Privacy Policy

1. Who we are

ElasticFunnels ("EF", "we", "us") is operated by Elastic Funnels, LLC, a Delaware company. We provide a SaaS platform for building, testing and scaling online sales funnels. A Delaware C-Corp parent with a Romanian operating subsidiary is in progress; this Privacy Policy will be updated when that conversion completes.

2. Your data and your customers' data

This policy covers two different things, and the difference matters:

• Your data. Data about you, our customer, and your team: your account, billing and support conversations, and your visits to this website. For this data we are the controller, and this policy governs it.
• Your customers' data. Data your funnels collect about other people: buyers at your checkout, leads and contacts in your CRM, callers handled by your call center, visitors to your pages, and the affiliates who promote your offers. For this data you are the controller and we are your processor. We handle it on your instructions to run the Service, and for no other purpose.

If you bought from, signed up with, or spoke to a business that uses ElasticFunnels and you want your data accessed or deleted, contact that business. It decides what happens to your data. If you cannot identify it, write to us and we will pass your request on.

3. What data we collect

As controller, we collect the following categories:

• Account data. Name, email, password (stored hashed, never in plain text), company name, role, billing information.
• Usage data. Pages, funnels, contacts, orders, automations and other content you create or upload.
• Technical data. IP address, user agent, request logs, error logs and performance metrics. Used for security, debugging and operations.
• Support and sales conversations. Emails, demo bookings and messages you send us.
• Cookies. Session cookies for sign-in and security. What this marketing website sets is listed in our Cookie Policy.

4. Data we process for you

ElasticFunnels runs the parts of your business that touch your customers directly, so it handles more personal data than a page builder. The categories below are what the Service can process on your behalf. What is actually collected depends on the features you turn on and the fields you configure.

4.1 Checkout and payment data

When a buyer checks out on an ElasticFunnels checkout, we process what the checkout asks for: typically name, email, phone, billing and shipping address, the products ordered, amounts, taxes, and the outcome of the payment. We also record the IP address, device and browser of the order, which is used for fraud screening and for your analytics.

Card details are passed to the payment processor that handles the transaction (for example Stripe, NMI, PayPal, Klarna and Authorize.net, as you connect them), and that processor handles them under its own terms. We keep the record of the transaction that comes back, such as its status and the processor's reference.

If you use payment routing between several merchant accounts, the checkout uses the details your routing rules call for, such as the buyer's country, the card's issuing bank number (BIN) and previous decline outcomes, to choose the account that processes a payment.

4.2 CRM contacts, forms and messages

Your CRM holds the contacts and records you create, import, or capture through forms: names, emails, phone numbers, custom fields, notes, tags, pipeline stages, and the history of what happened to each record. Form submissions are stored as records too. Emails and texts you send through automations are processed so they can be delivered and tracked.

You are responsible for having a lawful basis to collect and contact the people in your CRM, and for honouring their opt-outs.

4.3 Call-center data

If you use the built-in call center, we process call logs: phone numbers, times, duration, the agent who handled the call, its outcome, and notes your agents write. Where the phone system you connect provides call recordings, links to them are stored with the call. Telling callers that a call may be recorded, and getting any consent your jurisdiction requires, is your responsibility.

4.4 Visitors to your pages

To run pages, split tests and analytics, the Service records visits to your pages: pages viewed, the version of a split test shown, referring page and UTM parameters, approximate location, device and browser type, and IP address. The platform sets cookies on your pages to keep a visitor's session and split-test version consistent. If you add advertising pixels or tracking scripts to your pages, those send data to the ad networks under their terms, and obtaining any consent they require is your responsibility.

4.5 Affiliate data

If you run an affiliate program or accept traffic from affiliate networks, the Service processes affiliate identifiers and sub-IDs passed in links, the clicks and sales attributed to them, commission records and, where you collect them, affiliate account and payout details.

