website), when you use those features.
Plausible and Google Analytics (visit statistics on unfunnel.io only).
Google Fonts (font files on funnels that use them).
Meta (pixel and Conversions API), only when a business has connected its own Meta account, and for our own marketing pages.
OpenAI (the ChatGPT Ads pixel and Conversions API), only when a business has connected its own ChatGPT Ads account.
Google (the Google Ads tag and Data Manager API), only when a business has connected its own Google Ads account.
Cloudflare (DNS for unfunnel.io and unfunnel.page).
Crisp (the support chat in the app): your name, email address and workspace, and the messages you send us.
Sentry (error tracking): technical details of errors in the app and on hosted pages, with an account and workspace ID but never your email address, request bodies or form answers.
GoHighLevel (our customer records): your name, email address, workspace, plan and payment history, how you found us, and account milestones such as how many funnels and leads you have, so we can support and contact you. Never the leads themselves or funnel answers.

We will tell account holders by email before adding a sub-processor that handles lead data. Beyond these, we share data only if the law requires it, to protect someone's safety, or with a buyer if Unfunnel changes hands, in which case this policy still applies. We do not sell data and we do not use funnel answers for our own marketing.

Security

Data travels over HTTPS and is encrypted at rest by our database and storage providers. Passwords are hashed, tracking credentials such as Meta access tokens, ChatGPT Ads keys and Google Ads sign-ins are encrypted with a key that lives only on our servers, and every table is protected by row-level access rules so a workspace can only ever read its own data. Two-factor authentication is available in Settings. No system is perfect; if we learn of a breach affecting you, we will tell you without undue delay.

How long we keep it

Account and workspace data stays while the account exists.
Deleting a funnel deletes its leads and metrics. Deleting a lead deletes it. Deleting an account deletes its workspaces once no other member remains.
Server logs are kept for a short rolling period, measured in weeks, and then discarded.
Backup copies of the database expire on a rolling schedule after the live copy is deleted.
Billing records are kept for as long as tax and accounting law requires.

Your rights

You can export every contact and every funnel from the app at any time. You can delete contacts one at a time or all at once. Account deletion is in Settings and removes everything, cancelling any subscription first.

If you are in the EU, UK, California or another place with data protection rights, you can ask us to access, correct, delete, export or stop processing your personal data, and to object to or restrict its use. We do not sell or share personal data for cross-context advertising, so there is nothing to opt out of there. Write to us and we will answer within thirty days, and we will not treat you differently for asking. If you are in the EU or UK you can also complain to your data protection authority.

Where your data lives

Our servers and providers are in the United States. If you use Unfunnel from elsewhere, your data is transferred there under our providers' standard contractual clauses and equivalent safeguards.

Children

Unfunnel accounts are for adults. Funnels must not be aimed at children under 16 without a lawful basis, and if we learn we hold a child's data without one we will delete it.

Changes

When this policy changes, the date at the top changes with it. If a change matters to how your data is used, we will email account holders before it takes effect.

Contact

Questions about this policy and requests about your data go to hello@unfunnel.io, or to the business that published the funnel you used.