Privacy Policy
Effective Date: September 1, 2026 • Last Updated: November 4, 2026
At Sofunnels, we take the confidentiality, integrity, and security of personal data seriously. This Privacy Policy details the standards, practices, and governance protocols we adhere to regarding the collection, processing, safeguarding, and retention of personal data across our platforms, visual builders, and hosted services. We do not sell, rent, monetize, or trade your personal data or your funnel visitors' information to third-party data brokers or behavioral advertising networks.
We use cookies and standard web storage technologies to provide essential website functionality, maintain authenticated sessions, secure user accounts, and understand aggregated platform performance. Non-essential cookies (such as analytics and campaign measurement) are only activated with your consent and can be configured through our on-site cookie preferences.
We never sell personal data or customer records to third-party data brokers, and we do not engage in cross-site behavioral tracking. You can manage or revoke cookie consent at any time via your browser settings or on-site controls.
1 Scope and Legal Roles Under Data Protection Laws
This Privacy Policy applies to all websites, web applications, visual funnel builders, APIs, and hosting infrastructure operated by Sofunnels (“Sofunnels”, “we”, “us”, or “our”). This policy outlines how information is handled across two distinct legal and operational capacities:
Sofunnels as Data Controller
We act as a Data Controller for personal data regarding our direct account holders, subscribers, billing records, direct platform visitors, and customer support communications.
Sofunnels as Data Processor / Service Provider
When you build funnels and collect leads, form submissions, or orders from your visitors, you act as the Data Controller and Sofunnels acts strictly as a Data Processor executing processing operations on your instructions.
As the Data Controller for your funnel visitors, you warrant and represent that you have provided all legally required privacy disclosures, established lawful grounds, and obtained any mandatory consents (including under GDPR, UK GDPR, CCPA/CPRA, CAN-SPAM, and TCPA) before collecting or processing any personal information from your end users. You assume sole legal responsibility for all content, forms, and data collection deployed within your funnels.
2 Categories of Information We Collect
We collect and process personal data strictly to operate, secure, and deliver the Sofunnels platform:
A. Account & Registration Information
When creating or managing an account, we collect your full name, email address, organization name, securely hashed and salted login credentials, and workspace preferences.
B. Platform Subscription & Billing Details
Platform subscriptions are billed through certified third-party payment processors. We store billing customer identifiers, subscription plan tiers, invoice history, payment status, and renewal dates. We never store, process, or view full payment card numbers or card security verification codes (CVV/CVC).
C. Connected Payment Gateway Configuration
If you integrate a third-party payment processor (such as Stripe) to sell products on your funnels, your API credentials and connection identifiers are stored securely and encrypted solely to facilitate direct payment execution between your buyers and your merchant account. Sofunnels is not a party to transactions between you and your customers.
D. Funnel Submissions & Contact Capture
Information submitted by visitors on your published funnels (such as names, email addresses, phone numbers, custom form responses, and order selections) is stored in your dedicated, isolated workspace database on your behalf.
E. Operational Telemetry & Analytics
For performance, security, and attribution analytics, our first-party tracking captures aggregate and de-identified operational metrics, including referring URLs, campaign parameters, browser and device category, approximate geographical region (country level), navigation flow, and conversion events.
3 Purposes and Legal Bases for Data Processing
We process personal data exclusively for lawful business and operational purposes under recognized legal bases (Performance of Contract, Legitimate Interests, Legal Obligation, and Consent):
- Platform Operations: To deliver, host, maintain, and optimize the Sofunnels visual builder, cloud infrastructure, and customer workspaces.
- Authentication & Security: To authenticate user sessions, maintain tenant isolation, enforce rate limits, and protect against fraud, abuse, or unauthorized access.
- Billing & Account Administration: To process subscription renewals, maintain accounting records, and send essential transactional and administrative notices.
- Customer Support: To provide technical diagnostics, resolve customer support inquiries, and deliver service notifications.
- Legal & Regulatory Compliance: To comply with applicable statutory accounting, tax, anti-fraud, and legal obligations.
4 Data Sharing, Disclosure & Sub-Processors
We do not sell, rent, monetize, or trade personal data under any circumstances. We share data only with vetted third-party service providers (Sub-Processors) bound by stringent confidentiality and data protection obligations, strictly as necessary to provide the Service:
| Category / Provider | Operational Purpose | Safeguards & Compliance |
|---|---|---|
| Payment Processors (e.g., Stripe) | Subscription billing management and direct merchant payment execution | PCI-DSS Level 1 Certified, Encrypted Tokenization, DPA & SCCs |
| Cloud Infrastructure & Hosting | Secure cloud server hosting, database infrastructure, and edge delivery | SOC 2 / ISO 27001 Certified Facilities, Encrypted Storage |
| Transactional Email Services | Account verification, password resets, and critical operational notices | TLS-encrypted email transport, strict anti-spam adherence |
We may also disclose information where strictly required by law, court order, or governmental regulation, or when necessary to protect the legal rights, safety, and property of Sofunnels, our users, or the public.
5 Cookies, Local Storage & Tracking Technologies
Cookies are small data files stored in your browser by websites you visit. Sofunnels utilizes cookies and browser storage technologies to maintain platform security, preserve user preferences, and analyze website performance:
A. Strictly Necessary Cookies (Always Active)
Essential for core website operations, encrypted session authentication (`PHPSESSID`), workspace security, and Cross-Site Request Forgery (CSRF) defense tokens. The platform cannot function securely without these cookies.
