Privacy Policy

Thank you for using FunctionalAI. This Privacy Policy explains how FunctionalAI ("we," "us," or "our") collects, uses, discloses, and protects personal information when you use our website and services ("Service"). It also describes your rights and choices regarding your personal data. We are committed to protecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and other relevant regulations.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

1. Information We Collect

We may collect several types of information from and about users of our Service, including:

Information You Provide Directly

When you sign up for FunctionalAI or use our Service, you may provide personal information such as your name, email address, company name, and account login credentials. You may also provide content when using the Service's features – for example, by entering chat conversations, uploading files or documents, or providing prompts to the AI. All data that you input into the Service (including any text, files, or other materials) is collected and stored to enable the Service's functionality.

Information from Connected Accounts

If you choose to integrate or connect third-party accounts with FunctionalAI, we will access certain information from those accounts with your permission. The currently supported integrations are:

• If you connect a Gmail account, we access your emails, email headers, attachments, and related data in order to read incoming messages or draft/send responses on your behalf, in compliance with the Google API Services User Data Policy (including the Limited Use requirements).
• If you connect Instagram or Facebook Messenger, we retrieve messages, comments, and related conversation metadata from that platform to process them through our AI and generate replies. Use of this data is limited to providing the Service to you and is subject to the Meta Platform Terms.
• If you install our Shopify app, we access store, product, customer, and order data through the Shopify Admin API solely to power your AI assistant and any approved analytics features.
• If you connect Slack (Two-Way Slack), we post your widget and share-link conversations into the Slack channel you choose — including the visitor's name or identifier, their messages, the AI's replies, and handoff alerts — and we receive the replies your team writes in Slack so we can deliver them to the visitor. We store the Slack workspace and channel identifiers and an access token, and nothing else from your Slack workspace.
• If you set up a Discord or Telegram alert (a “notification sink”), we send one-way alerts to the webhook, bot, or chat you specify. An alert contains the channel name, the visitor's name or identifier, a preview of the visitor's message, the AI's reply or the reason there was none, and, for handoffs, the rule that fired and how long the visitor has been waiting. We store the webhook URL or bot token and chat ID you enter.

Slack, Discord, and Telegram are tools you choose for your own team. When you connect one, the conversation data described above leaves our systems and is processed by that provider under your own agreement with them, which may involve transfers outside the EEA. They are not our sub-processors, and you are responsible for having a lawful basis to send your visitors' data there. You can disconnect Slack or delete an alert at any time on the Handoff & Alerts page; we then stop sending new data, but we cannot delete messages already delivered to your Slack, Discord, or Telegram.

Other channels (e.g., WhatsApp Business, LINE) may be added in the future. We will update this Privacy Policy and the sub-processor list before any new channel becomes available to you.

Payment and Transaction Information

If you make a purchase or subscribe to a paid plan outside the Shopify ecosystem, our third-party payment processor Lemon Squeezy (a Stripe company) acts as merchant of record: Lemon Squeezy issues the invoice to you, collects payment, handles VAT/sales tax, and pays FunctionalAI a monthly settlement net of fees. If you install us through the Shopify App Store, Shopify plays the same merchant-of-record role through its Billing API. In both cases, your payment-card details, billing address, and cardholder name are collected and stored by the merchant of record, not by us.

On our side, while your account is active we keep an internal reconciliation record per transaction — amount, date, plan tier, and the pseudonymous order/subscription identifier issued by Lemon Squeezy or Shopify. These rows are operational data, not Polish tax records. Our Polish tax records are the monthly payout / settlement statements from Lemon Squeezy or Shopify and the invoices we issue to them; those documents (which do not identify individual end users by name or card details) are retained for the 5-year period required by Art. 86 § 2 of the Polish Tax Ordinance. When you delete your account, the per-transaction reconciliation rows are deleted along with the rest of your data.

Automatically Collected Information

When you use our website or app, we may collect certain information automatically via cookies, log files, and similar tracking technologies. This can include your IP address, browser type, device type, operating system, referring URLs, pages viewed, and links clicked.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide and Operate the Service: We process your registration information to create and maintain your account, and we use your input data to generate AI responses and perform the functions you request.
• To Integrate with Third-Party Services: If you connect external accounts (email, social media, etc.), we use the data from those accounts as instructed by you to facilitate the integration.
• To Communicate with You: We may use your contact information to send service-related communications, including confirmations, updates, and customer support responses.
• For Customer Support and Account Management: If you reach out to us with questions or issues, we use your information to respond and help resolve them.
• To Improve and Develop the Service: We analyze usage trends and user interactions to improve our platform, typically in an aggregated or de-identified manner.
• For Security and Abuse Prevention: We may process data to detect, prevent, and respond to potential fraud, hacking attempts, or misuse of our Service.
• To Comply with Legal Obligations: We may need to use or retain your information to comply with laws, regulations, or court orders.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide the Service you have requested, including account creation, AI chatbot functionality, and customer support.
• Legitimate Interests: Processing for our legitimate business interests, such as improving our Service, preventing fraud, ensuring security, and conducting analytics. We balance these interests against your rights and freedoms.
• Consent: Where required, we obtain your consent for specific processing activities, such as marketing communications or optional third-party integrations. You may withdraw consent at any time.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, or legal processes.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information when you use our Service. Here is how we use these technologies:

Types of Cookies We Use

• Essential Cookies: Required for the Service to function properly. These include authentication cookies, security cookies, and session management cookies. You cannot opt out of these cookies.
• Analytics Cookies: We use Google Analytics and PostHog on our marketing website to understand how visitors interact with it. These cookies collect information about page views, session duration, and usage in an aggregated, anonymized manner. Whether they are set before you make a choice depends on where you are: opt-in in the EEA, UK and Switzerland, on by default with an opt-out everywhere else — see section 11c. Session replay is a separate category that is off in every region until you switch it on.
• Preference Cookies: These cookies remember your settings and preferences (such as language or display options) to provide a more personalized experience.

Chat Widget Cookies

The FunctionalAI chat widget — on our own website and on the websites of merchants who embed it — stores one first-party identifier so a returning visitor can resume their existing conversation. It is not set on page load: it is only written after the visitor actually engages with the chat (sends a message, submits the pre-chat form, or uploads a file). If you never interact with the widget, no persistent identifier is stored. Merchants embedding the widget can copy the table below into their own cookie notice:

For visitors a merchant identifies to us as logged-in customers, the same identifier is stored under a per-customer key (fai_visitor_id_<customer identifier>) with the same purpose and lifetime. Related conversation state (submitted pre-chat form data, last-read message markers) is kept in localStorage only, also only after engagement.

Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. However, disabling essential cookies may affect the functionality of the Service. For more information on managing cookies, visit www.allaboutcookies.org.

Do Not Track

Some browsers have a "Do Not Track" feature that signals to websites that you do not want your online activity tracked. Our Service does not currently respond to "Do Not Track" signals.

5. How We Share or Disclose Information

We understand that your data is important, and we only share personal information with others in the following circumstances:

Service Providers and Partners

We use trusted third-party companies to perform certain functions to operate and improve FunctionalAI. Key service providers include:

• OpenAI (AI Processing): We send the content of your queries and documents to OpenAI's GPT-based language models to generate responses. They may retain data for up to 30 days to monitor for abuse but do not use this data to train their general AI models by default.
• Payment Processors: When you make payments outside the Shopify ecosystem, the transaction is processed by Lemon Squeezy (a Stripe company). For Shopify-installed merchants, billing flows through Shopify's Billing API. We do not collect or store your sensitive payment card details.
• Hosting and Infrastructure: Our primary application and database are hosted by Hetzner Online GmbH in Falkenstein, Germany (EU). User-uploaded files, avatars, and conversation-export archives are stored in AWS S3 in Frankfurt, Germany (eu-central-1).
• Transactional Email: Account verification, billing receipts, and system notifications are delivered via Mailjet (a Sinch company, France).

Destinations You Choose

If you connect Slack or set up Discord or Telegram alerts, we send conversation data to the workspace, server, or chat you choose, as described in section 1 under “Information from Connected Accounts”. We send it on your instruction, to your own tools.

6. AI Model Training & Merchant Data

We want to be explicit about how your data is used in relation to AI model training:

For Shopify Merchants

If you use FunctionalAI through our Shopify integration, we want to be crystal clear about our data practices:

• We do NOT train AI models on your store data. Your product information, customer details, and order data are used solely to power your AI assistant's responses.
• We do NOT train AI models on your customers' conversations. The conversations your customers have with your AI assistant are never used to train any AI model — ours or anyone else's.
• Your data is isolated. Knowledge bases and conversation history are strictly separated between merchant accounts. One merchant cannot access another merchant's data.

