Privacy Policy

Version 3.0

UEN 202556294D · 68 Circular Road, #02-01, Singapore 049422

Company no. 10169897 · Gw 522, 5th Floor, The Grange, 100 High Street, London N14 6BN, United Kingdom

Funnelish is operated by two companies that decide together how personal data is used on the platform and the funnelish.com websites, and are joint controllers of that data under the UK GDPR and EU GDPR, and jointly responsible organisations under Singapore’s Personal Data Protection Act (PDPA):

Under our arrangement, Funnelish Pte. Ltd. is responsible for the product, billing and accounts created from 21 October 2026, and Ginigo Ltd is responsible for accounts created before that date and for hosting and infrastructure during the transition. Whatever the split, you can exercise any right against either company through the single contact point below, and we will coordinate the response. Ginigo Ltd also acts as Funnelish Pte. Ltd.’s representative in the United Kingdom under Article 27 UK GDPR.

This policy explains how we use personal data when we decide why and how it is used. It covers you if you are:

We do not ask for special-category data (health, biometrics, religion, politics, sexual orientation and similar) and ask that you do not send it to us. If you build a store that collects such data from shoppers, you are responsible for the legal basis and consents, as the Terms of Service explain.

4. How we use personal. Data, and on what basis

Where the UK GDPR or EU GDPR applies, we rely on the legal bases shown. Elsewhere, we use data for the purposes shown and, where a law requires consent, we ask for it

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, except for automated fraud and abuse screening that may suspend an account pending human review. You may ask for human review of any such decision.

5. Funnelish AI and your data

Funnelish AI features send the prompts you write and relevant account data (such as your product catalogue, page content and store settings) to machine-learning models. Some of those models are operated by third-party providers under contracts that prohibit them from using your data to train their general-purpose models and that require deletion after processing, subject to short-term abuse monitoring where the provider requires it.

We may use prompts, outputs and usage patterns to operate, secure and improve Funnelish AI, including to evaluate and fine-tune models used only within the Funnelish platform. We do not sell this data. Shopper personal data is not used to improve AI features except in aggregated or de-identified form. If you want AI features disabled for your account, contact support.

6. Who we share data with

We share personal data only as described here, and never sell it.

• Between the two Funnelish companies, under our joint-controller arrangement, to run the platform and perform the contract with you.

• Service providers (processors) who act on our instructions: cloud hosting and content delivery (Google Cloud, Fastly), payments and billing (Stripe), email delivery and marketing automation, analytics and logging, AI model providers, customer support and ticketing, community platform, fraud prevention and sanctions screening, accounting and tax tools. A current list of sub-processors for merchant and shopper data is published at funnelish.com/sub-processors.

• Payment and partner platforms you connect, such as Stripe, Airwallex, PayPal, Shopify or an advertising platform, which receive the data needed for the integration and act as independent controllers under their own policies.

• Affiliates who referred you receive only the information needed to attribute and pay commissions, never your contact details.

• Professional advisers: lawyers, accountants, auditors and insurers, under confidentiality.

• Authorities and others where the law requires: to comply with a legal obligation, court order or lawful request; to protect the rights, property or safety of Funnelish, our customers, shoppers or the public; or to enforce our terms.

• A buyer or successor in a merger, acquisition, financing, reorganisation or sale of assets, in which case this policy continues to apply to the transferred data and we will notify you of any change of controller.

7. International transfers

We operate from Singapore and the United Kingdom and use providers in the United States, the European Economic Area and elsewhere. Your data may therefore be transferred to, and processed in, countries other than your own. Where data protected by the UK GDPR or EU GDPR leaves the UK or EEA, we rely on: adequacy decisions where they exist; the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, including between the two Funnelish companies; and supplementary measures such as encryption in transit and at rest. For transfers out of Singapore we ensure the recipient is bound to a standard of protection comparable to the PDPA. You can request a copy of the relevant safeguards at privacy@funnelish.com.

8. How long we keep data

We keep data longer where a legal hold, dispute or regulatory requirement needs it, and may keep aggregated, de-identified data indefinitely.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, network isolation, role-based access with least privilege, logging and monitoring, vulnerability management, and staff and contractor confidentiality obligations. Card payments are handled by PCI DSS-compliant providers; we do not store full card numbers. No system is perfectly secure, so please keep your own credentials safe, enable two-factor authentication, and tell us immediately if you suspect a problem. If a breach affects your personal data in a way the law requires us to report, we will notify you and the relevant authority without undue delay.

