Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains how Subscribe Funnels, LLC (“Subscribe Funnels,” “we,” “us,” or “our”) handles personal information. It applies to subscribefunnels.com, our funnel and page building platform, and related services, including the SubscribeFunnels app for Shopify (together, the “Services”).

1. Our Different Roles — Please Read First

We handle distinct categories of personal information, and our role and responsibilities differ for each. This distinction runs through the whole of this Policy.

1.1 Information about our Subscribers — we are the controller

When a business registers for, pays for, or uses the Services, we decide how and why we handle that business’s account, billing, and usage information. For this information we act as the controller (and, under U.S. state privacy laws, the business). Sections 3, 5, 6, and 12 describe this.

1.2 Information about Visitors to Subscriber funnels — we are only a processor

Our Subscribers build pages and forms (“Funnels”) using our tools. When a member of the public (a “Visitor”) fills in a form or interacts with a Funnel, we handle that information solely on the instructions of, and on behalf of, the Subscriber who operates that Funnel. For this information the Subscriber is the controller (or business), and we act only as the processor (or service provider). Section 4 describes this.

If you are a Visitor: we do not decide what a Funnel collects, why it collects it, or what happens to it afterwards. The business operating that Funnel does. To exercise your rights or ask questions about your information, contact that business directly, using the contact details and privacy notice published on its Funnel. If you contact us instead, we will forward your request to the relevant Subscriber where we are able to identify them, and we will act on that Subscriber’s instructions.

1.3 White-label arrangements — we may be a sub-processor

Some businesses (“Partners”) resell or provide our platform to their own clients (“End Clients”) under the Partner’s brand. Where this happens, the Services may operate under a name and on a domain that do not identify Subscribe Funnels.

In these arrangements the End Client is the controller, the Partner is the processor, and Subscribe Funnels acts only as a sub-processor, several steps removed from the individual whose information is involved. We have no direct relationship with End Clients or with their Visitors, and we act solely on instructions passed down through the Partner.

If you are an End Client or a Visitor to an End Client’s funnel: contact the business you actually deal with. That business, or its Partner, is responsible for answering your questions and handling your rights requests. Where we receive a request directly and can identify the Partner concerned, we will forward it and act on their instructions.

Partners are contractually required to disclose Subscribe Funnels as a sub-processor to their End Clients, notwithstanding any branding applied to the platform. We do not permit any Partner to represent that no third-party platform is involved in the processing of their clients’ data.

2. What We Do Not Do

Because the scope of our processing is narrow, it is worth stating plainly what falls outside it:

We are not a CRM. The Services do not include customer relationship management functionality. We do not build, maintain, segment, enrich, deduplicate, score, profile, or nurture contact databases.
We do not market to Visitors. We never use Visitor information to send our own marketing, to build audiences, or to advertise to Visitors.
We do not receive payment card data. Funnel payment and order forms transmit payment information directly from the Visitor’s browser to the third-party service the Subscriber has selected. Card numbers, security codes, and related payment credentials are not transmitted to, received by, or stored on Subscribe Funnels systems.
We do not sell or share personal information as those terms are defined under U.S. state privacy laws, and we have not done so in the preceding twelve months.
We do not use personal information to train artificial intelligence or machine learning models.

3. Information We Collect About Subscribers

3.1 Information you give us

Account information: name, business name, email address, telephone number, business address, username, and password.
Billing information: billing address, tax identifiers, plan and subscription details, transaction history, and the last four digits and expiry date of your payment card. Full card details are collected and stored by our payment processor, not by us.
Support and communications: the content of your messages to us, support tickets, and any attachments you send.
Marketing and event information: preferences, survey responses, and testimonials you choose to provide.
Affiliate information: where you join our affiliate program, the identifiers, payout details, and referral data required to administer it.

3.2 Information collected automatically

Device and connection data: IP address, browser type and version, operating system, device identifiers, language, and time zone.
Usage data: pages viewed within our application, features used, actions taken, dates and times of access, referring URLs, and session duration.
Cookies and similar technologies: as described in Section 7.

3.3 Information from other sources

We may receive information from our payment processor, our affiliate platform, fraud prevention providers, and publicly available sources, and from any person who registers an account on your behalf.

