Privacy Policy

This website and associated platforms are operated by Joburn Pte. Ltd., a company registered in Singapore, trading as “Funnel Futurist.”

References to “we,” “us,” or “our” in this policy refer to Joburn Pte. Ltd.

This policy applies to all personal data collected through our websites, applications, quizzes, assessments, roadmap tools, booking forms, chat interfaces, and any other digital surfaces operated by Joburn Pte. Ltd., including but not limited to:

• ›joburn.com
• ›funnelfuturist.com
• ›quiz.funnelfuturist.com
• ›audits.funnelfuturist.com
• ›portal.funnelfuturist.com

When you interact with our platforms, we may collect the following categories of personal data:

We do not collect NRIC, FIN, passport numbers, or sensitive personal data (health, race, religion) unless directly relevant to a service you have requested.

We use your personal data only for the purposes consented to at the point of collection:

We will never use your data for a purpose you did not consent to without first obtaining your additional consent.

We share personal data only with trusted service providers who assist in delivering our services:

We do not sell personal data. We do not share personal data with third-party advertisers beyond the hashed conversion events described above.

When data is shared with a client of ours through our CRM platform (e.g., when you submit a form on a client’s behalf), that client becomes a joint controller of the data within their isolated account. Client accounts are segregated at the database level using row-level security.

Depending on the context, Joburn Pte. Ltd. operates in different data protection roles:

When acting as a data processor on behalf of clients, our processing activities are governed by Data Processing Agreements and our Master Services Agreement. We do not use client data for our own purposes beyond the services contracted.

We use Meta (Facebook/Instagram) APIs to provide advertising performance reporting, audience insights, and campaign management services to our clients. This includes access to:

• ›Ad performance metrics (impressions, clicks, conversions, spend)
• ›Campaign and ad set configuration data
• ›Audience insights (aggregated, non-personally-identifiable)
• ›Conversion event data via the Conversions API (CAPI)

Our use of Meta Platform data is subject to Meta Platform Terms and Meta Developer Policies. All personally identifiable information transmitted to Meta via CAPI is hashed using SHA-256 before transmission. We do not store raw Facebook user IDs or access tokens beyond what is necessary for authorized API operations.

To request deletion of data associated with your Facebook or Instagram interactions with our services, see Section 11: Data Deletion Requests.

We obtain consent through clear, affirmative actions appropriate to each data collection surface:

You may withdraw consent at any time by emailing john@joburn.com or clicking “Unsubscribe” in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal, nor does it affect services already delivered.

Your data is stored on servers in the United States (AWS US-East-1 via Supabase) and may be processed in the United States and European Union (Vercel edge network).

Under Section 26 of the PDPA, we ensure comparable protection through:

• ›Contractual safeguards — Data Processing Agreements with all cloud providers imposing PDPA-comparable obligations
• ›Encryption — All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• ›Access controls — Role-based, least-privilege access across all systems

We retain personal data only as long as necessary for the stated purpose:

“Last interaction” means any of: submitting a form, viewing a roadmap, clicking a link in our emails, booking a call, or contacting us.

Our platforms may use the following tracking technologies:

Under the Personal Data Protection Act (PDPA), you have the right to:

We will respond to access and correction requests within 30 calendar days. If we cannot comply (e.g., legal obligation to retain), we will explain why.

Withdrawing consent for marketing will not affect the delivery of services you have already requested.

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with additional rights:

• ›Right to erasure ("right to be forgotten") — Request complete deletion of your data
• ›Right to data portability — Receive your data in a machine-readable format
• ›Right to restrict processing — Request limitation of data processing in certain circumstances
• ›Right to object — Object to processing based on legitimate interests, including profiling
• ›Right to lodge a complaint — Contact your local EU supervisory authority

For GDPR-specific requests, contact john@joburn.com. We will respond within 30 days.

You may request the deletion of your personal data at any time by emailing john@joburn.com with the subject line “Data Deletion Request.”

We will confirm receipt within 5 business days, complete the deletion within 30 calendar days, and provide written confirmation once complete. Where data must be retained for legal obligations (e.g., tax records), we will explain which data is retained and why.

If you have interacted with our services through Facebook or Instagram, you may also submit a deletion request through your Facebook Settings under “Apps and Websites.”

We implement reasonable technical and organizational measures to protect your personal data:

• ›Encryption in transit (TLS 1.3) and at rest (AES-256)
• ›Row-level security on databases (client data isolation)
• ›Role-based access controls (least-privilege principle)
• ›Regular security reviews and vulnerability assessments
• ›Incident response plan with breach notification procedures

No system is 100% secure. If we discover a data breach that may affect you, we will notify you and the Personal Data Protection Commission (PDPC) within 3 calendar days of assessment, in accordance with the PDPA’s mandatory breach notification requirements.

We comply with Singapore’s Do Not Call (DNC) Registry provisions. We will check the DNC Registry before sending telemarketing messages via voice calls, SMS, or fax to Singapore telephone numbers. You may register your number on the DNC Registry at www.dnc.gov.sg.

Our platforms are not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through our platforms, contact us immediately and we will delete the data.

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email (if we have your contact information) or a prominent notice on our platforms.

The effective date at the top of this page indicates when this policy was last revised.

For any questions about this privacy policy or your personal data:

You may also contact the Personal Data Protection Commission (PDPC) if you believe we have not adequately addressed your concern: