Privacy Policy

FunnelFi is a B2B pre-qualification intelligence platform operated by FunnelFi, Inc. ("FunnelFi," "we," "us," or "our"), a Delaware corporation. This Privacy Policy explains how FunnelFi collects, uses, retains, and discloses information in connection with the FunnelFi platform and related services, including the FunnelFi API, VectorIQ, and CaptureIQ (collectively, the "Platform").

FunnelFi is designed for use by businesses, not individual consumers. Our direct customers are companies, brokers, lenders, and marketing partners ("Customers") who access the Platform to pre-qualify their own business-owner leads. When we process personal information about a Customer's leads, we do so on behalf of and at the direction of that Customer.

By accessing or using the Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree, do not use the Platform.

The Platform is owned and operated by:

FunnelFi, Inc.
A Delaware C-Corporation
Email: support@funnelfi.ai
Website: funnelfi.ai

FunnelFi is a product of FunnelFi, Inc. References to "FunnelFi," "FunnelFi," "we," "us," and "our" throughout this Policy refer to FunnelFi, Inc. and its affiliated products and services. FunnelFi, Inc. may operate additional products and services under the FunnelFi Intelligence brand umbrella, each subject to their own applicable terms.

A. Customer Account Information

When a business registers for the Platform, we collect information necessary to provision and manage the account, including:

• Business name, address, and contact details
• Authorized user name(s) and email address(es)
• Billing information (processed by our payment processor — we do not store raw payment card data)
• API key usage logs and account configuration settings
• Certifications of permissible purpose for credit data access
• A2P 10DLC campaign registration information, where applicable

B. Lead Data Submitted by Customers

Customers submit lead data to the Platform for pre-qualification. The data processed per lead typically includes:

• Full name (first and last)
• Phone number
• Email address
• IP address and consent metadata (ConsentDate, ConsentIP) where applicable
• Business revenue, time in business, and industry (where provided)
• UTM parameters, referral source, and page-level tracking data (for CaptureIQ leads)
• TCPA/SMS consent records, opt-in timestamps, and opt-out events (where captured via CaptureIQ or Customer webhook)

C. Historical Performance Data (VectorIQ)

Customers using VectorIQ may upload historical funded deal records (Winners) and declined-lead records (Losses) to improve the accuracy of their pre-qualification model. These uploads contain business owner name and email at minimum, and optionally include business revenue, time in business, and funded amounts.

D. Platform Usage and Technical Data

We automatically collect technical data when Customers access the Platform, including:

• IP addresses and browser/device information
• API request and response logs (excluding sensitive credit report details)
• Session activity, feature usage, and error logs
• Embed token activity for CaptureIQ installations

We use the information collected for the following purposes:

• Service Delivery: To operate the Platform, process API calls, run pre-qualifications, deliver qualification results, and push lead data to Customer-configured webhooks and CRM endpoints.
• Account Management: To provision accounts, manage billing, communicate service updates, and provide customer support.
• Compliance: To maintain records required by the Fair Credit Reporting Act (FCRA), Telephone Consumer Protection Act (TCPA), FTC regulations, and applicable state and federal law, including consent records and permissible purpose documentation.
• Platform Intelligence and Model Training: Qualification outcomes and derived non-credit demographic signals generated through Platform activity are used to train and improve FunnelFi's proprietary decision intelligence models — both at the platform-wide level and at the individual account level. See Section 04A below for a full description of this process.
• Security and Fraud Prevention: To monitor for unauthorized API usage, abuse, and security incidents.
• Legal Obligations: To respond to lawful legal process, regulatory inquiries, or court orders.
• Internal Analytics: To analyze platform-wide usage patterns, product performance, and service reliability in aggregate, non-personally-identifying form.
• Complementary Financial Service Identification: Aggregated qualification outcome data and non-credit demographic signals derived from Platform activity may be used by FunnelFi to identify individuals who may benefit from financial products and services that are complementary to those available through the Platform — including credit improvement programs, financial wellness tools, and related offerings within the FunnelFi Intelligence portfolio or facilitated through affiliated arrangements. Any such use is conducted consistent with applicable law and the consent obtained at the time of data collection, and does not involve the use, transfer, or sale of raw credit report data.
• Communications: Contact information provided through the Platform may be used to communicate with Customers and, where applicable and consistent with applicable consent, with individuals whose information is processed through the Platform, regarding products, services, and program opportunities within the FunnelFi portfolio. All communications include opt-out mechanisms and are conducted consistent with applicable law. See Section 08 for details.