4. Information We Process About Visitors on Subscribers’ Behalf

4.1 When we host a Subscriber’s Funnel, we may process the following on that Subscriber’s behalf and at their direction:

information a Visitor submits through a form, which is determined entirely by the Subscriber and commonly includes name, email address, and telephone number;
technical data such as IP address, browser and device information, and pages viewed on the Funnel; and
data collected by any tracking technology, pixel, tag, or custom code that the Subscriber has chosen to add to the Funnel.

4.2 We process this information only to host and deliver the Funnel, to transmit submissions to the third-party service the Subscriber has designated, to maintain security and prevent abuse, and to provide support to the Subscriber. We process it only on the Subscriber’s documented instructions and in accordance with our Data Processing Addendum.

4.3 Form submissions are transmitted to the Subscriber’s chosen third-party service. Once transmitted, that information is held and processed by that service under its own terms and privacy policy. We do not control it and are not responsible for it.

4.4 Subscribers are contractually required to publish their own privacy notice on every Funnel, to establish a lawful basis for their processing, to obtain all required consents including for cookies and tracking technologies, and to respond to Visitor rights requests. We do not verify whether they have done so, and we are not responsible for their compliance.

4.5 Subscribers are prohibited from configuring Funnels to collect special categories of data, government identification numbers, financial credentials, health information, or information about children. We do not monitor Funnels for compliance with this restriction.

4.6 Where a Funnel is operated by an End Client under a Partner’s white-label arrangement, the instructions we act on reach us through the Partner rather than directly from the controller. We do not receive, hold, or verify information about End Clients’ identities, purposes, lawful bases, or notices, and we are not in a position to confirm whether an End Client has met its obligations. Responsibility for that sits with the End Client as controller and the Partner as processor.

5. How We Use Subscriber Information

We use the information described in Section 3 to:

create and administer your account and authenticate you;
provide, host, maintain, and support the Services;
process payments, manage subscriptions and renewals, and issue invoices;
send service and transactional communications, including trial expiry notices, billing notices, security alerts, and changes to our terms — you cannot opt out of these while you hold an account;
respond to your enquiries and provide customer support;
monitor, secure, and improve the Services, diagnose faults, and develop new features;
detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
send marketing communications about our products and services, subject to your right to opt out at any time;
administer our affiliate program; and
comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

6. Legal Bases for Processing (EEA, Switzerland, and UK)

Where the EU or UK General Data Protection Regulation applies to our processing of Subscriber information, we rely on the following legal bases:

Performance of a contract — to provide the Services, administer your account, and process payments.
Legitimate interests — to secure and improve the Services, prevent fraud and abuse, conduct direct marketing to business contacts, and defend legal claims. We balance these interests against your rights.
Legal obligation — to meet tax, accounting, and regulatory requirements and to respond to lawful requests.
Consent — for non-essential cookies and where else required. You may withdraw consent at any time without affecting prior processing.

For Visitor information we act as processor, and the legal basis is determined by the Subscriber, not by us.

7. Cookies and Similar Technologies

7.1 On our own website and application we use:

Strictly necessary cookies for authentication, session management, load balancing, and security. These cannot be disabled.
Functional cookies to remember preferences.
Analytics cookies to understand how our application is used.
Marketing cookies to measure the effectiveness of our own campaigns and to attribute affiliate referrals.

7.2 Where required by law we obtain consent before setting non-essential cookies, and you may change your choices at any time through our cookie settings control or your browser.

7.3 Cookies on Subscriber Funnels are the responsibility of the Subscriber. Any analytics, advertising, or tracking technology on a Funnel is placed there by the Subscriber operating it. Obtaining consent for those technologies and disclosing them is that Subscriber’s obligation.

7.4 Our application does not currently respond to browser Do Not Track signals. We honor Global Privacy Control signals where required by applicable law.

8. When We Disclose Information

We do not sell personal information. We disclose it only as follows:

Sub-processors and service providers — hosting and infrastructure, content delivery, payment processing, email delivery, analytics, customer support tooling, affiliate tracking, and security providers, each bound by written terms restricting their use of the information to the provision of services to us. A current list is available at [SUBPROCESSOR LIST URL].
At a Subscriber’s direction — we transmit Visitor form submissions to the third-party service that Subscriber has designated.
Legal and regulatory — where required by law, subpoena, court order, or other legal process, or to a regulator or law enforcement body.
Protection of rights — where we reasonably believe disclosure is necessary to investigate or prevent fraud, abuse, or security threats, to enforce our agreements, or to establish, exercise, or defend legal claims.
Corporate transactions — in connection with a merger, acquisition, financing, reorganization, insolvency, or sale of all or part of our business, subject to the recipient honoring this Policy.
With your consent — where you direct or authorize disclosure.

