Privacy policy

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Funnel-Link · Andrej Hirsch
Garmischer Straße 14, 82418 Murnau, Germany
Email: datenschutz@funnalized.app

Funnalized is a B2B platform. For data protection purposes, two roles must be distinguished:

• We as controller: For data that arises when you visit this website, on registration, contract processing, billing and support, with product and promotional emails, feedback and surveys and in the usage analysis of your account (sections 3 to 5, 7, 8 and 13 to 16 — unless the customer is expressly named as controller there), we are the controller within the meaning of Art. 4(7) GDPR.
• We as processor: For data that our customers process in their workspaces (e.g. leads, contacts, applicant data — section 6), the respective customer is the controller — we process this data exclusively on their behalf on the basis of our data processing agreement (Art. 28 GDPR). Data subjects (e.g. applicants via a customer’s careers page) should please address requests to the respective company; we forward requests received directly by us there without delay.

When our website is accessed, our server automatically processes technical data (IP address, date and time, URL accessed, user agent, referrer) in order to deliver the page and to ensure the security of the system (defence against attacks, rate limiting, error analysis). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Server logs are deleted after 30 days at the latest, unless they are needed for longer to investigate specific security incidents.

When you register and use an account, we process:

• Account data: name, email address, password (exclusively as a bcrypt hash), workspace membership, role, login times — legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Sign-in log: On registration, for every sign-in attempt — with a password on our sign-in page, with a passkey, via Google, Microsoft, LinkedIn or Facebook (section 8 (d) and (e)) or via your employer’s company login (section 8 (d)) —, for every entry of the second factor and for every confirmation before a security-critical action, we record the time, email address, IP address, browser identifier and the result. This enables us to recognise and fend off attacks on accounts and to alert you to a sign-in from a new device. Owners and administrators of a workspace you belong to see these entries on your account there in the team’s activity history; you yourself also see them there insofar as you are allowed to view it, although as a member without one of these roles without IP address and browser identifier. We delete this log after 90 days — legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of your account and of the platform).
• Sessions: For every session in which you are signed in, we store the IP address and browser identifier, the device and browser derived from them, as well as the start, last activity and expiry and, if the session ends earlier, the time and the reason. This lets you see in the settings where you are signed in and sign out individual devices, and allows us to reliably end a session that has been signed out or blocked. Only you see this information. It remains stored even after a session has ended, until your account is deleted — legal basis: Art. 6(1)(b) GDPR (provision of access) and point (f) GDPR (security of your account).
• Entries in the activity history: We additionally record sign-ins and sign-outs, changes and resets of your password (including a failed attempt to change it), confirmations before security-critical actions, the setting up and removal of a passkey and the linking and unlinking of sign-in via Facebook in the activity history of the workspace to which your account was first assigned, even if you no longer belong to it — with the time and IP address, for a sign-in also with the browser identifier and the sign-in service used, for the company login including the workspace that provides it. These entries can be seen there by owners and administrators and by anyone to whom they grant access to the workspace’s audit log, in each case with IP address and browser identifier; you see your own entries there even without one of these roles — then without this information —, as long as you belong to the workspace and are allowed to view the team’s activity history. The entries have no deletion period of their own; they are deleted together with the workspace — legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of your account and in being able to trace in the workspace when an account was used and its access changed).
• Passkeys: If you set up a passkey in the settings, your device or your password manager generates a key pair. We do not receive the private key, nor your PIN or your biometric characteristic (such as fingerprint or facial recognition) — only your device checks the unlocking. For each passkey, we store the public key and its algorithm, the identifier of the passkey, a user identifier derived from your account, a signature counter, the transports reported by the device, the model identifier of the authenticator, whether the passkey can be and is backed up across devices, the name you give it (we suggest one based on device and browser), as well as the time of setup and of last use. We do not request an attestation from the device manufacturer. When it is set up, we pass your email address and your name to your device so that you can find the passkey there again; whether your device or password manager synchronises it with a cloud service is determined by you via its settings. For every setup, every sign-in and every confirmation, we create a one-time challenge (as a hash value, with purpose, account and expiry time); it is valid for five minutes and is deleted immediately when redeemed, and a challenge that has not been redeemed is deleted when a later one is created, once it has been expired for more than one hour. We inform you by email and in the app when a passkey is set up or removed; this message cannot be unsubscribed from for security reasons. You can rename or remove a passkey in the settings at any time; when it is removed or together with your account, we delete the stored information — legal basis: Art. 6(1)(b) GDPR (provision of the chosen sign-in method) and point (f) GDPR (security of your account).
• Confirmation before security-critical actions: Before consequential steps — such as deleting or exporting a workspace, changing payment details or administrator rights, setting up or removing a passkey — we ask you to confirm that it is you: with a passkey, your second factor or, if your account does not have one, your password; a new sign-in is also sufficient. We record the time of the last sign-in or confirmation on the respective session; if it was no more than 15 minutes ago, we do not ask again in this session. It is stored and deleted together with the other information on the session (see “Sessions”) — legal basis: Art. 6(1)(f) GDPR (security of your account).
• Academy: If you use the Funnalized Academy, we store against your account which articles you have read and completed, your results in knowledge checks, which questions you last answered correctly or incorrectly (for repetitions), which introductory tours you have completed, on which days you studied (for your learning streak) and which awards you have received. You see this information yourself; we do not show it to other members of your workspace. We delete the learning days after 400 days, tours and repetitions together with your account — legal basis: Art. 6(1)(b) GDPR (provision of the Academy as part of the platform).
• Billing data: selected plan, billing address, payment status. Payment processing is handled by Stripe Payments Europe Ltd. (Dublin, Ireland); credit card and account data are processed directly at Stripe and do not reach our servers — legal basis: Art. 6(1)(b) GDPR; retention of invoice data pursuant to Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (Abgabenordnung – AO) (10 years).
• Payment reminders: If an invoice remains unpaid, we remind you of it in stages. For this purpose, we record for each invoice which stage was sent when and whether the associated email went out; this record contains neither names nor addresses. The recipient is the billing address you have provided, alternatively the email address of the owner of the workspace. These messages concern your contract and cannot be unsubscribed from — legal basis: Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in enforcing outstanding claims).
• System emails: we send transactional emails (e.g. password reset, invoices, important account information) via the EU service provider Zoho Corporation B.V. (ZeptoMail, EU data centre) — legal basis: Art. 6(1)(b) GDPR.
• Beta waiting list: If you sign up for the beta, we process your email address and your consent — the latter together with the time of sign-up, your IP address and the browser identifier (user agent) as proof of consent pursuant to § 7(2) of the Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG). We record the same two items a second time when you click the confirmation link — this click is the actual act of consent. In addition, we store the display language you have chosen as well as origin and campaign data that your request brings with it (the source of the sign-up, any UTM parameters from the link and the referring page/referrer). We do not collect a name or company details in the process. After confirmation, we ask you on a voluntary basis which area you come from (agency, sales or recruiting); this information is optional, you can skip the step, and we use it exclusively to tailor the launch information accordingly. This data serves to confirm your sign-up in the double opt-in procedure and — insofar as you have consented — to inform you once about the launch by email. The sign-up does not establish an order of precedence or a place. Legal basis: Art. 6(1)(a) GDPR (consent, § 7(2) no. 3 UWG). You can withdraw your consent at any time with effect for the future: every waiting-list email contains an unsubscribe link — clicking it deletes your entry completely from our database; we do not keep a blocklist and do not retain any residual data. The unsubscribe button built into many email programs, which we provide technically, works in the same way. Alternatively, an informal message to datenschutz@funnalized.app is sufficient. If you do not confirm your sign-up at all, we delete it by ourselves: the confirmation link expires after 14 days, and 30 days after that a daily run removes the entry completely from the database — you do not have to do anything for this. We delete confirmed waiting-list data that has not been unsubscribed no later than 12 months after the end of the beta programme, unless a contract is concluded; for your further rights, see section 10.

