Privacy Policy

Privacy

Last Updated: July 20, 2026

Please read this privacy policy carefully

This Privacy Policy explains how we collects, uses, stores, and shares information when you installs and uses Funnel AI Landing Page, an AI landing-page builder for Shopify, and when a Customers interact with landing pages created with the App.

By installing or using the App, you agree to this Privacy Policy.

Information We Collect

1. Information from your Shopify store

When you install the App via Shopify OAuth, we receive and store information necessary to operate the App, including:

Store identifiers — your myshopify.com domain and Shopify store ID.
Shopify access tokens — used to call the Shopify Admin API on your behalf.
Store user information provided by Shopify in the authentication session (such as the account owner/staff name, email, locale, and collaborator status), as supplied by Shopify's session.

The App requests the following access scopes and uses them only for the stated purpose:

write_online_store_pages — Create, update, and delete the landing pages you build.
write_themes — Install the App's landing-page page template files into your published theme so pages render correctly. The App only manages its own files (prefixed `ms-`) and does not read or modify your other theme files.
write_files — Upload media (images/video) used by your landing pages to your store's Shopify file storage.
write_app_proxy — Expose the public storefront endpoints used by the landing-page subscribe form and A/B test measurement.
write_pixels, read_pixels — Install and manage the App's web pixel, which records funnel events for A/B tests you run.
read_customer_events — Let the App's web pixel receive storefront analytics events (page views, add to cart, checkout) for A/B test measurement.
read_orders — Verify orders attributed to an A/B test and read their subtotal so revenue can be reported per variant. The App queries **only the order ID and order subtotal** — never customer names, email addresses, phone numbers, or shipping/billing addresses.

2. Information you provide to the App

Third-party API credentials: You may connect your own Klaviyo private API key and list ID to enable the subscribe-form integration. This credential is stored server-side and used only to perform the actions you request. (AI content generation runs on the App's own system API keys — you do not provide AI provider credentials.)
Landing-page content and briefs: Product details, offers, target persona, copy instructions, design preferences, generated landing pages, generated email sequences, templates, and version history that you create in the App.
Billing and credit records: Your subscription plan and AI credit balance/usage. Payments are processed entirely by Shopify Billing — we never receive or store your payment card or bank details.

3. Customer (buyer) information collected via the storefront

When a Customer submits the subscribe form on a published landing page, the App receives:

The Customer's email address.
The landing page handle the form was submitted from.

This Customer data is forwarded to your connected Klaviyo account (using your own Klaviyo key) to add the Customer to your list and trigger your welcome email flow. The App does not store Customer email addresses in its own database.

4. Visitor and order data collected for A/B testing

When you run an A/B experiment on a landing page, the App measures how visitors move through the funnel so it can report which variant performs better. For this purpose the App collects:

First-party cookies on your storefront — _flunnel_experiments (which variant the visitor was assigned), _flunnel_visitor_id (a randomly generated pseudonymous identifier), and _flunnel_time_on_page (a short-lived engagement handoff). These are first-party cookies scoped to your storefront; the App sets no third-party or cross-site tracking cookies.
Behavioral funnel events via a Shopify web pixel — page views, add-to-cart, checkout started, checkout completed, time on page, device type, traffic source, and UTM parameters, keyed only to the pseudonymous identifiers above. These records contain no names, email addresses, or other directly identifying information.
Attributed order records via the Shopify Admin API — for orders completed in an experiment, the App stores the Shopify order ID and order subtotal (amount and currency) only, used to verify the order and report revenue per variant. The App's Admin API queries request no customer fields.

Consent. The App's web pixel is registered under Shopify's analytics consent category with sale-of-data disabled. In regions where consent is required, Shopify withholds the pixel until the visitor grants analytics consent, and Shopify's consent management applies automatically.

5. What we do not collect

We do not collect or process payment card or financial account data.
We do not collect Customer names, phone numbers, or shipping/billing addresses.
We do not set third-party tracking cookies in the Shopify admin; the embedded App authenticates using Shopify session tokens, and we do not track visitors across sites
We do not retain Customer personal data in our own database.