Every pre-qualification processed through FunnelFi produces a qualification outcome — a structured signal indicating whether a given individual meets the configured eligibility criteria for a given account. These outcome signals, independent of any raw credit report data, are used to continuously train and improve FunnelFi's proprietary decision intelligence layer. This process operates at two distinct levels.

Platform-Level Model Training (Global)

Qualification outcome signals across all Customer accounts are aggregated and used to train FunnelFi's core intelligence model — a proprietary vector database maintained internally by FunnelFi. At this level, the model learns what a "qualified" profile looks like relative to a "disqualified" profile across different account types, industries, lead sources, and lending verticals. Over time, this makes the FunnelFi qualification engine more accurate and predictive across the entire Platform, benefiting all Customers. No personally identifiable information (PII) and no raw credit report data are transmitted into this training pipeline.

Account-Level Model Training (VectorIQ)

Simultaneously, each qualification outcome contributes to the Customer's individual VectorIQ model instance. Every qualified and disqualified result processed on behalf of a given account trains that account's algorithm using data that is specific to that Customer's lead profile, account type, and industry. Over time, the account-level model becomes increasingly accurate at predicting qualification outcomes for that specific Customer's lead sources and business context — without any data from other Customers' accounts being used or exposed.

How Signals Are Used — Privacy Protection in Model Training

The model training pipeline does not use personally identifiable information or raw credit report data. The signal passed into the training layer consists of a one-way hashed email address and a hashed name identifier. These hashed identifiers are mapped within FunnelFi's internal data environment to a rich demographic profile — compiled from identity resolution data, behavioral signals, and publicly available information — that may include hundreds of data attributes describing the individual's demographic and financial behavioral characteristics. The model trains on these demographic and behavioral attributes, not on personal contact data or credit file content. The result is a continuously refined demographic "profile" of what a qualified and a disqualified individual looks like for each account type — enabling more accurate and predictive pre-qualification results over time.

Customer Data Isolation in Model Training

Account-level VectorIQ models are trained exclusively on data processed for that account. No Customer's lead data is used to train another Customer's model, and no Customer has visibility into another Customer's model or qualification data. At the platform-wide level, only the aggregated outcome signal (qualified/not qualified) and associated de-identified demographic attributes contribute to the global model — individual account identities and business relationships are not exposed.

FunnelFi pre-qualifications are powered by soft credit pulls. Soft pulls do not affect a lead's credit score and are not visible to other lenders or creditors on the lead's credit file.

The Fair Credit Reporting Act (FCRA) requires that any entity obtaining a consumer credit report have a permissible purpose and obtain appropriate consumer consent before doing so.

Customer Responsibilities

Customers using the FunnelFi API are responsible for obtaining written FCRA consent from each lead before submitting that lead's information to the Platform for pre-qualification. FunnelFi provides sample FCRA consent language and requires Customers to certify a permissible purpose at the time of account registration.

CaptureIQ Consent Capture

For Customers using CaptureIQ, FCRA consent is captured directly through the popup form. The form includes a mandatory, non-modifiable FCRA disclaimer checkbox. Consent is recorded server-side at the moment of form submission, capturing the ConsentDate (timestamp) and ConsentIP (visitor IP address from server request headers). Customers may not remove or modify the FCRA disclaimer in CaptureIQ.

Backend Credit Infrastructure

FunnelFi operates an FCRA-compliant soft-pull credit pre-qualification pipeline. When a pre-qualification is triggered, the lead's name, phone, and email are processed through FunnelFi's credit intelligence infrastructure, which returns a structured credit data response used solely to compute the qualification result for that specific call. Credit data returned through this pipeline is not sold, licensed, or shared with any other party.

