Privacy policy
How Avalore Ltd handles personal data when you use Cinch, and what you can ask us to do with it.
Last updated 27 August 2026
Cinch is operated by Avalore Ltd (“we”, “us”). We are the data controller for the information described below, and you can reach us at hello@cinchfunnel.com.
Two kinds of data, two different roles
This distinction matters, so it comes first. Cinch handles two separate sets of information and our responsibilities differ for each.
- Your data as a customer. Your account details, the funnels you build, and how you use the product. We are the controller for this, and this policy explains how we handle it.
- Answers from people who complete your funnels. The responses, scores and contact details your visitors submit. You are the controller for that information and we act as your processor — we store and deliver it on your instructions and do not use it for our own purposes. You are responsible for telling those people what you collect and why, and for having a lawful basis to do so.
What we collect from you
- Account information — your email address, and a password or the identifier from whichever sign-in provider you use.
- Content you create — funnels, questions, result copy, themes and integration settings.
- Billing information — if you subscribe to Pro, our payment provider processes your card details. We never see or store full card numbers; we keep a customer reference, your plan and your invoices.
- Technical and usage data — IP address, browser and device type, pages viewed, and error logs, used to keep the service running and secure.
- Anything you send us — emails, support messages and beta feedback.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Providing the product, hosting your funnels and delivering responses | Performance of our contract with you |
| Taking payment and issuing invoices | Performance of our contract; legal obligation for tax records |
| Keeping the service secure, preventing abuse and fixing faults | Our legitimate interests in running a reliable service |
| Cookieless website analytics, to see which pages are useful | Our legitimate interests in improving the site |
| Service emails — outages, changes to these terms, billing notices | Performance of our contract; our legitimate interests |
| Product updates and marketing email | Your consent, which you can withdraw at any time |
Who we share it with
We do not sell personal data, and we do not share your leads with anyone. We use a small number of suppliers to run the service, each under a contract that limits them to processing data on our instructions. They are named here rather than described, because “a hosting provider” is not something anyone can check:
| Supplier | What they do | What they see |
|---|---|---|
| Supabase | Database, sign-in and file storage | Your account, your funnels, and the responses they collect |
| Cloudflare | Serving the site and published funnels | Requests in transit, and the country a visitor is in |
| Resend | Sending sign-in links and lead notifications | Email addresses and the contents of those messages |
| Stripe | Pro subscriptions | Your billing details. We never see your card number |
| OpenAI | Turning a prompt into a draft funnel | Only the sentence you type when generating — see below |
| GoatCounter | Cookieless analytics on our own marketing pages | Page, referrer and rough country. No cookies, no identifiers |
We may also disclose information where the law requires it, or to establish or defend legal claims. Where you connect your own integrations — a webhook, Zapier or Make, a checkout link — data goes wherever you have told Cinch to send it, and that destination's own terms and privacy policy then apply.
Generating a funnel with AI
When you describe a funnel and ask us to draft it, the sentence you type is sent to OpenAI so a model can write the questions. That is the only thing sent: not your funnels, not your responses, and never the details anyone gives you through a published funnel. OpenAI states that content submitted through their API is not used to train their models.
We keep a record of each generation — how many tokens it used, what it cost, and the draft it produced — so we can enforce the monthly allowance and know what the feature costs to run. If you would rather we did not generate anything for you, simply do not use it: everything else works without it.
Tracking a funnel’s owner has added
On the Pro plan, whoever built a funnel can switch on their own advertising pixels — Meta, TikTok, Google Analytics, LinkedIn or X. Where one is switched on, that company receives a page view when the funnel opens and a conversion event when somebody finishes, under its own privacy policy.
Cinch never adds these to a funnel itself, and cannot see what the ad platform does with them. The funnel’s owner chooses whether to use them and is responsible for getting consent where the law requires it. If you are answering a quiz and would rather know, the owner’s own privacy notice is the place to ask — they are the controller of that funnel.
We only ever store the pixel identifier the owner gives us, and we generate the tracking code ourselves. Funnel owners cannot paste arbitrary scripts into a page we serve.
International transfers
Some suppliers may process data outside the UK or EEA. Where that happens we rely on approved safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. If you need data kept in a specific region, contact us before you build on Cinch.
How long we keep it
- Account and funnel data — for as long as your account is open, then deleted within 90 days of closure.
- Funnel responses — until you delete them or close your account. You control this.
- Billing records — six years, as UK tax law requires.
- Server and security logs — typically 30 to 90 days.
Cookies and analytics
We use cookies that are strictly necessary to keep you signed in and to keep the service secure. Published funnels use only what they need to remember a visitor's progress through the questions.
For website analytics we use GoatCounter, which is privacy-friendly by design: it sets no cookies, does not track people across sites, and does not collect personal data. It records the page visited, the referring site, and rough browser, screen size and country information. If we ever add analytics or advertising that does track individuals, we will ask for your consent first and you will be able to change your mind.
Your rights
Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can also withdraw consent to marketing at any time. Email hello@cinchfunnel.com and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. If you are a visitor who completed someone's funnel, please contact the business that ran it — they control that information, not us — though we will help them act on your request.
Security
Data is encrypted in transit, access to production systems is limited to those who need it, and passwords are stored hashed. No service can promise perfect security, but if a breach affects your data we will tell you and the ICO as the law requires.
Children
Cinch is not intended for children under 16, and we do not knowingly collect their data. If you build a funnel aimed at under-16s, that is your responsibility to handle lawfully.
Changes
If this policy changes materially we will email account holders and update the date at the top of this page.
Contact
Avalore Ltd
Registered in England and Wales, company number 17046103
3rd Floor, 86-90 Paul Street, London, EC2A 4NE
hello@cinchfunnel.com