Obligation to provide data (Art. 13(2)(e) GDPR): The provision of name, email address and billing data is necessary for the conclusion and performance of the user agreement; without this data, we cannot provide the account. There is no statutory obligation to provide it; all further information is voluntary.

On this website and in the application, we generally use technically necessary cookies. Optional categories are only activated with your express consent (opt-in, deactivated by default):

• funnalized_token — session cookie with a JWT for sign-in; httpOnly, secure, SameSite=Lax; valid for 7 days. Legal basis: § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• workspace-slug — remembers the most recently used workspace for correct forwarding after login; SameSite=Lax; valid for 12 months. Legal basis: § 25(2) no. 2 TDDDG (technically necessary).
• funnalized-consent — on our marketing pages, we store your cookie decision (only whether statistics or marketing is on or off) in a cookie of its own so that we do not ask you again on every visit; SameSite=Lax, valid for 365 days. Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(c) and (f) GDPR. In the signed-in application, the decision is kept locally in the browser in the same way.

Further technically necessary storage: Depending on which route you use, the following storage is added. It too is technically necessary and serves no analytics or advertising purpose whatsoever:

• sso_state — only when signing in with Google, Microsoft, LinkedIn or Facebook and when linking Facebook: the cookie binds the return route from the provider to your browser and thereby prevents manipulation of the sign-in; when linking, it additionally records which Funnalized account is being linked, so that this does not run via Meta. httpOnly, secure, SameSite=Lax, valid for 10 minutes, deleted immediately after sign-in (see section 8 (d) and (e)). Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• oauth_bindung_kalender_google, oauth_bindung_kalender_outlook and oauth_bindung_zoho_books — only while you are connecting a Google or Outlook calendar or Zoho Books: the cookie binds the return route from the provider to your browser and prevents someone from slipping someone else’s connection to you (calendar: section 8 (a) and (b); Zoho Books: section 7 (c)); httpOnly, secure, SameSite=Lax, valid for 15 minutes, deleted on the return route. Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• tz_… and fz_… (followed by a character string per link) — only if you open a password-protected board or a document folder protected in this way that someone has sent you by link: the cookie records that you have entered the correct password for exactly this link, so that it is not requested again on every retrieval. httpOnly, secure, SameSite=Strict, valid for 30 minutes. Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(f) GDPR.
• firmenlogin_state — only when signing in via the company login that a workspace has set up with its company’s directory: the same task as sso_state, the same properties (httpOnly, secure, SameSite=Lax, valid for 10 minutes, deleted immediately after sign-in). Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• firmenlogin_saml — the same for a company login via SAML 2.0: binds the directory’s response to the sign-in that was started in this browser. httpOnly, secure, valid for 10 minutes, deleted immediately after sign-in. SameSite=None, because the directory sends its response as a form from its own address — with SameSite=Lax, the cookie would not be sent along there. Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• sso_2fa — only if, after a sign-in via a provider (Google, Microsoft, LinkedIn, Facebook or company login), the second factor is still missing: records this intermediate step until you have entered the code; httpOnly, secure, SameSite=Lax, valid for a maximum of 5 minutes, deleted when the sign-in is completed. Legal basis: § 25(2) no. 2 TDDDG (technically necessary) in conjunction with Art. 6(1)(b) GDPR.
• user_consent_settings and consent_banner_dismissed — on the careers pages and funnels published by our customers, the cookie decision made there is not stored in a cookie but in your browser’s local storage: which categories you have allowed and whether the notice has already been acknowledged. These values do not leave your device. Legal basis: § 25(2) no. 2 TDDDG (storage of the consent decision).
• Test cookie when loading the sign-in page — before login, we use a single test value to check whether your browser allows cookies at all (without this, sign-in is technically impossible). The value is deleted again in the same step and contains no information about you. Legal basis: § 25(2) no. 2 TDDDG.
• invite-schritt-verify and einladung-nach-anmeldung — only when accepting an invitation to a workspace: the session storage of the browser tab records which step of the invitation you are at and — if your company signs you in via its company login — to which invitation you return afterwards. The value is the invitation link, not information about you; it is deleted when first read, at the latest when the tab is closed. Legal basis: § 25(2) no. 2 TDDDG.
• fl-ladebild-gesehen — on our marketing pages, your browser’s session storage records that the brief opening animation of the brand has run through completely once, so that it does not appear again as you click on. The value (“1”) is set without any action on your part as soon as the animation has finished (around 1.6 seconds after the page has loaded), contains no information about you and is deleted when the browser tab is closed. If “Reduce motion” is set in the operating system, the animation does not run and nothing is stored. Legal basis: § 25(2) no. 2 TDDDG.
• fl.messung.besuch — on our marketing pages, your browser’s session storage stores a random visit identifier so that several page views can be combined into one visit (pseudonymous audience measurement, see below). The value is only set if you have switched on the “Statistics” category in the cookie settings; without this consent, we merely count page views, without accessing your device. The identifier is random, contains no information about you and is deleted when the browser tab is closed. Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent); withdrawal at any time via the cookie settings.