FunnelFi works with categories of third-party infrastructure providers to deliver Platform services. These providers process data only as necessary to perform their designated function and are contractually bound to protect the data they handle.

• Credit Data Infrastructure: FCRA-compliant backend infrastructure for soft credit pull processing
• Database Infrastructure: Platform database and backend infrastructure (encrypted at rest and in transit)
• Payment Processing: Billing and subscription management (FunnelFi does not store raw card data)
• Communication Infrastructure: SMS and voice notification delivery, registered under applicable A2P 10DLC frameworks for platform-initiated messaging
• Analytics and Monitoring: Internal monitoring tools for uptime, error tracking, and API performance

A current list of sub-processors that handle personal data on behalf of the Platform is available on written request to support@funnelfi.ai.

We do not sell lead data to third parties. We do not share Customer lead data with other Customers or with lenders outside of the Customer's own configured workflow. See Section 08 for our complete data sale policy and FunnelFi marketing rights.

Platform-Initiated Communications

FunnelFi may send transactional communications to Customers and, where applicable, to leads via SMS or email. These include account notifications, qualification result alerts, and system status updates. Platform-initiated SMS messages are sent exclusively through communication infrastructure registered under the A2P 10DLC framework with The Campaign Registry (TCR). FunnelFi does not send unsolicited marketing SMS messages to leads or end-users. All platform-initiated messaging is transactional in nature.

A2P 10DLC Registration

The Application-to-Person (A2P) 10-digit long code (10DLC) framework, as administered by major U.S. wireless carriers and The Campaign Registry, requires that businesses registering to send commercial SMS traffic through long-code numbers comply with carrier vetting and campaign registration requirements. FunnelFi maintains its own A2P 10DLC registrations for platform-level messaging. Customers who use FunnelFi qualification data to conduct their own outbound SMS campaigns are solely responsible for obtaining their own A2P 10DLC registration, maintaining campaign compliance, and honoring all carrier-imposed messaging policies.

TCPA Compliance — Customer Responsibility

The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, restricts telemarketing calls and text messages made using automated telephone dialing systems (ATDS) or prerecorded voice messages to wireless numbers. When using FunnelFi qualification data to conduct outbound phone or SMS outreach, Customers are solely responsible for:

• Obtaining prior express written consent from each lead before sending any autodialed, prerecorded, or artificial-voice messages to wireless numbers
• Restricting outbound contacts to the hours of 8:00 AM to 9:00 PM in the lead's local time zone
• Maintaining and honoring an internal Do-Not-Call (DNC) list; processing opt-out requests within one business day across all channels
• Scrubbing lead phone numbers against the National DNC Registry and applicable state DNC registries prior to dialing
• Complying with carrier-specific opt-out keywords (STOP, QUIT, CANCEL, UNSUBSCRIBE, END, HELP) and honoring any such keyword responses immediately
• Maintaining TCPA consent records for a minimum of 5 years, including opt-in timestamp, consent language presented, and opt-in method
• Complying with the FTC's Telemarketing Sales Rule (TSR) and any applicable state telemarketing laws

CaptureIQ and SMS Consent

Where Customers configure CaptureIQ to include an SMS opt-in checkbox, that consent language is the Customer's responsibility to draft and maintain consistent with TCPA requirements. FunnelFi logs the ConsentDate and ConsentIP server-side at the time of form submission. Customers acknowledge that FunnelFi's logging of consent metadata does not constitute legal advice or a guarantee of TCPA compliance, and Customers should consult qualified legal counsel regarding their specific SMS campaign practices.

Email Communications (CAN-SPAM)

Any commercial email sent by FunnelFi to Customers or, at Customer direction, to leads complies with the CAN-SPAM Act, including accurate sender identification, non-deceptive subject lines, a physical postal address, and a functional unsubscribe mechanism. Unsubscribe requests are honored within 10 business days. Customers sending their own commercial email using Platform data are responsible for their own CAN-SPAM compliance.

