Privacy Policy

1. Who we are, and which hat we are wearing

ConvexFlow (“we”) operates FunnelForge A.I., a tool that turns one offer into a complete lead-capturing funnel: a landing page, a segmenting quiz, lead magnets, email sequences and ads. For privacy questions, contact convexflow@gmail.com.

We handle personal data in two different roles, and your rights differ depending on which applies:

• As a controller, for our own customers — the people who sign up for and pay for FunnelForge A.I.. We decide why and how that data is used, and this policy governs it.
• As a processor, for leads— the visitors who fill in a form or complete a quiz on a page published by one of our customers. We hold that data only on that customer’s instructions. The customer is the controller. If you are a lead, this policy explains our handling, but the controller you should contact is the business whose page you filled in. Our terms for that role are in our Data Processing Addendum.

2. Data we collect

2.1 Customer data (we are the controller).

• Account data: your email and authentication data.
• Offer and brief content: the offer text or URL you submit, and the brief derived from it, which is sent to our AI provider to generate your funnel.
• Generated assets: the pages, quizzes, magnets, emails and ads produced for you, and your edits to them.
• Usage data: generations, the credit ledger, and product analytics.
• Payment data: handled by our payment processor; we do not store full card details.

2.2 Lead data (our customer is the controller; we are the processor).When a visitor uses a page published through the Service, we store, on the publishing customer’s behalf:

• Contact detailssubmitted to the opt-in form — typically an email address, and any additional fields the customer configured.
• Quiz answers and the segment they resolve to.
• Traffic data: UTM parameters and basic visit analytics.

We do not use lead data for our own purposes. We do not sell it, we do not use it to market to the lead, and we do not use it to train AI models.

3. How we use data

• To provide the Service (authentication, generation, publishing, lead capture, magnet delivery, billing).
• To meter and protect the Service (credits, rate limiting, abuse prevention).
• To improve the product and provide support — customer data only.

We do not use your content, or your leads’ data, to train AI models. Content is sent to our AI provider to produce your output and for no other purpose.

4. Legal bases (EU / UK GDPR)

For customer data we rely on: performance of our contract with you; our legitimate interests in operating and securing the Service; compliance with legal obligations; and your consent where required. For lead data we act only on the documented instructions of the customer who is the controller, and that customer is responsible for having a lawful basis to collect it.

5. US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know what personal information we hold, to access, correct, delete or obtain a portable copy of it, and to be free from discrimination for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. With respect to lead data we act as a service provider to our customer, and we are contractually prohibited from retaining, using or disclosing it for any purpose other than performing the Service. To exercise a right, contact us at the address in §1; if your request concerns lead data, we will refer you to the customer who controls it.

6. Sharing & sub-processors

We share data only with service providers acting on our behalf. The current list, with what each one receives and where it processes, is maintained at /subprocessors. We do not sell personal data.

7. International transfers

We are established in Brazil. Our database and file storage are hosted in Canada, and other providers process data in the United States. Where personal data is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies.

8. Retention

Customer data: kept while your account is active and for as long as required by law. The credit ledger is retained as a financial record. Deleting your account cascades your data.

Lead data:retained for as long as the controlling customer keeps it, and deleted or returned on termination of that customer’s account, as set out in the DPA. A lead’s deletion request is passed to the controller.

9. Your rights

Subject to applicable law, you may access, correct, export, delete, object to or restrict the processing of your personal data, and lodge a complaint with your supervisory authority. Contact us at the address in §1.

If you are a lead, direct your request to the business whose page you used. We will forward any request we receive to that customer and assist them in responding, but we cannot act on lead data without their instruction.

10. Security

Row-level security on every table, encryption in transit, least-privilege access, and validation at every boundary. Published pages are immutable snapshots. No system is perfectly secure; our breach-notification commitments for lead data are in the DPA.

11. Cookies and analytics

We use strictly necessary cookies for authentication. For product analytics we use PostHog, processing in the European Union, in a cookieless mode: it sets no cookies and persists nothing on your device, and it does not run on published funnel pages. For error monitoring we use Sentry (United States). We do not set analytics or advertising cookies. If that changes, this section and /subprocessors will be updated, and where consent is required it will be requested before any non-essential cookie is set.

12. Children

The Service is not directed to children and is not intended for anyone under 18.

13. Changes

We may update this policy; material changes will be notified in-product or by email.