Our own consent system (no third-party CMP): On your first visit to our marketing pages, we show a small consent card with options of equal weight; it comes entirely from us and does not load any external scripts. Optional categories — Statistics and Marketing — can be activated in it individually and deliberately; without your consent, no optional cookies or comparable technologies are loaded. The legal basis for optional categories is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent, our own pages do not set any statistics or marketing cookies; the default setting is “off”, and anyone who does not decide is deemed not to have agreed. This applies unchanged to any future extension as well. Which cookies are actually set is listed by name and in the current status in our cookie policy.

Pseudonymous audience measurement of our marketing pages: We ourselves count which of our marketing pages are accessed and how often — without third-party providers and in two stages. Without your consent, for each page view we store the address of the page, the time, the language, the device class (phone, tablet, computer), the browser and operating system family, the window width, the referring website (only its host) and campaign identifiers from the link (utm_source, utm_medium, utm_campaign), and when you leave additionally the time spent and the scroll depth. Your IP address and the complete user agent are not stored in the process; none of this is stored on your device, and no one becomes identifiable as a result. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving our offering). Only with your consent (“Statistics” in the cookie settings) does your browser’s session storage additionally store a random visit identifier (fl.messung.besuch, see above), with which several page views are combined into one visit; it is deleted when the browser tab is closed. Legal basis for this: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The measurement data is deleted after 400 days; this period allows a comparison with the previous year and is the upper limit, not the target.

Withdrawal and change (Art. 7(3) GDPR): You can change or withdraw your selection at any time with effect for the future — as easily as you gave it. You can reopen the consent panel via the footer link “Cookie settings” or the following button:

Open cookie settings

Customer pages: On the funnels and careers pages published by our customers, the respective customer may use their own tracking technologies (e.g. Meta Pixel). There, the platform displays a cookie banner through which visitors can consent or decline; the respective customer, whose privacy policy is linked in the banner, is responsible for this tracking.

Customer portals and documents: The customer portals and the document pages shared by link (quotes, contracts, invoices, recruiting offers) use exclusively technically necessary cookies — the portal sign-in (JWT), a short-lived session for the approval check, and language and display settings. No analytics or marketing tracking takes place; these pages are therefore free of cookie banners (§ 25(2) TDDDG).

Depending on the modules used, the following categories of data in particular are processed in our customers’ workspaces. The respective customer is the controller for this; the details are governed by the DPA:

• Sales (CRM): leads, contacts, companies, deals, activities, notes, tasks, email communication, appointments
• Recruiting: applicant data, application documents, answers from application funnels, interview notes, ratings, onboarding data
• Marketing: funnel sessions, campaign performance, recipient lists, tracking events from funnels operated by the customer
• Projects & team: project data, tasks, team members, permissions
• Time tracking: working times booked per project and task (billable or internal), running timers, weekly capacity and workload per person
• Team Academy: the customer’s courses as well as learning progress, results of knowledge checks and completions per member, which the customer can view
• Surveys: answers from customers and applicants to satisfaction and feedback surveys
• Notifications: messages about events in the workspace to its members, in the app and, depending on the settings, by email — for messages, mentions, comments, tickets and survey responses with an excerpt of the content of no more than 300 characters
• Content shared by link: Visualizer boards and folders of the document storage that the customer makes accessible without sign-in (folders also for uploading, if desired), and the log of their retrievals with a shortened IP address (deleted after 400 days)

For transfers to third countries, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place (EU Standard Contractual Clauses, adequacy decisions, EU-US Data Privacy Framework).

a) Processors (Art. 28 GDPR)

• Hetzner Online GmbH (Gunzenhausen, Germany) — Hosting of the application, the PostgreSQL database and backups (data centres in Germany, private network) as well as object storage for uploaded files (including application documents, receipts, media), location Nuremberg; an additional encrypted backup copy and a mirror of the files at the Falkenstein location; a monitoring server at the Helsinki location (Finland, EU) checks availability from outside and processes operational data only, no content of the workspaces
• BUNNYWAY d.o.o. (bunny.net) (Ljubljana, Slovenia (EU)) — Content delivery network, upstream delivery service and protective layer (web application firewall, defence against overload attacks). This covers (a) the pages published by the customer (careers pages, funnels, customer portals), including the customer’s own domains connected by the customer, and (b) the delivery of the platform itself — marketing website and application —, so that every request to these addresses runs through bunny.net. Only immutable program files are cached; pages relating to individual customers or users are expressly excluded from caching. Delivery takes place via a network of delivery nodes; connection data (in particular the IP address) may briefly also be processed on nodes outside the EU. Access logs are stored anonymised (last part of the address removed). Delivery nodes outside the EU possible — EU Standard Contractual Clauses
• Zoho Corporation B.V. (ZeptoMail) (Utrecht, Netherlands (EU data centre)) — Sending of system and product emails: transactional system messages (e.g. password reset, invoices, portal and team invitations, system notifications — for messages, mentions, comments, tickets and survey responses with an excerpt of the content of no more than 300 characters) as well as product and promotional emails to existing customers (e.g. announcements of new features), each with an unsubscribe link; EU data centre, no third-country transfer

b) Recipients acting under their own responsibility

• Stripe Payments Europe Ltd. (Dublin, Ireland) — Payment processing for subscriptions and invoices (processes payment data under its own responsibility; card and account data do not reach our servers). Intra-group transfer to the USA possible — EU Standard Contractual Clauses + EU-US Data Privacy Framework
• Company logos (favicon display) — to display companies clearly in the CRM, we show their favicon. It is retrieved exclusively server-side via our servers hosted in Germany; your browser only loads the logo from us. No personal data (in particular no IP address) of your browser is transferred to third parties in the process. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a clear presentation).