How We Use Information

We use the information described above to:

Authenticate the App and operate it within your Shopify admin.
Generate landing pages and email content using the App's AI providers.
Publish, update, and remove landing pages and their supporting theme template files.
Sync landing-page subscribers into your connected Klaviyo account and trigger your email flow.
Measure the A/B experiments you run — assign visitors to variants, count funnel milestones, attribute orders to variants, and report aggregate results (conversion, revenue per variant) to you. We use this data solely to provide these reports to you, never for our own marketing or advertising, and never to build cross-store or cross-site profiles
Manage your subscription plan and AI credit balance (payment processing is handled by Shopify Billing)
Provide support, maintain security, debug issues, and improve the App.
Comply with legal obligations.

We do not sell personal information, and we do not use Customer data for our own marketing.

Third-party services and sub-processors

The App relies on the following service providers. Data is shared with them only as needed to provide the App:

Shopify — App platform, authentication, Admin API, and webhooks. Data shared: store identifiers, access tokens, and page/theme data.
Render (application hosting) — Runs the App server. Data shared: all processed data in transit.
Supabase (database hosting) — Stores App data. Data shared: store records, settings (including encrypted AI keys), briefs, and generated pages and emails.
Anthropic, OpenAI, and Google (AI providers) — Generate landing-page and email content. Data shared: the content brief and product context you submit, sent using the App's own system API keys. No Customer or visitor personal data is sent to AI providers
Klaviyo — Email list subscription and email delivery. Data shared: Customer email addresses and generated email content, sent using your own Klaviyo key.

When you connect your own Klaviyo key, your use of Klaviyo is also governed by their terms and privacy policies

Data sharing and disclosure

We do not share personal information except:

With the sub-processors listed above to provide the App.
To comply with law, legal process, or a lawful government request.
To protect the rights, property, or safety of us, our users, or the public.
In connection with a merger, acquisition, or sale of assets, subject to this Policy.

Data retention and deletion

While installed: we retain your store data for as long as the App is installed so it remains available to you

A/B testing data: raw per-visitor session records are automatically and permanently deleted 30 days after an experiment ends; ended experiments are reported from an aggregated snapshot that contains no per-visitor records. Attributed order records (order ID + subtotal) are retained to back the experiment's revenue report for as long as you keep the experiment, and are deleted via the erasure mechanisms below

On uninstall: we mark your store as uninstalled and delete your Shopify session/access tokens. Your landing-page data is retained temporarily so it can be restored if you reinstall.

Shop data erasure (shop/redact): approximately 48 hours after uninstall, in response to Shopify's mandatory compliance webhook, we permanently delete all of your store's data from our database, including settings, stored API keys, and all A/B testing records

Customer data requests (customers/data_request, customers/redact): we support Shopify's mandatory customer data webhooks. On a data request, we export the data the App holds for the specified orders — the attributed order record (order ID, amounts, variant, timestamp) and, if still retained, the linked pseudonymous session record — so you can fulfil the Customer's request. On a redact, we permanently delete those same records. Subscriber emails forwarded to your Klaviyo account are managed by you as the controller in Klaviyo

You may also contact us at hello@flunnel.ai to request access to or deletion of your data.

Data security

We implement reasonable technical and organizational measures to protect information, including:

Encryption in transit using TLS/HTTPS for all connections (admin, storefront endpoints, and database)
Encryption at rest (AES-256) for the production database, with additional application-level encryption for stored API keys (ciphertext only; full keys are never returned to the browser)
Strict multi-tenant data isolation so each store can access only its own data.
Pseudonymization of A/B testing data (random visitor/session identifiers; no direct identifiers stored)
Restricted access to production systems.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your Rights

Depending on your location, you (and your Customers, via the Merchant as controller) may have rights to access, correct, delete, or restrict the processing of personal data, and to data portability. Requests can be made to hello@flunnel.ai. For Customer data, please direct requests to the relevant Merchant; we will assist the Merchant as their processor.

This Policy is intended to support compliance with applicable laws including the GDPR and CCPA/CPRA.

Children's privacy

The App is intended for use by businesses and is not directed to children. We do not knowingly collect personal data from children.

Contact Us

If you have questions or requests regarding this Privacy Policy or your data, contact:

Flunnel
Email: hello@flunnel.ai
Website: https://flunnel.ai