Legal
Last updated 24 September 2026 · Version 2026-09-24
This policy explains what personal data we collect, why, who else receives it, and what you can do about it. It covers our customers, the people on their teams, visitors to our websites and the partners in our partner program. It also explains, more briefly, how we handle the data our customers put into OpusFunnel about their own contacts.
OpusFunnel is operated by OpusFunnel, a company organised in the United States ("we", "us"). Our registered address is available on request from support@opusfunnel.com.
For the personal data described in this policy we are the controller, except where Data we process for customers says we act for a customer.
Where we operate. OpusFunnel is currently offered to businesses established in the United States. It is not offered to businesses established in the European Union, the European Economic Area, the United Kingdom or Switzerland, and sign-up asks for your business's country. For that reason we have not appointed representatives in the EU or the UK. The rights described below are ones we give everyone, wherever they are.
| Contact | Details |
|---|---|
| Privacy questions and requests | support@opusfunnel.com, with "Privacy request" in the subject line |
| Data protection officer | Not appointed. Privacy questions go to support@opusfunnel.com. |
| General support | support@opusfunnel.com |
We are the controller for data about our own customers and their team members, visitors to opusfunnel.com and partners.opusfunnel.com, people who try the builder before signing up, partners in our own partner program, and anyone who writes to us.
We are a processor for the data our customers load into OpusFunnel about their own contacts, leads, buyers, students, callers, social followers and partners. The customer is the controller and decides why that data is used. We process it under our Data Processing Addendum. If the customer is an agency acting for its own client, the agency may be the processor and we are its sub-processor.
As a processor we use customer data only to provide the service to that customer, and to keep the service secure, prevent abuse, meter and bill usage, and meet our legal and carrier obligations. We do not sell it, and we do not use it to train AI models.
The sign-up form asks where your business is based, and for your company, name, email and, optionally, a phone number. We record that you ticked to accept our terms, with your IP address. For a paid plan, Stripe's checkout page also collects your card, billing address and phone. At present, for a paid plan, these details are passed to our checkout function in the page address, so they can appear in that function's technical logs.
On the "Build my funnel free" page we collect your answers about your business and the site our AI builds from them. We record your IP address to limit how many builds one person can start in a day.
We have no advertising pixels, analytics trackers or tag managers on our websites or in the app.
Your name, email address and what you tell us.
To open an account we need your name and email address, and for a paid plan, payment details. Without them we cannot provide the service. To text in the US, carriers require the registration details above. Partners must give payout details, and a tax form when we ask for one, before we can pay them. Everything else is optional.
Most of it comes from you. We also receive data from:
The table shows each purpose and the legal basis we rely on, in the terms used by laws such as the GDPR.
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and providing the features you use | Contract |
| Taking payment, charging usage to your balance, issuing invoices | Contract |
| Keeping tax and accounting records | Legal obligation |
| Registering your business with carriers so you can text in the US | Contract |
| Running AI features on your content when you use them | Contract |
| Recording which versions of our terms you accepted | Contract, and legitimate interests (being able to show what was agreed) |
| Security, fraud and abuse prevention, including monitoring messaging quality and pausing texting when opt-out or failure rates cross our limits | Legitimate interests (keeping the platform safe and meeting carrier rules) |
| Support, and emails about your account, security and changes to our terms | Contract |
| Improving the product and diagnosing faults | Legitimate interests |
| Marketing email about OpusFunnel | Consent where the law requires it; otherwise legitimate interests for existing business customers. You can unsubscribe at any time. |
| Partner referral cookies | Legitimate interests (crediting the partner who referred you). You can delete or block them at any time. |
| Letting you try the builder before you sign up | Steps you ask for before a contract, and legitimate interests |
| Running the partner program: approving, tracking, paying | Contract |
| Collecting partners' tax forms and meeting tax reporting duties | Legal obligation |
| Dealing with legal claims, and requests from authorities where the law requires us to answer | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see Your rights).
We use service providers to run OpusFunnel. They process data for us under contract and only for the purpose we engage them for. The current list, with what each one does and where, is on our sub-processor page. In summary:
Others who may receive data, under their own terms rather than as our providers:
We do not sell personal data. We do not share it for cross-context behavioural advertising.
Several features use AI: the inbox assistant and workflow agents, the AI phone agent, the in-app assistant, lead scoring, copy and content generation, replies to reviews and social comments, image ads and photos, and knowledge-base search. When you use them, the content they need is sent to the AI provider that runs them: Anthropic for most text, OpenAI for images, search and some text, and Telnyx for the phone agent. The AI Terms list what each feature sends.
We do not use your data to train AI models. Under their business terms, Anthropic and OpenAI do not train their models on data we send through their APIs (OpenAI would only if we opted in), and Telnyx does not use it to train models offered to others, except in de-identified form. The AI Terms say how long each provider keeps data.
AI output can be wrong. It never makes decisions about you as our customer that have legal or similarly significant effects.
We are a US company and store data in the United States.
| What | Where |
|---|---|
| Database, files, sign-in and server functions (Supabase) | United States (AWS us-west-1, California) |
| The web app (Google Cloud Run) | United States (us-central1, Iowa) |
| Website and page delivery, security (Cloudflare) | Cloudflare's global network, nearest to the visitor |
| Email (Resend) | United States |
| Other providers | See the sub-processor page |
OpusFunnel is not offered to businesses in the EU, the EEA, the UK or Switzerland. Personal data about people there can still reach us, for example when they visit our website or are contacts of a US customer. It is then processed in the United States and protected as follows:
To get a copy of the safeguards we use, write to support@opusfunnel.com.