c) Integrations that can be activated by the customer

The following services only receive data if you or your workspace owner actively establish the respective connection. They act as independent controllers or — for example in the case of the Meta Pixel (CJEU, “Fashion ID”) — as joint controllers with the respective workspace owner. For the permissions requested, see section 8:

• Meta Platforms Ireland Ltd. (Dublin, Ireland) — Creating, managing and evaluating advertising campaigns — access to ad accounts (ads_management, ads_read), connected pages (pages_show_list, pages_read_engagement, pages_manage_ads), business assets (business_management) and basic Instagram data (instagram_basic), plus the identifier and name of the connecting person (public_profile); when publishing, the ad media chosen by the customer (images, videos, carousels) and the information on the beneficiary and payer of the advertising required under the Digital Services Act; the profile picture of the connected page or Instagram account for the ad preview is retrieved by the server, not by the viewer’s browser; additionally Meta Pixel / Conversions API on funnel pages operated by the customer — only if the workspace owner actively connects the Meta integration. In addition, “Sign in with Facebook” (public_profile: an identifier valid only for Funnalized, and the name) — only if a user actively links their Facebook account in the settings. USA possible — EU Standard Contractual Clauses + EU-US Data Privacy Framework
• Google Ireland Ltd. (Dublin, Ireland) — Google Calendar connection via OAuth: view, create, change and delete events (calendar.events), view the calendar list (calendar.calendarlist.readonly), identifier and confirmed address of the account (openid, email), synchronisation every five minutes in the background, Google Meet links — only if the user actively connects their account. In addition, “Sign in with Google” (openid, email, profile) — only if a user chooses this sign-in. USA possible — EU Standard Contractual Clauses + EU-US Data Privacy Framework
• Microsoft Ireland Operations Ltd. (Dublin, Ireland) — Outlook calendar connection via OAuth: read, create, change and delete events (Calendars.ReadWrite), synchronisation in the background (offline_access), identifier, address and display name of the account (User.Read), Teams meeting links — only if the user actively connects their account. In addition, “Sign in with Microsoft” (openid, email, profile) — only if a user chooses this sign-in. USA possible — EU Standard Contractual Clauses + EU-US Data Privacy Framework
• Zoho Corporation B.V. (Zoho Books) (Utrecht, Netherlands) — Accounting integration (quotes, invoices) — only if actively linked by the customer
• sevDesk GmbH (Cologne, Germany) — Accounting integration (quotes, invoices) — only if actively linked by the customer
• easybill GmbH (Kaarst, Germany) — Accounting integration (quotes, invoices) — only if actively linked by the customer
• FastBill GmbH (Frankfurt am Main, Germany) — Accounting integration (quotes, invoices) — only if actively linked by the customer
• bexio AG (Rapperswil-Jona, Switzerland) — Accounting integration (quotes, invoices) — only if actively linked by the customer. Switzerland — adequacy decision of the EU Commission
• BuchhaltungsButler GmbH (Germany) — Accounting integration (quotes, invoices) — only if actively linked by the customer

d) Services that serve only for sign-in

The following services only receive data if you yourself choose to sign in via them. In doing so, they act as independent controllers; we do not transmit any data from the workspaces to them. Sign-in via Google, Microsoft and Facebook is provided by the providers named under (c); details on all sign-in services can be found in section 8 (d) and (e):

• LinkedIn Ireland Unlimited Company (Dublin, Ireland) — “Sign in with LinkedIn” (openid, profile, email: email address, name and the confirmation of the address) — only if a user chooses this sign-in. USA possible — EU Standard Contractual Clauses + EU-US Data Privacy Framework

Users and workspace owners can optionally connect external accounts. Only you yourself actively establish these connections; without your connection, no data is exchanged with the providers concerned. Access and refresh tokens are stored encrypted (AES-256-GCM).

a) Google Calendar

If you connect a Google account under Settings → Calendar, we request two calendar permissions: calendar.events (view, create, change and delete events in your calendars) and calendar.calendarlist.readonly (view the list of your calendars so that you can choose which calendar is synchronised). The second is optional — without it, we synchronise your primary calendar. Without the first, no connection is established. We do not create, share or delete calendars themselves. In addition, there are the sign-in permissions openid and email: with them, Google tells us the identifier of your Google account and your confirmed email address. We use both only to recognise the connected account unambiguously — for example, so that reconnecting does not create a second connection and the right access is revoked when disconnecting.

What we read and store: Funnalized synchronises the selected calendar every five minutes in the background in both directions with your calendar in Funnalized (you can restrict the direction). For this, we read the events of the last 30 days and all future ones and store, from each event, the title, description, start and end, location, video conference link, reminder and the names and email addresses of the participants; for the account, the identifier of your Google account, your confirmed Google email address, the name of the selected calendar, the permissions granted and technical information on the state of the connection (times of the last synchronisation and of the last renewal of access, error codes of the provider).

What for: The events appear in your calendar in Funnalized, and the busy times count as not bookable on your workspace’s appointment booking pages. Conversely, we create your events from Funnalized in your Google Calendar, change or delete them there, with a Google Meet link if desired. This applies to events that you create, change or cancel yourself (such as sales appointments or job interviews), and to events that are created for you: bookings that others make with you via your workspace’s booking pages, events that your workspace’s automations create for you, and interview appointments that applicants reschedule via the link in their invitation. In doing so, we transmit the title, times, location, description and the participants to Google. We ask Google not to send any invitations in the process; Google points out, however, that individual emails may still be sent. If you delete in Funnalized an event that originates from your Google Calendar, we also delete it there — unless the connection is set to “Import only”.