No Sale of Data to Third Parties

FunnelFi, Inc. does not sell, rent, license, or trade Customer data or lead data to unaffiliated third parties for advertising, lead monetization, or any commercial purpose outside of delivering the Platform services. This prohibition extends to external data brokers, aggregators, and unaffiliated marketing networks. Customer lead data is not shared with other Customers; each account is logically isolated at the database level.

FunnelFi Portfolio Rights

FunnelFi, Inc. operates — and may in the future operate — multiple products and services under the FunnelFi Intelligence brand umbrella. The data processed through the Platform, including qualification outcomes, demographic signals, and contact information collected through Platform-embedded forms and tools, may be used by FunnelFi in connection with the operation, improvement, and promotion of its portfolio of products and services. This includes, without limitation:

• Communicating with Customer account contacts regarding Platform updates, new capabilities, and related products offered within the FunnelFi portfolio
• Using aggregated qualification outcome data and derived non-credit demographic signals to identify and facilitate access to financial products and services — including credit improvement programs, financial wellness tools, and related offerings — that FunnelFi determines may be relevant to individuals based on their qualification profile, consistent with applicable law and any consent obtained at the time of data collection
• Using Platform data in aggregate to develop, test, and improve FunnelFi products and services, including future product offerings within the portfolio

All communications made by FunnelFi in connection with these rights will: identify FunnelFi, Inc. as the sender; comply with applicable communication law including CAN-SPAM and TCPA; and include a functional opt-out mechanism. Opt-out requests are honored within 10 business days and do not affect Platform access or transactional account communications.

To opt out of non-transactional FunnelFi communications, email support@funnelfi.ai with "Unsubscribe" in the subject line or use the unsubscribe link in any FunnelFi communication.

FunnelFi may disclose information in the following circumstances:

• Customer Direction: FunnelFi transmits lead qualification results to the webhook endpoints, CRMs, and dialer systems configured by the Customer. These disclosures are made at the explicit direction of the Customer as part of the service.
• Service Providers: FunnelFi shares data with the third-party service providers listed in Section 06 solely to operate the Platform.
• Legal Process: FunnelFi may disclose information when required by law, court order, subpoena, or governmental authority, or when we believe disclosure is necessary to protect the rights, safety, or property of FunnelFi, our Customers, or the public.
• Regulatory Compliance: FunnelFi may disclose data to regulators including the FTC, CFPB, FCC, or state attorneys general in response to formal investigations, audits, or enforcement actions.
• Business Transactions: In the event of a merger, acquisition, asset sale, or restructuring of FunnelFi, Inc., data held by the Platform may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy. Affected Customers will be notified.
• Aggregate Data: Non-personally-identifying, aggregated, or de-identified data may be disclosed or published without restriction.
• Affiliated Financial Programs: De-identified and aggregated qualification outcome data and derived demographic signals may be used within the FunnelFi portfolio to facilitate access to financial products and services — such as credit improvement, financial wellness, and related programs — that may be relevant to individuals based on their qualification profile. Such use is based on outcome signals and non-credit demographic attributes; raw credit report data is not disclosed for this purpose. Any communications made in connection with this use will be consistent with applicable consent and law.

FunnelFi takes the security and integrity of Customer and lead data seriously. The following describes how data is stored, protected, and managed at an infrastructure level.

Infrastructure & Storage Location

All Platform data is stored in the United States on managed PostgreSQL infrastructure hosted with enterprise-grade cloud providers that maintain industry-standard physical security controls. FunnelFi does not transfer Customer or lead data to servers outside the United States as part of standard Platform operations.

Organizational Controls

FunnelFi maintains written information security policies covering data classification, access management, incident response, and vendor oversight. Internal access to production data is restricted to personnel with a documented business need, subject to least-privilege principles and regular access reviews.

Vendor Security

All third-party infrastructure providers are reviewed for security posture, data processing agreements, and compliance certifications prior to integration and on an ongoing basis. FunnelFi does not onboard vendors that do not meet minimum security and compliance standards appropriate to the data they handle.