10. Your rights

Depending on where you are, you may have the right to:

• access the personal data we hold about you and receive a copy;

• correct inaccurate or incomplete data (most account data can be changed in Settings);

• delete your data, subject to records we must keep;

• restrict or object to processing, including objecting at any time to direct marketing and to     processing based on legitimate interests;

• port data you gave us to another provider in a structured, machine-readable format;

• withdraw consent where processing is based on consent, without affecting earlier processing;

• not be discriminated against for exercising any right.

To exercise a right, email privacy@funnelish.com from the address on your account, or write to the postal address in section 1. We may ask you to verify your identity and, if you act for someone else, your authority. We respond within one month (UK and EU), 30 days (Singapore) or 45 days (U.S. states), extendable where the law allows for complex requests, and we will tell you if that happens. We do not charge for requests unless they are manifestly unfounded or excessive.

United Kingdom and European Economic Area

You may complain to your data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the authority in your country, listed at edpb.europa.eu. We would appreciate the chance to resolve your concern first.

Singapore

You may request access to and correction of your personal data, and withdraw consent, under the PDPA by contacting our Data Protection Officer at the address in section 1. Withdrawing consent may mean we cannot continue to provide some or all of the Services.

United States (California and other states)

If you are a California resident, the categories of personal information we collect and the purposes are described in sections 3 and 4; the sources are listed in section 3; and the categories of recipients in section 6. We do not sell personal information. We may “share” identifiers and internet activity with advertising partners for cross-context behavioural advertising through cookies on our marketing sites; you can opt out through the cookie settings link in the footer of funnelish.com or by enabling the Global Privacy Control signal in your browser, which we honour. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA. You have the rights to know, delete, correct, opt out of sharing, limit use of sensitive data, and not be discriminated against; an authorised agent may act for you with written permission. Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with comparable laws have similar rights and may appeal a refusal by replying to our decision. Much of the data we hold about merchants is business-contact data that some state laws exempt; we apply the rights above regardless.

Other countries

Residents of Australia, Canada, Brazil, Switzerland and other countries with data protection laws may exercise the rights those laws provide through the same contact. We will apply the law that protects you.

11. Shopper data: our role as processor

When merchants use Funnelish to run their stores, we process their shoppers’ data — names, contact details, order and payment information, browsing on the store, messaging preferences — solely to provide the Services to the merchant and on the merchant’s documented instructions, under our Data Processing Addendum. The DPA sets out our security commitments, sub-processor terms, breach notification, assistance with data-subject requests, audit rights, and the transfer mechanisms we use. We do not use shopper data to market to shoppers, and do not use it to improve our products except in aggregated or de-identified form. Merchants are responsible for publishing their own privacy policy, obtaining consents for cookies and marketing on their stores, and responding to their shoppers’ requests.

12. Cookies and similar technologies

We use cookies, local storage, pixels and similar technologies on funnelish.com and in the platform. They fall into four groups:

• Strictly necessary: sign-in, session security, fraud prevention, load balancing and remembering your choices. These do not require consent.

• Functional: preferences such as language and editor settings

• Analytics: understanding how our sites and platform are used, using our own analytics and third-party tools, with IP addresses truncated where possible.

• Marketing: advertising pixels (for example from Google, Meta and LinkedIn) on our marketing sites, used to measure campaigns and show relevant ads elsewhere.

In the UK, the EEA and other places that require it, we ask for your consent before setting non-essential cookies and you can change your choice at any time through the cookie settings link in the footer. Everywhere, you can block or delete cookies in your browser, which may affect how the sites work. Cookies set by stores built on Funnelish are controlled by the merchant.

13. Marketing communications

We send marketing emails about Funnelish to business contacts who have signed up, asked for information or otherwise expressed interest. Every marketing email has an unsubscribe link, and you can also opt out from your account settings or by emailing us. Opting out does not stop service and billing messages we must send to run your account.

14. Children

The Services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

15. Changes to this policy

We will update this policy when our practices or the law change. Material changes will be announced by email to account owners or by a notice in the platform at least 30 days before they take effect, except where a change is needed sooner to comply with the law. The effective date at the top shows the current version; earlier versions are available on request.

16. Contact