Who in your workspace sees the imported events: Other members only see events that Funnalized imports from your calendar if you share your calendar with them under “Calendar sharing”; owners and administrators of your workspace see them even without sharing and can set the sharing for you. Events that you mark as private or confidential in Google are imported by Funnalized as private: you yourself see them with all details, other members — including owners and administrators — do not; where only your availability matters (scheduling in the team calendar, booking pages), only the time appears as busy. Events that you create yourself in Funnalized are seen by all members who are allowed to read sales appointments, except those that you mark as private. Only you control your connection itself: which calendar, in which direction, “Sync now” and events with a meeting link in your calendar. Owners and administrators can only pause or disconnect your connection; they do not see your calendar list.

Disclosure: We do not pass this data on to anyone except the processors from section 7 (a) that operate Funnalized on our behalf (Art. 28 GDPR) — for example for servers and database, the delivery of the application and system emails. We do not sell it and use it neither for advertising nor for training AI models. We only send emails to the participants of an event if this is expressly triggered in Funnalized — by you or by someone who is allowed to edit the event in your workspace (such as an invitation or a cancellation); they are sent via your workspace’s email account.

People at Funnalized only see this data in the following cases; the details are set out in section 14:

• Support ticket (section 14 (a)): If your workspace opens a support ticket, our support may enter it to investigate the fault without separate approval — tied to the ticket, for a maximum of 14 days and with the rights of an administrator. Your workspace sees this access and can end it at any time.
• Access without a ticket (section 14 (c)): If there is no ticket and your workspace cannot be reached, authorised employees may enter it in the event of a fault that can only be traced there — with a mandatory stated reason, for a maximum of 90 days and with notification to the owner by email and in the application.
• Security and law: insofar as this is necessary for security (for example to investigate misuse) or on the basis of legal obligations.

If, on the other hand, we work alongside you beyond a ticket with your workspace’s approval (section 14 (b), for example during setup), we do not see the events imported from Google or Outlook calendars — not even with the role of an administrator and not even if you have shared your calendar. The same applies to events that are created in Funnalized and synchronised with a connected calendar, because their content may have been changed there. Where only your availability matters (scheduling in the team calendar, booking pages), only the time appears as busy. These events cannot be changed or deleted directly via such access, not even individual events of a series. They are indirectly affected if such access edits or deletes something to which such an event is assigned, in particular: if it deletes a record such as a lead or customer, the event is deleted along with it; if it converts the record or merges it with another, the event may be assigned to the resulting or remaining record, when converting a lead with a note at the beginning of the description; if it changes, cancels or deletes a job interview, the event created for it takes over the title, time, location, video conference link and status or is deleted along with it. We also transfer the deletion and the changes to job interviews to your connected calendar. The access does not get to see the content of such an event in the process. The use and transfer of information that Funnalized receives from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

b) Microsoft calendar (Outlook, Microsoft 365)

If you connect a Microsoft account, we request the permissions Calendars.ReadWrite (read, create, change and delete events in your calendars), offline_access (continue the synchronisation in the background, even when you are not signed in) and User.Read (once when connecting: the identifier, the email address and the display name of the connected account). What we read, store, what for and who sees it corresponds to (a) — with these differences: your Microsoft default calendar is always synchronised (there is no selection); the events from one year back and one year ahead are read; for events that Funnalized creates or changes in your calendar, we do not transmit any participants to Microsoft, so that no invitations result from them. If desired, we create a Microsoft Teams link (business accounts); for personal Microsoft accounts, we request the meeting service for personal accounts — since Microsoft discontinued Skype on 5 May 2025, it is unclear whether a link is still created for this; if none is created, we create the event without a link. If you delete in Funnalized an event that originates from your Outlook calendar, we also delete it there (unless the connection is set to “Import only”); if you are the organiser of a meeting there, Microsoft sends cancellations to the participants in the process. Funnalized likewise takes over the “private” or “confidential” marking from Outlook; the same applies as for Google.

If users may not approve apps themselves in your company’s Microsoft directory, an administrator can grant consent once for everyone; Funnalized shows the link for this under Settings → Calendar. The company grants this consent vis-à-vis Microsoft; Funnalized does not receive any data as a result.

Disconnecting, revocation and deletion (re (a) and (b))

You can disconnect at any time under Settings → Calendar. We then immediately delete the stored access tokens and all events imported from Google or Microsoft. Events that were created in Funnalized remain — including their copies in your Google or Outlook calendar, which belong to you there.

• Google: When disconnecting, we revoke access at Google — unless the same Google account (recognised by the identifier that Google assigns) is still connected in another workspace, because Google’s revocation would otherwise also end that connection. You can withdraw access yourself at any time at myaccount.google.com/permissions.
• Microsoft does not offer apps a way to revoke. You withdraw your consent yourself: with a work or school account at myapps.microsoft.com (if your IT has consented for everyone, only it can remove the approval), with a personal account at account.live.com/consent/Manage.
• If you withdraw access at the provider without disconnecting in Funnalized — or if your company blocks the app —, the synchronisation ends and the account appears as “Reconnect”. You receive a notification announcing the disconnection. If you do not reconnect within 30 days of this announcement, Funnalized disconnects the connection itself, deletes the imported events and notifies you; before that, you can disconnect yourself at any time. If the cause lies with Funnalized, nothing is disconnected.
• If you choose another calendar or set the direction to “Export only”, we delete the events imported up to that point — they would no longer be kept up to date.
• If you leave a workspace, Funnalized disconnects your calendar connection there automatically (after five minutes at the latest), with the same consequences. If your access is only blocked, the synchronisation pauses and continues after unblocking.
• If the workspace is deleted, the calendar data is deleted with it, and we revoke access at Google — unless the same Google account is still connected in another workspace; for backups, see section 9.