4.6 Our role as your processor

• We process your customers' data only to provide the Service to you, and on your instructions.
• We do not sell it.
• If you need a data processing agreement, email [email protected].

5. Our partner program

When you arrive on this website through a partner's link (a link with ?ref= or ?via=, or an elasticfunnels.io/r/ link), we store the partner's code in a first-party cookie and in your browser's storage for 90 days, count the click once per visit, and bind the code to your account if you register. We use it only to credit the partner who referred you. Details are in our Cookie Policy.

If you are a partner, we process your account details, the clicks, signups and payments attributed to you, your commission balance, the payout details you enter, and any tax documentation we need before paying you.

6. How we use it

To run the Service: authenticate you, render pages and funnels, process payments, send notifications, and provide support.

To improve the Service: aggregate usage analytics, error monitoring and performance metrics. Always anonymized or aggregated.

To meet legal obligations: tax reporting, fraud prevention, and lawful requests from regulators.

7. AI and your data

AI features in ElasticFunnels run on credits included with your plan and are processed through third-party AI providers selected by ElasticFunnels. EF does not retain prompts or outputs beyond what is needed to operate the feature, and EF never trains any model on your data.

8. Sub-processors

We use other companies to run the Service. The main ones are:

Payment processors, phone systems, email services and other integrations that you connect to your account act on your instructions under their own terms with you. A current list of our sub-processors with addresses and DPAs is available on request. We notify customers in advance of new sub-processors.

9. Sharing

We do not sell your data or your customers' data. We share data only with the sub-processors above, and only as needed to run the Service. We may share data when legally required (a subpoena, a lawful regulator request), and we will notify you unless we are legally prohibited from doing so.

10. Retention

Account data: while your account is active, plus 30 days after closure for data export. Then deleted from production.

Backups: encrypted backups retained 90 days for disaster recovery. Then overwritten.

Logs: 90 days for security and debugging.

Tax and billing records: 7 years for compliance.

Your customers' data (orders, CRM records, call logs, visit and affiliate data) stays in your account for as long as you keep it there. You can delete records at any time, and it is deleted with your account on the schedule above.

11. Security

TLS 1.2+ for all traffic. AES-256 at rest for databases and backups. Role-based access control with audit logs. SSO and two-factor sign-in available. Annual penetration test. Vulnerability disclosure program at [email protected].

If a breach affects your data, we notify you within 72 hours, in line with GDPR Article 33, so you can meet your own notification duties towards your customers.

12. Your GDPR rights (EU/EEA, UK, Switzerland)

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to erasure").
• Restrict or object to processing.
• Data portability (export in machine-readable format).
• Withdraw consent for any processing based on consent.
• Lodge a complaint with your supervisory authority.

To exercise any of these rights, email [email protected]. We respond within 30 days. If your data reached us through a business that uses ElasticFunnels, see section 2.

Legal basis: contract (running the Service for you), legitimate interest (security, anti-fraud, product improvement), consent (optional cookies and marketing emails).

13. Your CCPA / CPRA rights (California)

If you are a California resident, you have the right to:

• Know what personal information we collect, use or share.
• Delete personal information we collect from you.
• Correct inaccurate personal information.
• Opt out of the sale of personal information (we do not sell, but the right is yours regardless).
• Limit use of sensitive personal information.
• Non-discrimination for exercising any of these rights.

To exercise any right, email [email protected] with the subject "CCPA request."

14. Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have, email us and we will delete it.

15. International data transfers

If you are in the EU/EEA, UK or Switzerland and we transfer your data to the US, we use Standard Contractual Clauses approved by the European Commission.

16. Cookies on this website

This website uses necessary cookies to deliver pages, keep them secure, and credit partner referrals. It loads no third-party analytics or advertising tags today. If we add any, visitors in the EU/EEA, UK and Switzerland are asked first. The full list, with purposes and durations, is in our Cookie Policy, and you can change your choice at any time from "Cookie settings".