9. International Data Transfers

9.1 We are based in the United States, and our infrastructure and service providers are located in the United States and other countries. Information we hold will be transferred to and processed in the United States.

9.2 Where we transfer personal information out of the EEA, Switzerland, or the United Kingdom, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss addendum where applicable, together with supplementary technical and organizational measures where required. A copy of the relevant safeguards may be requested at [email protected].

9.3 Transfer arrangements for Visitor information processed on a Subscriber’s behalf are set out in our Data Processing Addendum.

10. Data Retention

10.1 We keep Subscriber account information for as long as the account is active and for a reasonable period afterwards, and we keep billing and tax records for the period required by law, typically seven years.

10.2 Visitor information is retained for the period the Subscriber instructs, or until the Subscriber deletes it or their account closes. On termination we may delete Funnels and associated data. Subscribers should export their data before cancelling.

10.3 We may retain information longer where necessary to comply with legal obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. Backup copies may persist for a limited period before being overwritten in the ordinary course.

11. Security

11.1 We implement technical and organizational measures designed to protect personal information, including encryption in transit, access controls, authentication requirements, logging, and regular review of our practices.

11.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials, for enabling available security features, and for controlling who has access to your account.

11.3 Subscribers are responsible for the security of any custom code, script, or third-party integration they add to a Funnel, and for the security practices of any third-party service to which their Funnel transmits data.

12. Your Privacy Rights

These rights apply to information for which we are the controller — that is, Subscriber information. For information collected through a Subscriber’s Funnel, please contact that Subscriber, as explained in Section 1.2.

Subject to conditions and exemptions, you have the right to: access your personal information; correct inaccurate information; request erasure; restrict processing; object to processing carried out on the basis of legitimate interests, including direct marketing; receive your information in a portable format; withdraw consent at any time; and not be subject to decisions based solely on automated processing producing legal or similarly significant effects. We do not carry out such automated decision-making.

You may lodge a complaint with your local supervisory authority. In the United Kingdom this is the Information Commissioner’s Office. We ask that you contact us first so we can try to resolve the matter.

EU representative (Article 27): [EU REPRESENTATIVE NAME, ADDRESS, EMAIL]

UK representative (Article 27): [UK REPRESENTATIVE NAME, ADDRESS, EMAIL]

12.2 United States

Depending on your state of residence, you may have the right to: know what personal information we collect, use, and disclose; access and obtain a copy of it; correct inaccuracies; delete it; obtain it in a portable format; opt out of sale, sharing, or targeted advertising; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

We do not sell or share personal information, and we do not use it for targeted advertising or profiling with legal or similarly significant effects. We do not knowingly collect sensitive personal information from Subscribers beyond what is necessary to administer accounts and payments.

Oregon residents may additionally request a list of the specific third parties to which we have disclosed personal information.

12.3 How to exercise your rights

Submit a request to [email protected]. We will verify your identity, usually by confirming control of the email address associated with your account, and may request further information where necessary. We respond within the period required by applicable law, generally within 30 to 45 days, and may extend that period where permitted, with notice.

An authorized agent may submit a request on your behalf with proof of authorization. Where we deny a request, we will explain why and, where applicable, how to appeal. To appeal a decision, reply to our response with the word “Appeal.” If your appeal is denied, you may contact your state attorney general.

13. Marketing Communications

You may opt out of our marketing emails at any time using the unsubscribe link in any such message, or by writing to [email protected]. You cannot opt out of service and transactional messages while you hold an account. Where you have provided a mobile number and consented to receive text messages from us, you may withdraw consent by replying STOP; message and data rates may apply.

14. Children

14.1 The Services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have done so, we will delete it. Contact us at [email protected] if you believe a minor has provided us information.

14.2 Subscribers are prohibited from using Funnels to collect information from children. Where a Funnel nonetheless does so, the Subscriber operating it is solely responsible for compliance with the Children’s Online Privacy Protection Act, the UK Age Appropriate Design Code, and any comparable law.

15. Subscriber and Partner Obligations

15.1 If you operate a Funnel using our Services, you are required under our Terms of Service to: publish an accurate and legally compliant privacy notice on every Funnel; establish and document a lawful basis for your processing; obtain all consents required for cookies, tracking technologies, and electronic marketing; honor Visitor rights requests; and comply with all applicable privacy, marketing, and anti-spam laws. We provide tools, not compliance. We cannot give you legal advice and recommend you obtain your own.