For the duration of a connection process (no more than 15 minutes), we set a technically necessary cookie that binds the return route from the provider to your browser (see section 5). The legal basis for the calendar connection is Art. 6(1)(b) GDPR; if you use Funnalized as an employee of a customer, we process the data on behalf of your employer on the basis of the data processing agreement.

c) Meta (advertising campaigns)

If the workspace owner connects a Meta Business account, the platform gains access to ad accounts, connected pages, business assets and basic Instagram data (permissions ads_management, ads_read, pages_show_list, pages_read_engagement, pages_manage_ads, business_management, instagram_basic) in order to create, manage and evaluate advertising campaigns from Funnalized. As with every sign-in via Facebook, we also receive the identifier and the name of the person who connects (public_profile); they assign the connection, and the name shows in the settings which Facebook account is connected. Meta lead ads are not retrieved (leads_retrieval); leads are created within the platform (including via funnels, import, manual entry and forms), not by retrieval from Meta. The workspace owner is responsible for this processing.

If you remove Funnalized in your Facebook settings, Meta informs us. We then disconnect the connection in every workspace in which you established it and delete the access token, your Meta identifier, your name and the lists of your ad accounts and pages. If you request the deletion of your data via Facebook, we delete the connection completely, including the names of your ad accounts that campaigns have taken over. You can check the status of your request via the link that Facebook shows you. Whoever manages the connection in an affected workspace learns that it has been removed, without your name and without your identifier. Campaigns, ads and their evaluations remain in place: they are business data of the advertising company, do not originate from your Facebook profile and do not describe you.

As proof that we have deleted, we retain the confirmation code, the status and the scope of the deletion in figures for three years. Your Meta identifier is only available in encrypted form and only until the deletion has been completed; after that, the proof no longer contains any information about you. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR (accountability).

d) Sign-in with Google, Microsoft or LinkedIn (SSO)

If you sign in with your Google, Microsoft or LinkedIn account (privately or via your company, for example Google Workspace or Microsoft Entra ID), we redirect you to the respective provider for sign-in; for LinkedIn, this is LinkedIn Ireland Unlimited Company. From there, we receive the details of your basic profile, including email address and name, and the confirmation that the sign-in was successful (permissions openid, email, profile). Of these, only the email address is used: it assigns the sign-in to your existing Funnalized account, and only if the provider reports it as confirmed. No new account is created in the process. A password never reaches us at any point. For the duration of the sign-in process, we set a short-lived, technically necessary cookie that binds the return route from the provider to your browser and thus prevents manipulation of the sign-in; it is deleted immediately after sign-in. Legal basis: Art. 6(1)(b) GDPR (performance of contract — provision of access), for the cookie additionally § 25(2) no. 2 TDDDG.

If your employer has set up its own company login for its workspace (sign-in via the company’s directory using OpenID Connect or SAML 2.0, for example Microsoft Entra ID, Okta or Google Workspace), we likewise take only the email address, name and an identifier for assignment from this directory. If your employer additionally uses automatic user provisioning (SCIM), its directory creates your account or adds your existing account to its workspace, determines your name — it then applies to your entire account, including in other workspaces — and can block your access to its workspace; such a block ends all your sessions, including in other workspaces. This processing is carried out on behalf of your employer on the basis of the data processing agreement; we log the sign-in itself like any other under our own responsibility (section 4). If your account still requires the second factor after sign-in, another short-lived cookie records this intermediate step for a maximum of five minutes.

e) Sign-in with Facebook

You can link your Funnalized account with your Facebook account under Settings → Security and then sign in via Facebook. You confirm the linking with your Funnalized password. For sign-in, we redirect you to Meta Platforms Ireland Ltd. In the process, Meta only receives from us what the sign-in process technically requires: the identifier of our app, the address to which Meta sends you back, and a random check value. We do not transmit any information about your Funnalized account. From Meta, we receive exclusively two items of your public profile (permission public_profile): an identifier of your Facebook account that is valid only for Funnalized, and your name. We do not request your email address, contacts, posts or other profile data. A password never reaches us at any point, and we do not store Meta’s access token.

We store the identifier in order to assign you to your account when you sign in. Facebook only signs in an account with which you have previously linked it yourself, never on the basis of an email address. We only store the name so that you can see in the settings which Facebook account is linked. We delete both as soon as you unlink in the settings, remove Funnalized in your Facebook settings, request the deletion of your data via Facebook (you can check the status of your request via the link that Facebook shows you) or delete your Funnalized account, and likewise as soon as you change your password. After that, Facebook only signs you in again once you link again. For the duration of the sign-in process, we set the same short-lived, technically necessary cookie as under (d).

The legal basis is Art. 6(1)(b) GDPR (provision of the access to your account chosen by you), for the cookie § 25(2) no. 2 TDDDG. Meta is responsible for the processing at Facebook itself, such as your sign-in there; Meta’s privacy policy applies. Meta may transfer data to the USA and relies on EU Standard Contractual Clauses and the EU-US Data Privacy Framework for this.

The application, database and file storage are operated exclusively in data centres of Hetzner Online GmbH in Germany — the uploaded files (including application documents, receipts, media) are stored in object storage at the Nuremberg location. An encrypted backup copy of the database and a mirror of the files are additionally stored at the Falkenstein location. A monitoring server of the same provider in Helsinki (Finland, EU) checks availability from outside; it only processes operational data, not the content of the workspaces. We only store personal data for as long as is necessary for the respective purposes or as statutory retention periods (e.g. § 147 AO: 10 years for accounting records) exist. Account data is deleted after the end of the contract in accordance with the periods of the DPA (§ 9). We retain proof of a deletion requested via Facebook (section 8 (c)) for three years. Database backups are created daily, encrypted with AES-256 and overwritten after 14 days.

As a data subject, you have the following rights in particular under the GDPR:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure of your data (“right to be forgotten”, Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a machine-readable format (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
• Complaint to a data protection supervisory authority (Art. 77 GDPR) — the supervisory authority of your habitual residence or of our registered office is competent

Please send requests informally by email to datenschutz@funnalized.app. If your request concerns data in a customer workspace (e.g. your application to a company), we will forward it to the responsible customer.

