Data Processing Addendum

For personal data a customer submits to BuildMyFunnel, the customer is the controller and BuildMyFunnel is the processor acting on documented instructions. For account, billing, security, and usage data, BuildMyFunnel acts as an independent controller under the Privacy Policy.

• •Subject matter: generating products, funnels, copy, and related assets from customer-provided briefs.
• •Purpose: providing the service configured and triggered by the customer.
• •Data subjects: customer personnel, clients, prospects, and people mentioned in customer material.
• •Categories: contact data, business data, marketing profiles, testimonial/customer-story content.

BuildMyFunnel uses TLS in transit, managed database encryption at rest, account scoping/RLS, encrypted BYOK key storage, admin role gating, audit logs, isolated Vercel Sandbox build execution, and vendor-managed backup/recovery controls.

The current authorised sub-processors are listed on the sub-processor page. BuildMyFunnel gives 30 days' prior notice of intended additions or replacements where required by the DPA.

On termination or customer request, BuildMyFunnel deletes or returns customer personal data and deletes existing copies within 30 days, unless applicable law requires retention. Project source uploads can be removed through project source controls; broader deletion of projects, generated artifacts, or an entire account is handled by support/admin request until broader self-service deletion is shipped.

Where processing involves transfers outside the EEA/UK/CH, the parties rely on applicable adequacy decisions, EU Standard Contractual Clauses, and vendor transfer mechanisms listed for each sub-processor. BuildMyFunnel makes information reasonably necessary to demonstrate compliance available under confidentiality and reasonable audit limits.