Privacy Policy

1. Who we are

Smoothfunnels is operated by Smoothware OÜ. We provide an AI-powered marketing funnel and landing page generation platform for agencies and businesses.

Data Controller: Smoothware OÜ, a private limited company registered in Estonia
Estonian Business Register (registry code): 17596037
VAT: not VAT-registered
Address: Sepapaja tn 6, 15551 Tallinn, Estonia
Management board: Joshia Jeff Paul Wollrabe
Contact: info@smoothfunnels.ai · info@smoothware.io · +31 85 060 5265

We are the controller of the personal data of our own customers and website visitors, described in section 2. For the leads that our customers collect through their landing pages we are only a processor: the customer decides why and how that data is used (see section 4 and our Data Processing Agreement).

2. What personal data we process

• Account data: your name, email address, a hashed password (never stored in plain text), your language preference, and a record of when you accepted the Terms and which version. If you sign in with Google, we receive your name and email address from Google. If you are invited to a team, we store the invited email address.
• Billing data: payments are handled by Stripe, and we never see or store your card details. We store your plan, your Stripe customer and subscription identifiers and status, your credit balance and the history of credit transactions (what was granted, spent or refunded).
• Usage data: the websites, brand profiles, funnels and landing pages you create, and a log of AI actions (which action, when, and its cost in tokens and credits).
• Security and technical data: every signed-in or visiting browser gets a session record that holds a session identifier, the IP address and browser (user agent) string, and is kept while the session is valid (inactivity limit: 120 minutes). Sign-in, registration and form attempts are rate limited per IP address to prevent abuse.
• Support data: the tickets and messages you send us.
• Contact form: the name, email address, company and message you type on our contact page are sent to us by email. The app does not keep them in its database.
• “Try it on your site” generator: if you use the free preview on our home page we store the email address, website URL and IP address you submit, and we fetch the public content of that website to build your preview. We only do this for a website on the same domain as your email address, and the result is shown only in your own browser session; it is cached briefly (at most 24 hours per domain). The app does not send email to the address you enter.
• Partner referral: if you arrive through a partner link (?ref=), the referral code is kept in your session only, so the partner can be credited if you sign up in that same visit. It is not stored in a persistent cookie.
• Connected accounts: if you connect Google Analytics / Search Console (or, when available, an advertising account), we store the access token you authorise. Tokens are stored encrypted and you can disconnect at any time.
• Reports of illegal content: if you report a page through our report form (Digital Services Act), we store the address of the page, your explanation, your name and email address, and our decision. We keep them as long as needed to handle the report and to answer complaints about our decision.
• Support access log: when a member of our team signs in to your account to help you, we record who, when and from which IP address. You can see these entries in Account privacy.
• Leads (as processor): name, email address, phone number, message, custom form answers, IP address, browser string, consent answers and the privacy-policy link shown, of people who fill in a form on a customer’s landing page. See section 4.

3. Why we use it, and the legal basis

Purpose	Legal basis (GDPR)
Create and run your account, deliver the service, generate content with AI, process credits	Contract, art. 6(1)(b)
Take payments, send invoices and payment-failure notices	Contract, art. 6(1)(b); legal obligation, art. 6(1)(c)
Service emails: verification, password reset, low-credit and credit-receipt notices, new-lead notifications, a weekly activity digest	Contract, art. 6(1)(b); legitimate interest, art. 6(1)(f), for the digest
Security, abuse and fraud prevention, rate limiting, error monitoring, backups	Legitimate interest, art. 6(1)(f)
Answer support requests and contact-form messages	Contract, art. 6(1)(b) or legitimate interest, art. 6(1)(f)
Build the free preview you ask for, and keep that generator from being abused	Your request, art. 6(1)(b); legitimate interest, art. 6(1)(f)
Keep tax and accounting records	Legal obligation, art. 6(1)(c)
Record that you accepted the Terms and which version	Legitimate interest, art. 6(1)(f) (proof of agreement)

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (art. 22). We do not use advertising or tracking technologies on this website.

4. Leads: we are the processor, the customer is the controller

When a visitor fills in a form on a landing page that a customer created with Smoothfunnels (whether hosted by us or published to the customer’s own site), the customer decides why that person’s data is collected and what happens to it. For that data we act only on the customer’s instructions, under the Data Processing Agreement, which forms part of our Terms. If you are a person who submitted such a form, please contact the business whose page you used for access, correction or deletion; we will help that business to answer you.