We ourselves do not make any automated decisions within the meaning of Art. 22 GDPR about users of the platform. Insofar as customers configure automated pre-screening (e.g. minimum requirement questions) in their application funnels, the respective customer is the controller for this; the platform provides them with the transparency and information functions required under Art. 13(2)(f) and Art. 15(1)(h) GDPR.

We protect your data with measures that correspond to the state of the art: TLS encryption of all connections, encryption of sensitive stored access credentials (AES-256-GCM), password storage exclusively as a bcrypt hash, role-based access control with strict tenant separation, audit logging, daily backups encrypted with AES-256 and a hardened server infrastructure. Details are contained in § 5 of the DPA.

We send you two kinds of emails. They differ in whether you can unsubscribe from them — and there is a reason for this difference:

• Mandatory emails on contract, billing and security: for example invoices, payment reminders, the confirmation of a password change, notices of security-relevant events in your account and invitations to your team. These messages concern your account and your contract; you cannot unsubscribe from them. The legal basis is Art. 6(1)(b) GDPR (performance of contract), for legally required notifications Art. 6(1)(c) GDPR and for security notices Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Product and promotional emails: announcements of new features, calls to vote on suggestions on our idea board and comparable news about the product. You can unsubscribe from these emails at any time with one click; each of them contains an unsubscribe link for this purpose.

Legal basis and your right to object

We send product and promotional emails to existing customers on the basis of Art. 6(1)(f) GDPR (legitimate interest in direct marketing, cf. Recital 47) in conjunction with § 7(3) UWG. You can object to this use of your email address at any time and without giving reasons — via the unsubscribe link in every promotional email or informally by email to datenschutz@funnalized.app. You will not incur any costs for this other than the transmission costs according to the basic rates. The unsubscribe link takes effect immediately and does not require you to sign in. You will find your general right to object under Art. 21 GDPR in section 10.

What we measure in promotional emails — and what we do not

In order to recognise which notices are useful, and so as not to write to you more than necessary, we measure two things in product and promotional emails:

• Opens: Every promotional email contains an invisible image the size of one pixel (a so-called tracking pixel). If your email program loads this image, we record that the email was opened. An open is counted only once per recipient and email — if you view the same message several times, no further entry is created. We recognise automatic retrievals by upstream security filters of email providers and do not count them.
• Clicks: Links in promotional emails lead via a redirect on our server, which records the click and then forwards you to the destination. Clicks are counted every time; if you open the same link twice, two entries are created.

Only the following is stored in the process: the campaign concerned, your recipient line (your email address and the assignment to your account), the type of event (opened, clicked, unsubscribed, undeliverable), for a click the target address clicked, and the time. This information can be attributed to you: in the evaluation of a campaign, our employees authorised for this purpose can see whether a specific address opened the email or clicked a link. We say this explicitly instead of speaking of “anonymous statistics”.

Not stored for opens and clicks are your IP address and any identifier of your device or browser. The retrieval of the tracking pixel and of the click redirect reaches our server like any other page request and appears there in the server logs under section 3; it is not combined with the measurement result. There is no classification of you according to interests and no automated decision about you (see section 11).

Storage period

We retain the sending and measurement data of a campaign for as long as your account exists; there is no fixed deletion period for them. If your user account is deleted, the sending lines belonging to you and the open and click data attached to them are deleted along with it; only the number of recipients contacted at the time remains in the campaign, as a total without personal reference. Otherwise, the principles and periods from section 9 apply.

What unsubscribing does

If you unsubscribe, we record your objection against your email address and your account and will no longer send you any product and promotional emails — not even if the same address is stored with a further account. Mandatory emails on contract, billing and security will continue to reach you, because they concern your account and are not advertising: anyone who unsubscribes from news has not thereby waived their invoice or a security warning. You can also declare the objection informally — an email to datenschutz@funnalized.app is sufficient; the unsubscribe link is merely the most convenient way.

Your objection remains in place, even without an account. So that an objection once declared is not lost because your account is deleted, we secure it via a checksum of your email address — a value that can be calculated from the address but cannot be converted back into it. If your account is deleted, we remove the address in plain text and keep only this checksum. Before every sending, we check against it; if you later register again with the same address, you will therefore still not receive any advertising. For the sake of completeness: the check only works for the address with which you objected — a new, different address is not covered by it.

Sending

The technical sending is handled for us by the email delivery service provider named in section 7 as processor; delivery takes place via its EU data centre.

For the data that you process in your workspace, you are the controller and we are the processor (section 6). In order to support you, our employees occasionally have to look into your workspace. We describe here in full when this happens, how far it extends, how long it applies and what you see of it. There are exactly three ways in, and none of them is concealed: the person acting always works under their own identifier and their own name, is listed as a regular, time-limited membership in your workspace and appears in your member list. Signing in under your name or taking over your account does not take place.

a) When you open a support ticket

If you open a ticket, an employee of our support who is authorised to do so may enter the affected workspace in order to deal with it. We do not ask you for separate consent for this — your ticket is the instruction on which we act (DPA § 3(3)). We do, however, tell you in the ticket form before you submit it. The access is tied to this ticket and ends automatically as soon as the ticket is closed, but no later than after 14 days.

We are open about the scope: In your workspace, support receives the rights of an administrator and can therefore see and edit the same data as an administrator of your own team — including contact, applicant and application documents as well as uploaded files. There is no restriction to individual areas on this route, because before looking in, nobody knows which section is sufficient for the solution. The only exception is ownership: the access account cannot become the owner of your workspace and cannot transfer ownership.

b) Working alongside you beyond ticket handling

Everything that goes beyond dealing with a ticket — such as working together on a campaign or setting up your workspace — happens exclusively with your express approval. We request such access stating the reason; you decide whether to grant it at all and determine the role with which the access is equipped. The owner role cannot be assigned. We notify you of such a request in the application and by email; this message concerns the security of your account and cannot be unsubscribed from. If the request remains unanswered, it expires by itself after 7 days. You determine the duration with the approval; if none is specified, a default of 30 days applies, and the upper limit is 180 days. If you run your own workspaces for your customers, such collaboration there is additionally blocked unless you expressly allow it. Such access does not see events that members of your workspace have imported from their Google or Outlook calendar or synchronise with it — not even with the role of an administrator; where only availability matters, the time appears as busy (section 8 (a)).

c) Access without a ticket in urgent cases

For cases in which there is no ticket and you cannot be reached — for example in the event of a fault that we can only trace in your workspace —, there is a third route. Only employees with the right to manage accounts may use it, stating a reason is mandatory, and the access is limited to a maximum of 90 days; a daily run removes expired access. This access too is created as a regular, time-limited membership and is visible in your member list. We inform you of its set-up by email to the owner of the workspace and additionally as a notification in the application; the message states the reason given verbatim, the role assigned and the end date and cannot be unsubscribed from.