These are our standard periods.
| Data | How long |
|---|---|
| Your account and content while the account exists | For as long as the account exists. Cancelling a paid plan does not delete anything: the account moves to the Free plan and keeps your content. We do not delete Free or inactive accounts automatically. |
| Your account and content after you ask us to close the account | Deleted 30 days after you ask us to close the account, except the records below that we must keep. Backup copies roll off within a further 14 days. |
| Billing, invoices and wallet transactions | At least as long as tax and accounting law requires us to keep them |
| Records of which terms you accepted | For as long as the account exists, and afterwards for as long as a claim about the agreement could be brought |
| Guest builds made before sign-up, and the IP address used to limit them | If not claimed, they become eligible for deletion 7 days after they were made and are removed at the next clean-up |
| Partner records, payout details and tax forms | 7 years, for tax purposes |
| Support emails | 3 years |
| Server and request logs | 30 days |
| Backups | Roll off within 14 days |
Data we hold for customers, such as their contacts and messages, is kept as the customer instructs. Call recordings and transcripts are kept until the customer deletes them or closes the account. See the Data Processing Addendum.
Data is encrypted in transit and at rest by our hosting providers. Each customer's data is kept apart by row-level security in the database. Card details are handled by Stripe and never reach our servers. The Security page has more detail, including what we do not have yet.
No system is perfectly secure. If a breach affects personal data we control, we will tell the relevant supervisory authority within 72 hours where the law requires, and tell the people affected without undue delay where there is a high risk to them. If a breach affects data we process for a customer, we tell that customer without undue delay, as the Data Processing Addendum sets out.
Depending on where you live, you can ask us to:
Your right to object. You can object at any time to our use of your data based on legitimate interests. You can also object to direct marketing at any time, and we will stop.
How to use your rights. Email support@opusfunnel.com, with "Privacy request" in the subject line. We may ask you to confirm your identity, for example by replying from the email address on your account. We answer within one month (45 days for US state law requests), and tell you if we need longer. There is no charge.
Some things you can do yourself: edit your profile in the app, download a copy of your account's data from Settings › Account & data, unsubscribe using the link in any marketing email, and reply STOP to texts. To close your account, use Close account in Settings › Account & data, or write to us. Its data is deleted 30 days after the request, and you can cancel the request until then.
If your data is in a customer's OpusFunnel account (for example, you bought from or were contacted by a business that uses OpusFunnel), ask that business. It controls the data. If you write to us, we will pass your request on.
We would like the chance to fix a problem first, so please write to us. You also have the right to complain to a supervisory authority:
We do not make decisions about you, as our customer, based solely on automated processing that have legal or similarly significant effects.
Some safety checks are automatic. For example, texting is paused when a workspace's opt-out or failure rate crosses our limits. These affect a feature, not your legal rights, and you can ask a person to review them.
Customers can use AI lead scoring on their own contacts. That is the customer's processing, not ours; see the AI Terms for the limits we set on it.
OpusFunnel is a business service for adults. You must be at least 18 to use it, and we do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
Customers must not use OpusFunnel to collect data from children under 13, or under 16 in the EU, unless they meet the rules that apply (such as COPPA in the US and parental consent rules in the EU).
Our websites set no analytics or advertising cookies. The only cookies on them that are not strictly necessary are the partner referral cookies, set when you arrive through a partner's link. The Cookie Policy lists every cookie and similar technology we use, and how to delete or block them.
This section is for residents of California and other US states with consumer privacy laws. It covers the last 12 months.
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, phone, IP address, account ID | Hosting, email, payment and support providers |
| Customer records | Postal address, payment references, business registration details | Stripe, Telnyx and carriers (for texting registration) |
| Commercial information | Plan, purchases, wallet transactions, commissions | Stripe; PayPal for payouts (as an independent controller) |
| Internet or network activity | Logs, pages visited in the app, errors | Hosting providers |
| Professional information | Company name and role | Hosting providers |
| Sensitive personal information | Account sign-in details; partners' taxpayer identification numbers on tax forms | Hosting providers (stored only); PayPal does not receive tax forms |
Sources and purposes are described under Where it comes from and Why we use it. We do not create inferences about you.
No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We have no advertising pixels on our websites. We do not knowingly sell or share the data of anyone under 16.
Sensitive personal information is used only to provide the service, secure accounts and meet tax duties. We do not use it to infer characteristics about you, so there is no need for a "limit" request.
Your rights: to know what we collect, use and disclose; to delete; to correct; and not to be discriminated against for using these rights. You can use them yourself or through an authorised agent, who must show your written permission. We verify requests by matching them to information we already hold, usually your account email. We answer within 45 days, extendable once by 45 days with notice.
Retention is explained under How long we keep it.
Our customers use OpusFunnel to hold data about their contacts, leads, buyers, members, students, callers and social followers, and about the partners in their own affiliate programs. That can include names, contact details, messages, call recordings and transcripts, form answers, orders, reviews and lead-form answers.
For that data the customer is the controller and its own privacy notice applies. We act on its instructions under the Data Processing Addendum, and our sub-processors process it for us. If you want to use your rights over that data, contact the business. If you contact us, we will pass your request on and help the business answer it.
If we change this policy in a way that matters, we will email account owners before the change takes effect. The version and date at the top always show the current policy.
Version history: 2026-09-24, full rewrite (who we are, partners, AI, transfers, retention, US state rights). 2026-08-20, previous version.
Privacy questions or requests, and anything else: support@opusfunnel.com. For a privacy request, put "Privacy request" in the subject line. A person will answer.
