Legal
Last updated 24 September 2026 · Version 2026-09-24
This Data Processing Addendum ("DPA") forms part of the Terms between you (the customer) and OpusFunnel, a company organised in the United States ("OpusFunnel", "we"). It applies whenever we process personal data for you. You accept it when you create an account, and we record the version you accepted. You do not need to sign anything else.
1.1 "Customer Personal Data" means personal data that you, your team or your clients put into OpusFunnel, or that OpusFunnel collects on your behalf through your pages, forms, stores, inboxes, numbers and connected accounts. "Data Protection Law" means US state privacy laws such as the California Consumer Privacy Act and, where they apply to personal data in OpusFunnel, the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection.
1.2 For Customer Personal Data you are the controller (or, if you act for your own client, a processor) and we are your processor (or sub-processor). Annex 1 describes the processing.
1.3 This DPA does not cover data we control ourselves, such as your account and billing details. Our Privacy Policy covers that.
1.4 OpusFunnel is offered to businesses established in the United States, not to businesses established in the EU, the EEA, the UK or Switzerland. For most customers the US state law terms in section 11 are the main terms; section 12 provides safeguards for any personal data of people in Europe that your data includes.
2.1 We process Customer Personal Data only on your documented instructions. The Terms, this DPA and the way you configure and use the service are your instructions. You can give further reasonable instructions in writing.
2.2 We may also process Customer Personal Data where the law requires us to, in which case we will tell you first unless the law forbids it.
2.3 Within your instructions, we also use Customer Personal Data to keep the service secure, prevent fraud and abuse, meter and bill usage, and meet carrier and legal obligations, for example monitoring opt-out rates and pausing texting when they cross our limits. We do not use it for any other purpose of our own, and we do not use it to train AI models.
2.4 We will tell you if we believe an instruction breaks Data Protection Law.
Everyone we authorise to process Customer Personal Data is bound by confidentiality, and has access only as far as their job needs.
4.1 We take the technical and organisational measures in Annex 2, which are designed to meet Article 32 of the GDPR. We may improve them over time but will not reduce the overall level of protection.
4.2 You are responsible for the security of your own account: who you invite, what roles you give them, and keeping sign-in details safe.
5.1 You give us general authorisation to use sub-processors. The current list is on our sub-processor page (Annex 3).
5.2 We will tell you at least 30 days before we add or replace a sub-processor, by updating that page and emailing the account owner. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may end the affected part of the service and we will refund any prepaid fees for it.
5.3 We put a written contract in place with each sub-processor that gives Customer Personal Data at least the protection this DPA requires, and we remain responsible to you for our sub-processors.
5.4 When you connect a third-party service yourself, such as your Stripe or PayPal account, a WhatsApp Business Account registered to your own Meta business, a social or ad network, or a webhook destination, that service is not our sub-processor. Your own agreement with it applies. How WhatsApp and Meta work is described on the sub-processor page.
6.1 Requests from individuals. The app lets you find, correct, export and erase contacts. Account owners and admins can export everything held about one person (for an access request) and erase a person. Erasing removes the person from the records that hold them, including their messages, form answers, call recordings and transcripts. Orders are kept for tax with the person's name, street address and tracking removed, a review they left stays with the author shown as "Former customer", and their opt-outs are kept in hashed form so they are not contacted again. Erasure is refused while the person has a live paid subscription with you; cancel it first. If you need more help answering a request, we will provide it. If an individual contacts us directly about your data, we will pass the request to you and not answer it ourselves unless you ask us to.
6.2 Assessments. We will give you the information you reasonably need for data protection impact assessments and consultations with supervisory authorities.
7.1 We will tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data.
7.2 We will give you, as it becomes available: what happened; the categories and approximate number of people and records affected; the likely consequences; and what we have done and will do about it. We will take reasonable steps to contain the breach and limit its effects.
7.3 Telling you about a breach is not an admission of fault.
8.1 While your account exists you can export your contacts from the app, and the account owner can download a copy of all of the account's data from Settings › Account & data. We will help with other exports on request.
8.2 Cancelling a paid plan does not end processing: the account moves to the Free plan and your data stays available to you.
8.3 When you ask us to close your account, with Close account in Settings › Account & data or in writing, we delete Customer Personal Data 30 days after the request, unless the law requires us to keep it. You can cancel the request until then. Copies in our backups roll off within a further 14 days. We will ask our sub-processors to delete the copies they hold.
8.4 Call recordings and transcripts are kept until you delete them in the app or close your account.
9.1 We will make available the information reasonably needed to show that we meet this DPA, including by answering security questionnaires and sharing our sub-processors' certifications and reports where they allow it.