What you see in the meantime — and how you end it

As long as such access exists, a strip appears at the top of every view of your application that states the name of the person accessing, the reason and the end date. You can hide it for the current page view; on the next page view it is back, because it is not meant to be permanently dismissible. Under Team → Funnalized access you see all existing access — this list is deliberately visible to every member of your workspace, not just to administrators. There you can end any access immediately at any time, without a query and without giving reasons. In addition, a support access is noted in the history of the ticket concerned.

Report on the access: You can retrieve a report for each ticket. It contains the ticket header, the complete message history, a chronology of the entries (who entered when and when the access ended) and a list of the changes that were made in your workspace via such access. Internal notes of our employees are not included.

What we log

Every grant, every entry and every termination of such access is recorded: which employee acted, when, for what reason and — on entry — additionally their IP address and browser identifier. These entries are pseudonymised after one year by replacing the email address and IP address with a value that cannot be reversed, and deleted after three years. So that you can assess the scope correctly: these events and the changes made are recorded, not every single page view. Independently of this and for all access — not only that of our support — a separate log records read access to particularly sensitive types of data (including leads, contacts, customers, companies, applicants and data exports); it is deleted after 365 days.

Legal basis: Insofar as data from your workspace is processed in the process, this takes place as processing on behalf on your instructions (Art. 28 GDPR, DPA). We are the controller for the logs themselves; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in the traceability of every access) in conjunction with Art. 32 GDPR.

In three places, we ask you for your assessment. None of this information is a prerequisite for using Funnalized, cancelling or getting help. What is stored in the process and who reads it is set out here.

a) Satisfaction survey in the application

Once per quarter — at the earliest 14 days after your account was created — we display a card at the bottom right and ask how likely you are to recommend us. Your rating from 0 to 10, an optional free text, the quarter and the time are stored, linked to your user account and your workspace. The card does not block anything and can be closed.

A point we do not conceal: Closing or “later” is also stored as a response — what is then recorded is that you do not wish to take part in this quarter, linked to your user account. This happens solely so that we do not ask you again in the same quarter. There is no way to close the card without such an entry.

In our internal evaluation, the rating, free text, quarter and the name of your company appear — your name and your email address are not displayed there. However, the assignment to your user account remains in the database; we therefore do not speak of an anonymous survey. When your user account or your workspace is deleted, the response is deleted along with it; there is no fixed deletion period beyond this.

b) Feedback on a support ticket

Once a ticket has been resolved, you can rate it in the ticket history. A rating of one to five stars is stored, as well as — each voluntarily — whether your problem was solved, at which contact this was achieved, and a free text. The information is stored with the ticket concerned and is thus assigned to you and your workspace. You can skip the rating as a whole; if you want to submit it, the number of stars is required, nothing else.

Your feedback is included in our internal quality evaluation — also in relation to the person who handled your ticket. Your free text can be read by our employees authorised for this purpose in connection with the ticket.

c) Stating a reason for cancellation

If you end your trial period or cancel your subscription, we ask you on a voluntary basis for the reason. The information is not a prerequisite: anyone who skips the form cancels just the same, and even a failed recording does not hold up the cancellation or deletion. A reason from a fixed selection, an optional free text and, for classification, the name of your company, the plan, the duration of the collaboration and the most recently billed monthly amount are stored. No reference to you as a user is stored in the process.

This information is deliberately designed to outlast the deletion of the workspace — otherwise, precisely the information that documents the reason would disappear with the cancellation. The free text can only be read by employees with authorisation for the finance area and is not even retrieved without this authorisation. As you formulate it freely, we ask you not to include any information about individual persons there.

Legal basis and objection

The legal basis for all three types of feedback is Art. 6(1)(f) GDPR — our legitimate interest in aligning Funnalized and our support with what our customers actually experience. We expressly do not base them on your consent: in the satisfaction survey, a refusal is also recorded, and consent would not be an appropriate framework for this. You can object to this processing at any time pursuant to Art. 21 GDPR — informally by email to datenschutz@funnalized.app; for your further rights, see section 10.

In order to identify accounts that are not getting started and to direct our support to where it is needed, we analyse how a workspace is used: which modules are used at all, how many operations are created in them and when something last happened. On this basis, we assign each workspace to one of five levels — active in the last 7 days, active in the last 30 days, quiet for 30 to 90 days, dormant for more than 90 days or never used — and keep a list of the quiet workspaces.

Your content is not read in the process. Only counts and times are evaluated: how many operations there were and when the last one was. Which type of record was affected is included as a type designation — such as “lead” or “deal” —, but never its content: no names of prospects or applicants, no subject lines, no notes, no file names. Only the name of your company appears as plain text.

The analysis takes place at the level of the workspace, not at the level of individual persons. Which of your employees did what and when cannot be answered with it and is not collected by us: the time of the last sign-in is only included as the most recent value across all members, without naming the person concerned. Evaluating or monitoring individual employees of your company is therefore neither intended nor possible.

Only those of our employees to whom the corresponding authorisation has been expressly assigned have access to this analysis. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in needs-based support and in the further development of the service). You can object to this processing pursuant to Art. 21 GDPR; see section 10.

We adapt this privacy policy when the legal situation or the range of functions changes. You will always find the current version at this URL; we inform registered users of material changes by email.