Third-Party AI Providers (OpenAI)

We use OpenAI's API to generate AI responses. According to OpenAI's data usage policy:

• Data sent via their API is NOT used to train their models by default.
• They may retain data for up to 30 days solely for abuse and misuse monitoring.
• We have not opted in to any data sharing programs with OpenAI.

For the latest information on OpenAI's data practices, please refer to their official data usage policy.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In general:

• Account Information: We keep your profile information for as long as your account is active. If you delete your account (or, for Shopify merchants, uninstall the FunctionalAI app), we initiate erasure of your personal data within 30 days.
• Conversation Data: Chat transcripts, knowledge-base files, and AI outputs are stored to provide you with continuity and for your later reference, and are deleted along with your account.
• Per-transaction Reconciliation Rows: Internal operational records (amount, date, plan, pseudonymous order/subscription ID from the merchant of record). Deleted along with your account. We do not store payment-card data, cardholder names, or billing addresses.
• Polish Tax Records (separate from your account): The monthly settlement / payout statements we receive from Lemon Squeezy or Shopify, and the invoices we issue to them, are retained as Polish tax records for the period required by Art. 86 § 2 of the Polish Tax Ordinance (typically 5 years from the end of the calendar year of the corresponding tax filing). These documents do not identify individual end users.

8. Data Security

We take the security of your personal information seriously. We have implemented various technical and organizational measures to protect your data, including:

• Encryption: We utilize encryption to protect data in transit and at rest. Our website and APIs are accessible only over HTTPS (TLS encryption).
• Access Controls: We limit access to personal data to authorized personnel who have a need to know that information.
• Security Testing: We regularly review our practices and keep our software updated with security patches.

9. Your Rights and Choices

You have certain rights regarding your personal information, especially if you are in the EEA or in other jurisdictions with similar data protection laws:

• Access and Portability: You have the right to request a copy of the personal data we hold about you.
• Rectification: If any of your personal information is inaccurate or incomplete, you have the right to ask us to correct or update it.
• Erasure: You can request that we delete your personal data under certain circumstances.
• Restriction of Processing: You have the right to ask us to limit the processing of your personal information in certain scenarios.
• Objection to Processing: You have the right to object to our processing of your personal data in some cases.
• Withdraw Consent: Where we rely on your consent for processing, you have the right to withdraw your consent at any time.

Authenticated users can also exercise the right of access / portability and the right to erasure directly from the application via in-product self-service endpoints (under Account → Privacy): POST /api/users/gdpr/data-export/ initiates an asynchronous machine-readable export, and POST /api/users/gdpr/delete-account/ initiates account erasure (subject to a confirmation step).

To exercise any of these rights by other means, please contact us at privacy@functional-ai.com or through the contact information provided below. We will respond to verifiable data-subject requests within 30 days of receipt, with one 60-day extension where permitted by law for particularly complex or voluminous requests (you will be informed within the first 30 days if an extension is needed).

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information. We do not sell your personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California privacy rights, please contact us at privacy@functional-ai.com. We will respond to verifiable requests within 45 days, with a one-time extension of up to 45 additional days where reasonably necessary, in accordance with Cal. Civ. Code § 1798.130(a)(2).

Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) browser-level signal as a valid opt-out request under the CPRA — and we apply it to every visitor, not only California residents. When your browser sends GPC, the analytics, session-replay and marketing technologies on our marketing website stay off in every region, regardless of any earlier choice you made in our cookie banner, for as long as the signal is on. Because we do not sell or share personal information for cross-context behavioral advertising, the GPC signal also confirms our existing position: your information is not sold or shared. If our practices change in the future, the GPC signal will continue to be processed automatically as your opt-out.

11. International Data Transfers

FunctionalAI is based in Poland (in the European Union) and the core of the Service is hosted in the EU: application servers, the primary database, Redis, and persistent storage are operated by Hetzner Online GmbH in Falkenstein, Germany; user-uploaded files and conversation-export archives live in AWS S3 in Frankfurt (eu-central-1); and transactional email is sent through Mailjet (France). We serve users around the world, so some sub-processors are located outside the EEA — most relevantly OpenAI (United States) for LLM inference, Lemon Squeezy (United States) for payments, and PostHog and Google Analytics (United States) for analytics on our marketing site (opt-in in the EEA, UK and Switzerland; on by default with an opt-out elsewhere — see section 11c).