15.2 If you are a Partner reselling or providing the Services to End Clients, you are additionally required to: obtain authorization from each End Client to engage sub-processors; identify Subscribe Funnels, LLC as a sub-processor in your data processing terms and privacy disclosures; bind each End Client to privacy and data protection obligations at least as protective as those in the Agreement; pass through and respond to rights requests, deletion instructions, and incident notifications; and maintain records sufficient to identify each End Client on request. You remain fully responsible to your End Clients for our processing, and jointly and severally liable for their acts and omissions.

16. Third-Party Sites and Services

The Services and Subscriber Funnels may link to or integrate with websites and services we do not control. This Policy does not apply to them, and we are not responsible for their practices. Review their privacy policies before providing information.

17. The SubscribeFunnels App for Shopify

This section applies when a Subscriber connects a Shopify store to the Services using the SubscribeFunnels app for Shopify (the “Shopify App”). It supplements the rest of this Policy. In it, the “merchant” is the Subscriber who owns the connected store, and a “shopper” is anyone who visits that store.

17.1 Our role

For the merchant’s store connection and settings we act as described in Section 1.1. For information about shoppers, the merchant is the controller and we act only as a processor, as described in Section 1.2.

17.2 Information we receive from Shopify

Store details: the store’s myshopify.com domain and the permissions (access scopes) the merchant approved when installing the Shopify App.
Access tokens: the tokens Shopify issues at installation, which let us call Shopify’s APIs for that store. They are kept on our servers and are never sent to the storefront or to shoppers’ browsers.
Theme settings: the settings of the store’s live theme, read only to show the merchant whether the Shopify App’s app embed is switched on.
Product and cart information: the Shopify App’s permissions allow it to read the store’s products and, through Shopify’s Storefront API, cart contents. We use this only to provide features the merchant switches on.

The Shopify App does not request access to the store’s customers or orders, and we do not receive or store Shopify customer records.

17.3 Settings the merchant gives us

We store the settings the merchant enters in the Services for the store, such as head and body code for the storefront, the setting that switches the Shopify App’s storefront code on or off, and any redirect settings.

17.4 On the merchant’s storefront

17.4.1 When the merchant switches on the app embed, each storefront page loads a script from our servers, which then reads the store’s settings from us. These requests carry the store’s domain and the technical data any web request carries, such as IP address and browser details, which our servers may log to operate and secure the Services. The settings we return contain no personal information.

17.4.2 The script adds the head and body code the merchant configured to the storefront. Any information that code collects, and any cookies it sets, are the merchant’s responsibility, as described in Sections 4.1 and 7.3.

17.4.3 Where the merchant has switched on features that send shoppers from the store to the merchant’s Funnels, the script may save the UTM parameters and advertising click identifiers (such as fbclid, gclid, and ttclid) from a shopper’s first visit in a first-party cookie named sf_attribution on the store’s domain for up to 30 days. When the shopper is sent to the Funnel, the script passes those values, together with the shopper’s cart contents, currency, country, discount code, and Shopify cart token, to the Funnel in its web address. Information the shopper then provides on the Funnel is handled as described in Section 4.

17.5 Uninstalling and data deletion

Uninstalling: when the merchant uninstalls the Shopify App, we mark the store as disconnected and delete its access tokens. We keep the merchant’s settings so they are restored if the store is reconnected.
Store erasure: when Shopify tells us a store’s data must be erased (the request Shopify sends after a store uninstalls an app), we delete that store’s settings and any remaining tokens.
Customer requests: because we do not store Shopify customer records, a customer data request or customer erasure request we receive from Shopify has no Shopify customer data of ours to return or delete. Information a shopper provided on a merchant’s Funnel is handled as described in Sections 4 and 10.2; to exercise your rights over it, contact that merchant.
On request: a merchant may ask us to delete the store’s data at any time by writing to [email protected].

17.6 Security

We verify Shopify’s signature on every installation and on every notification Shopify sends us, and we access each store only through the permissions its merchant approved.

18. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with an updated “Last updated” date, and where changes are material we will provide additional notice by email or in-product. Continued use of the Services after the effective date constitutes acceptance.

19. Contact Us

Subscribe Funnels, LLC
PO BOX 31013
Portland, OR 97231
Email: [email protected]

For privacy requests, please include enough detail for us to identify your account and understand your request.