9.2 If that information is not enough, or a supervisory authority requires it, you may audit our compliance once a year, on 30 days' written notice, during business hours, at your cost, with an auditor bound by confidentiality, and in a way that does not put other customers' data at risk.
These are the main data protection terms for our customers. Where US state privacy law applies, we act as your service provider or processor. We will:
We certify that we understand and will comply with these restrictions.
12.1 OpusFunnel is a US company and processes Customer Personal Data in the United States and in the other locations on the sub-processor page.
12.2 We do not offer OpusFunnel to businesses established in the EU, the EEA, the UK or Switzerland. If Customer Personal Data nonetheless includes personal data of people there, and European data protection law treats our processing of it as a restricted transfer, the safeguards in this section apply.
12.3 Standard Contractual Clauses. The Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference, as follows:
12.4 United Kingdom. Where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) is incorporated. Its Table 1 is completed with the parties' details in this DPA, Table 2 with the modules and options in section 12.3, Table 3 with the Annexes of this DPA, and in Table 4 either party may end the Addendum as its section 19 allows.
12.5 Switzerland. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with the changes it requires: references to the GDPR include the FADP, the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority, and people in Switzerland can bring claims there.
12.6 Data Privacy Framework. OpusFunnel is not certified under the EU-US Data Privacy Framework or its UK and Swiss extensions. The SCCs are the transfer mechanism.
12.7 Onward transfers. Where a sub-processor processes Customer Personal Data outside the country it was transferred to, we make sure an appropriate safeguard is in place, such as the SCCs or the provider's certification under the Data Privacy Framework.
12.8 Government access. If a public authority asks us for Customer Personal Data, we will tell you unless the law forbids it, check whether the request is lawful, challenge it where there are grounds, and disclose only the minimum required.
12.9 If the SCCs or the UK Addendum conflict with this DPA, they prevail.
13.1 If you are an agency and put your clients' personal data into OpusFunnel, you are usually your client's processor, and we are your sub-processor. Where the SCCs apply, Module 3 applies.
13.2 You must have a data processing agreement with each client that authorises us and our sub-processors and passes on obligations at least as protective as this DPA. White label hides our brand in the app, but your agreement with your client must still name us and our sub-processors.
13.3 You pass your clients' instructions to us, and we deal with you rather than your clients unless the law requires otherwise. The Agency Terms set out the rest.
14.1 This DPA lasts as long as we process Customer Personal Data for you.
14.2 Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the SCCs do not allow it.
14.3 If this DPA and the Terms conflict on data protection, this DPA prevails. If the SCCs conflict with either, the SCCs prevail.
14.4 We may update this DPA to reflect changes in law or in the service. We will not reduce its protections without your agreement, and we will tell you of material changes in advance.
| Item | Details |
|---|---|
| Parties | Data exporter: the customer, whose details are in its OpusFunnel account. Data importer: OpusFunnel, a company organised in the United States, whose registered address is available on request from support@opusfunnel.com; contact support@opusfunnel.com. |
| Subject matter | Providing the OpusFunnel service under the Terms. |
| Duration | For the life of the account, then until deletion under section 8. |
| Frequency | Continuous. |
| Nature and purpose | Hosting, storing and displaying pages and content; collecting form, booking and checkout data; running a CRM and shared inbox; sending and receiving email, texts and WhatsApp messages; handling and transcribing calls, including with an AI phone agent; running AI features; publishing to social networks and running ads and lead forms; running courses, memberships and affiliate programs; supporting the customer; securing and billing the service. |
| Categories of people | The customer's leads, contacts and prospects; buyers and store customers; members and students; people who book appointments; people who call or text the customer's numbers; people who comment on or message the customer's social accounts; people who fill in ad lead forms; people who leave reviews; partners in the customer's affiliate program; the customer's own clients and staff (for agencies). |
| Types of personal data | Names and contact details; messages (email, text, WhatsApp, social); call audio, recordings and transcripts; form, survey and quiz answers; orders, shipping addresses and payment metadata (not card numbers, which Stripe handles); appointments; course progress and certificates; reviews; social handles and comments; lead-form answers; AI prompts and outputs about contacts; lead scores and tags; consent and opt-out records; affiliate partners' payout details and tax forms; technical data such as referring page addresses. |
| Special categories | Not intended. The customer decides whether any are processed and is responsible for doing so lawfully (see section 10). |
| Retention | As the customer instructs while the account exists, then section 8. |
| Sub-processors | See Annex 3, for the processing described on that page. |
What we do not have yet is listed on the Security page.
The list of sub-processors, with what each one does, the data involved, where it is and the transfer safeguard, is on our sub-processor page, which forms part of this DPA.
Version history: 2026-09-24, first version.
Questions about this DPA: support@opusfunnel.com.