Where personal data of EU/UK/EEA or Swiss data subjects is transferred outside the EEA/UK/Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as amended for the UK (ICO International Data Transfer Addendum) and Switzerland (FDPIC adaptations), together with supplementary technical and organizational measures. Where a sub-processor is certified under the EU–U.S. Data Privacy Framework, that certification may also be relied upon. Full details, including the current list of sub-processors, are in our Data Processing Agreement and on our Sub-Processors page.

11a. Data Processing Agreement (for Controllers)

If you are a business customer using the Service to process personal data of your own customers or end-users, we act as your Processor under GDPR Art. 28. Our Data Processing Agreement (DPA) is incorporated into our Terms and applies automatically; a signed counterpart is available on request at privacy@functional-ai.com.

11b. Personal Data Breach Notifications

Where we are data controller for your personal data (e.g., your account information as a FunctionalAI customer), in the event of a confirmed personal data breach we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Art. 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Art. 34 GDPR).

Where we act as data processor for a business customer (the "Controller") under the Data Processing Agreement, we will notify the Controller of any personal-data breach affecting their data within 48 hours of becoming aware, so that the Controller can meet its own 72-hour supervisory-authority obligation.

11c. Cookies and Tracking Technologies

We use strictly necessary cookies to operate this website. Beyond those, our marketing website (this site, not the application) can use three optional categories, each of which you can switch on or off individually via the “Cookie preferences” link in our footer; your choice is stored locally in your browser and applies until you change it:

• Analytics: Google Analytics (with IP anonymization and Google Consent Mode v2) and PostHog product analytics — page views, feature and pricing clicks, and aggregate usage patterns. This category also loads our own support chat widget, which stores an identifier only once you start a conversation (see section 4).
• Session replay: PostHog Session Replay, which records your visit — clicks, mouse movement, scrolling and form activity, with typed input masked by default. This is off in every region until you explicitly switch it on.
• Marketing: advertising and conversion-tracking pixels. Off in every region, not currently used, and never enabled without your explicit consent. We do not load any advertising or cross-context tracking pixel by default anywhere.

Whether analytics runs before you make a choice depends on where you are. We determine this in your browser from its time-zone setting; no location lookup is sent to any third party, and whenever the region cannot be determined we apply the stricter rule:

• European Economic Area, United Kingdom and Switzerland: opt-in. No non-essential cookie or analytics script is loaded until you grant consent through our cookie banner, which offers “Accept all” and “Reject all” on the same layer.
• Everywhere else: opt-out. The Analytics category (and only that category) is on by default. We show a non-blocking notice on your first visit; dismissing it is not treated as consent. You can turn analytics off at any time via that notice or the “Cookie preferences” link in our footer, and a saved refusal is honored on every later visit, in every region.

If your browser sends the Global Privacy Control signal, all three optional categories stay off in every region, regardless of any earlier choice (see section 10). A choice you have already saved in our banner is never overridden by the regional default: a stored refusal stays a refusal wherever you are.

Independently of these categories, we may count page views, referrers and campaign parameters from our web server's request logs in aggregate. These logs are written on our servers, store nothing on your device, are not combined with any other data about you, and are not used to identify or profile individual visitors.

12. Age Requirements and Children's Privacy

FunctionalAI is a business service intended for users who are at least 18 years of age or who have the legal capacity to enter into binding agreements on behalf of a business or organization. By using the Service, you represent that you meet these requirements.

We do not knowingly collect personal information from individuals under the age of 18. If we learn that we have inadvertently collected personal data from a minor without proper consent, we will delete that information as soon as possible. If you believe a minor has provided us with personal information, please contact us at privacy@functional-ai.com.

13. Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the "Last Updated" date at the top of this policy. If the changes are significant, we will provide a more prominent notice.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

We will do our best to address any issue or query promptly and transparently. If you are an EU/EEA individual and you believe we have not adequately resolved your privacy concern, you have the right to lodge a complaint with your relevant data protection authority.

Thank you for trusting FunctionalAI. Your privacy is important to us, and we are dedicated to safeguarding your personal information while providing you with a powerful and secure AI-driven service.