17. Changes

We may update this policy. For material changes, we email you and post a banner on the dashboard at least 30 days in advance.

18. Contact

Privacy questions: [email protected]. Security disclosures: [email protected]. EU representative on request.

19. Meta (Facebook) data

This section covers the data ElasticFunnels receives from Meta Platforms when you connect a Meta ad account or sign in with Facebook, and the data it sends to Meta when you turn on Meta conversion tracking. How to remove our access and have this data deleted is explained step by step on our Data deletion page.

19.1 What we access

You connect Meta Ads by signing in with Facebook and approving the ad accounts and permissions you want to share. With that access, ElasticFunnels reads:

• Ad accounts. The name, ID, business name, currency, status and time zone of each ad account you can use, so you can choose the one to connect.
• Campaigns, ad sets and ads. Their names, IDs, status, objective, budgets and dates, and each ad's creative name, thumbnail and video preview.
• Ad performance. Spend, impressions, clicks, CPM, CPC, CTR, reach and frequency, per ad and per placement.

Facebook may also return your name and email address during that sign-in. The Meta Ads connection does not store them.

If you choose "Continue with Facebook" to create or sign in to your ElasticFunnels account, we receive your name, email address and Facebook user ID, and store them on your user account so you can sign in that way again.

19.2 Why we use it

• To report your Meta ad spend next to the revenue your funnels record, so you can see cost and return per campaign, ad set and ad.
• To list your campaigns, ad sets and ads with their results in the Ad Campaigns report.
• To pause or activate a campaign, ad set or ad, or change its budget, when you or a member of your team asks for that in the app. ElasticFunnels makes these changes only on that request.

We use Meta data only to provide these features to you. We do not use it for advertising of our own, we do not build profiles from it, and we do not train AI models on it.

19.3 What we store

• An access token for each Meta Ads connection, which Facebook issues when you sign in. It lets the app read your ad data and make the changes you ask for. Facebook sets these tokens to expire after about 60 days.
• The ad account you connected (its ID and name) and, if you add one, your Meta pixel ID.
• Daily ad spend records: spend, link clicks, impressions, currency, placement, and the IDs and names of the campaign, ad set and ad. The app refreshes them every two hours while the connection is active.

The Ad Campaigns report reads campaign and ad details from Meta when you open it and keeps them in a short cache of about five minutes.

19.4 What we send to Meta

If you connect the Meta Conversions API, using a pixel ID and an access token you create in your own Meta business account, ElasticFunnels sends Meta an event for each purchase and upsell on your funnels: the order value, currency and order ID, and, unless you turn customer data off for that connection, details about the buyer. Email, phone, first and last name, city, state, ZIP code and country are hashed with SHA-256 before they leave our servers, and the order ID is also sent hashed as an external ID. The buyer's IP address, browser user agent and Meta click identifiers are sent as they are, because Meta needs them to match the event. These are your customers' data, and we send them on your instructions as your processor (see section 2).

19.5 Sharing

We do not sell Meta data and we do not share it with anyone outside the sub-processors that host the Service (section 8). People on your team can see it only in the accounts you give them access to.

19.6 Retention

The access token and the connected ad account stay stored until you disconnect, ask us to delete them, or close your account. Imported ad spend records stay in your reports while your account is active, so past reports keep their numbers, and are deleted with your account on the schedule in section 10. When you ask us to delete your Meta data, we delete it within 30 days.

19.7 Removing access and deleting your data

• In ElasticFunnels: go to Integrations, Meta Ads, Manage integrations, and delete the connection. The app stops reading from and making changes to your ad account.
• In Facebook: go to Settings and privacy, Settings, Business integrations, select ElasticFunnels and choose Remove. Meta then withdraws our access.
• By email: write to [email protected] from the email address on your ElasticFunnels account and ask us to delete your Meta data. We delete the stored tokens, the connected ad account and the imported ad spend records, and confirm by email.

The full steps are on our Data deletion page.