Incident Response & Breach Notification

FunnelFi maintains a documented incident response plan. In the event of a security incident involving unauthorized access to Customer or lead personal information, FunnelFi will:

• Contain and investigate the incident promptly
• Notify affected Customers within a reasonable timeframe and no later than required by applicable law
• Notify the FTC within 30 days if the breach affects 500 or more consumers, consistent with FTC Safeguards Rule (GLBA) requirements applicable to financial service finders
• Cooperate with regulatory investigations as required

Limitations

No data transmission over the internet or electronic storage system can be guaranteed to be 100% secure. While FunnelFi employs commercially reasonable security measures, we cannot guarantee absolute security. If you believe your account or Platform interaction has been compromised, contact us immediately at support@funnelfi.ai.

FunnelFi retains data for the following minimum periods, consistent with applicable regulatory requirements:

• API call logs and pre-qualification records: Minimum 60 months, consistent with FTC Telemarketing Sales Rule (TSR) recordkeeping standards.
• CaptureIQ consent records (ConsentDate, ConsentIP, form submission data): Retained indefinitely as FCRA compliance documentation.
• TCPA/SMS consent records: Minimum 5 years from the date of consent, including opt-in timestamp, consent language, opt-in method, and opt-out events.
• Customer account records: Retained for the duration of the account relationship and for a minimum of 3 years following account closure.
• VectorIQ upload records: Retained for the life of the Customer's account to support model accuracy.
• Security and access logs: Minimum 60 months.

Upon Customer request following account closure, we will work to delete or de-identify Customer account data, subject to our legal retention obligations and any ongoing compliance requirements.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) may provide you with additional rights regarding your personal information.

California residents may have the right to:

• Know what personal information we have collected about them and how it is used and shared
• Delete personal information we have collected, subject to certain exceptions
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information (FunnelFi does not sell personal information for advertising purposes)
• Limit the use of sensitive personal information
• Non-discrimination for exercising privacy rights

Note that FunnelFi is a B2B platform. Business contact information collected in the context of a purely commercial transaction may not qualify as "personal information" under the CCPA. However, California-resident business owners whose information is processed as leads through the Platform retain consumer rights under CCPA.

To submit a California privacy rights request, contact us at support@funnelfi.ai. We will respond within 45 days of receiving a verifiable request.

Customers may update account information by logging into the Platform or contacting us directly.

Customers may request account closure at any time. Following closure, FunnelFi will retain records as required by applicable law and its data retention policy described in Section 11.

To opt out of FunnelFi product communications, email support@funnelfi.ai with "Unsubscribe" in the subject line or use the unsubscribe link in any email from FunnelFi. Opting out does not affect your Platform access or transactional account communications.

If you believe your information has been submitted to the Platform as a lead and you wish to request deletion or correction, contact us at support@funnelfi.ai. We will work with the relevant Customer and our service providers to honor your request to the extent permitted by law.

Cookies and browser tracking technologies may be used on the FunnelFi website for analytics and session management. Most browsers allow you to decline cookies through browser settings. Disabling cookies may limit certain functionality on the site.

The Platform is intended exclusively for use by businesses and business professionals. The Platform is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18. If you believe a minor's information has been submitted to the Platform in error, contact us at support@funnelfi.ai and we will take appropriate steps to remove it.

FunnelFi reserves the right to update this Privacy Policy at any time. When we make material changes, we will revise the "Last Revised" date at the top of this page. Where required by law, we will provide additional notice to affected parties. Continued use of the Platform following the effective date of a revised Policy constitutes acceptance of those changes.

We encourage Customers to review this Policy periodically to stay informed about how we collect, use, and protect information.

Questions, requests, or concerns regarding this Privacy Policy should be directed to:

FunnelFi, Inc.
Attn: Privacy
support@funnelfi.ai
funnelfi.ai

Note that email communications may not be fully secure. Please do not include sensitive financial or authentication information in email correspondence. For verified legal notices, contact us by email with "Legal Notice" in the subject line.