Customers can show a consent checkbox and a link to their own privacy policy on each website, can export their leads, delete them, and can set how long leads are kept (see section 9).

5. AI processing

We generate funnels, landing pages and website analyses with Claude, a model provided by Anthropic, through Anthropic’s API. What is sent in a request depends on the feature, and is limited to:

• the public content of the website you asked us to scrape (we read a site only after the person asking confirms they own it or have permission, we respect robots.txt — including rules for all crawlers, unless the owner has proven ownership by a DNS record or meta tag — and our crawler is described at https://smoothfunnels.ai/bot);
• the brand profile and settings you maintain: business description, audiences, tone, page summaries, products and photos you allow the AI to use, content rules and allowed links;
• the page, funnel or section you are generating or editing, and the instructions you type into AI features; and
• for the free home-page preview, the content of the website URL entered.

Leads are not sent to the AI: no name, email address, phone number or message of a person who filled in a form is part of any prompt. The settings in the Business Brain let you choose which pages and details the AI may use. AI output can be wrong, so please review what it writes before you publish it (see our Terms).

6. Who receives data (sub-processors)

We use the following service providers. They process data on our behalf and only as needed for the purpose given. For lead data the same providers act as our sub-processors under the Data Processing Agreement.

Independent of our own sub-processors, Stripe is also responsible for payment data it handles in its own right (Stripe Privacy Policy). Further information: Anthropic, Resend, Sentry, Hetzner, Bunny, Google.

The Google Analytics Data API and Search Console are used only to read a customer’s own website statistics, after that customer connects their Google account; this website does not load Google Analytics or any other analytics script. We also share data where the law requires it, and with a professional adviser or a successor if our business is transferred, under confidentiality.

7. Transfers outside the EEA

Some of the providers above (for example Anthropic, Stripe, Google, Resend and possibly Sentry) are based in, or may process data in, the United States or another country outside the European Economic Area. Where that happens we rely on appropriate safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable to the provider. You can ask us for information on the safeguards used at info@smoothfunnels.ai.

8. Security

The service is served over HTTPS. Passwords are hashed. Third-party access tokens and the keys used to publish to your own website are stored encrypted. Two-factor authentication with an authenticator app is available for every account. Each customer’s data is separated from other customers’ data: you can only open records of websites that belong to your account. Sign-in and form endpoints are rate limited. Database backups are copied offsite. Payment data is handled by Stripe and never touches our servers. No system is perfectly secure; if a breach affects your data we will notify you and the authority as the law requires.

9. How long we keep data

• Account and workspace data (account, websites, funnels, pages, credit history, support tickets): while your account exists. When you delete your account in the dashboard (Account privacy), your subscription is cancelled and your data is deleted from the live system straight away. The websites of a shared account are deleted when its last member is deleted.
• Backups: database backups are kept on a rolling schedule (daily copies for the first weeks, then weekly, monthly and yearly copies) for up to 2 years. Data you deleted can therefore remain in a backup until that backup expires; backups are used only to restore the service after a failure.
• Leads: until the customer deletes them, or until they are removed under the lead retention period that the customer can configure per website.
• Free-preview requests (email, URL, IP): kept only as long as needed for the purposes above; you can ask us to delete yours at any time.
• Session records: while the session is valid; the cached preview result: at most 24 hours.
• Invoices and payment records: for the statutory period under Dutch tax law (7 years). These are kept with Stripe and in our tax administration, not as part of your dashboard data.
• Contact-form and support emails: as long as needed to handle your request and any follow-up.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy — signed-in customers can download an export of their data from the dashboard (Account privacy);
• Rectification of inaccurate data;
• Erasure (“right to be forgotten”) — you can delete your account yourself in the same place;
• Portability in a structured, machine-readable format (the export is JSON; leads can also be exported as CSV);
• Objection to processing based on legitimate interest, and restriction of processing; and
• Withdraw consent at any time where processing is based on consent.

To use a right that you cannot use yourself in the dashboard, email info@smoothfunnels.ai. We answer within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

11. Cookies

We set only the cookies that are strictly necessary to keep you signed in and to protect forms against forgery. We use no analytics, advertising or tracking cookies, so there is no cookie banner. The full, current list is in our Cookie Policy.

12. Changes to this policy

We may update this policy. For material changes we will notify account holders by email. The date and version at the top of this page show when it was last updated.

13. Contact

Questions about this policy or your data? Contact us at info@smoothfunnels.ai.