B. Functional & Preference Storage
Client-side local storage used to preserve user interface layouts, active workspace preferences, and auto-saved visual builder drafts to protect against accidental data loss.
C. Performance & Analytics Cookies (Consent-Gated)
Allows us to analyze aggregated, de-identified platform telemetry (such as page load speeds, visitor flow, and navigation trends) to improve software performance. These cookies are only activated if you grant consent.
D. Marketing & Campaign Attribution (Consent-Gated)
Measures acquisition campaign effectiveness and referral traffic. We do not sell personal data, construct cross-site behavioural profiles, or share browsing activity with data brokers.
You can configure your web browser (Chrome, Safari, Firefox, Edge) to block or clear cookies at any time. Note that blocking strictly necessary cookies will prevent successful sign-in and platform usage.
Customer Funnels & User-Installed Pixels: If you install third-party tracking scripts, analytics tools, or advertising pixels (such as Meta Pixel, Google Analytics, or TikTok Pixel) on your published funnels, those third parties collect data subject to their independent privacy policies. You act as the Data Controller and assume sole responsibility for providing notice and obtaining any legally required user consents on your pages.
6 Data Security & Safeguards
We enforce robust administrative, physical, and technical safeguards designed to protect personal data against unauthorized access, loss, alteration, or disclosure:
7 Data Retention & Post-Cancellation Deletion Policy
We retain personal data and customer records only for as long as necessary to fulfill the purposes for which it was collected, maintain active customer accounts, or comply with legal obligations.
Upon the cancellation, non-renewal, or expiration of your Sofunnels platform subscription:
- 30-Day Retention Grace Period: Your account records, funnels, published pages, contacts, and form submissions are retained in an inactive state for a period of thirty (30) calendar days following the cancellation date or the expiration of your paid billing cycle.
- Permanent & Irreversible Deletion: Following the conclusion of this thirty (30) day cancellation period, all customer workspace data, funnels, contact lists, lead captures, orders, and submission logs are permanently, securely, and irreversibly deleted from our active production systems.
- Customer Export Duty: It is your sole responsibility to download and export any desired lead lists, contact records, or order data via your dashboard before the expiration of the 30-day post-cancellation window. Sofunnels shall have no liability whatsoever for any lost records or unrecoverable data resulting from automatic deletion following this 30-day grace period.
- Immediate Deletion Requests: Account holders may request expedited permanent deletion of their account and data prior to the 30-day window by contacting our privacy team at [email protected].
- Statutory Financial Records: Minimal billing, tax, and invoicing transactional logs may be retained solely for the statutory duration required by applicable financial and accounting laws. Routine disaster-recovery backup snapshots cycle out and are overwritten in accordance with standard backup rotation schedules.
8 International Data Transfers & European Rights (GDPR / UK GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you hold specific statutory rights under the General Data Protection Regulation (GDPR), UK GDPR, and Swiss FADP:
- Right of Access: You may request confirmation of whether we process your personal data and obtain a copy of that data.
- Right to Rectification: You may request correction of inaccurate or incomplete personal records.
- Right to Erasure (“Right to be Forgotten”): You may request deletion of personal data where continued processing is no longer legally justified.
- Right to Restrict & Object: You may restrict or object to specific processing activities based on legitimate interests.
- Right to Data Portability: You may request transmission of your personal data in a structured, machine-readable format.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your competent Data Protection Supervisory Authority.
9 California & United States State Privacy Rights
Under the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and applicable comprehensive state privacy statutes, residents of qualifying US states are entitled to specific disclosures:
Notice of No Sale or Sharing: Sofunnels does not sell your personal information and has not sold personal information in the preceding 12 months. Sofunnels does not share personal information for cross-context behavioral advertising.
Consumer Rights: Qualifying US residents have the right to know what personal data is collected, request deletion, request correction of inaccurate data, and not receive discriminatory treatment for exercising their privacy rights.
To exercise your statutory privacy rights, contact [email protected] with the subject “Privacy Rights Request”.
10 AI-Assisted Features & Generated Content
Sofunnels may offer automated artificial intelligence features for copy generation, headline assistance, and layout structuring. All AI-generated outputs are produced algorithmically and provided on an “AS IS” and “AS AVAILABLE” basis without warranties of factual accuracy, original authorship, or legal compliance.
You retain sole and absolute legal responsibility for reviewing, fact-checking, editing, and verifying all AI-assisted content before publishing it on your funnels or disseminating it to the public.
11 Children’s Privacy Protection
Sofunnels is strictly a commercial business-to-business platform designed for individuals aged 18 and older. We do not knowingly solicit, collect, or process personal data from children under the age of 16. If we become aware that personal data of a child under 16 has been collected without verified parental consent, we will promptly delete that information from our active databases. Accounts or funnels found unlawfully collecting data from children will be terminated immediately.
12 Third-Party Integrations, Webhooks & External Services
Sofunnels may provide capabilities to connect with third-party applications, external webhooks, email service providers, and payment processors. We are not responsible for the privacy policies, data handling practices, security controls, or terms of any third-party services. Your interactions with third-party services are governed exclusively by their respective policies.
13 Updates to this Privacy Policy
We may modify or update this Privacy Policy periodically to reflect technological, operational, legal, or regulatory changes. We will notify active account holders of material revisions via dashboard notification or email before the changes take effect. Continued use of the Sofunnels platform following the effective date of an updated policy constitutes your agreement to the revised terms.
14 Contact Our Data Privacy & Legal Office
For any inquiries regarding this Privacy Policy, data subject requests, Data Processing Addenda (DPA), or data deletion requests, please contact our dedicated Data Protection team: