Privacy Policy

Last updated September 15, 2026

[Your legal company name] operates Churn Nut, a client health and churn monitoring app for agencies using HighLevel. This policy explains what we process, why, and the choices you have. We do not sell your data or your clients' data.

Who we are and your role

For the agency data you connect, you are the controller and we act as your processor: we process it to provide the Service on your instructions. For your own account details (name, email, sign-in records, support messages) we are the controller.

Data we process

We request only the access needed for the product to work, and read it through your HighLevel connection using the permissions you approve at install:

  • agency information, including your agency profile and support location;
  • users and staff, so an account can show its assigned client manager;
  • contacts, to identify the agency-side contact that represents each client;
  • sub-account / location information, including creation dates used for client age;
  • tags and custom fields, to identify which clients are active, cancelled or prospects;
  • calendars and appointments, where they are relevant to a configured signal;
  • workflows, so you can select an existing workflow in an automation rule;
  • billing and subscription information available through HighLevel;
  • advertising and account-status information where the source supports it;
  • conversation and activity metadata (such as timing and direction of recent activity) where it is relevant to a churn signal you enabled.

We also store the results we calculate: churn scores, contributing signals, evidence, daily snapshots, client-to-sub-account mappings, your configuration, automation logs and support messages you send us.

Where a data source is unavailable or a permission is missing, the affected value is shown as unknown. We do not invent data — for example, HighLevel does not expose a reliable client login timestamp, so no login date is displayed.

Why we process it

  • to calculate and explain client health and churn risk;
  • to match your clients to the sub-accounts you manage for them;
  • to run the automation rules you explicitly create and activate;
  • to authenticate users and keep each agency's data separate;
  • to provide support, investigate bugs and keep the Service secure;
  • to improve reliability and product quality using aggregated, non-identifying usage.

We do not use your data or your clients' data to train third-party AI models. Where AI is used to suggest churn signals, only your onboarding answers about how your agency works are sent — not client records.

Sharing

We share data only with service providers that help us run the Service — hosting and database infrastructure, error monitoring, email delivery and the AI provider used for signal suggestions — under agreements limiting their use to our instructions. We may disclose data if legally required, or in connection with a merger or acquisition, with notice where required.

Security

Access to HighLevel is via OAuth. Tokens and other credentials are stored server-side, encrypted, and never exposed to the browser. Every request is scoped to the authenticated agency, and access controls prevent one agency from reading another's data. Access to production data is limited to personnel who need it.

Retention

We keep configuration, mappings and churn history while your account is active, because history is what makes risk trends possible. If you disconnect or close your account, we delete or anonymise your data within a reasonable period, except where we must keep records for legal or accounting reasons. You can request deletion at any time.

Your choices and rights

You can disconnect HighLevel, edit or delete your configuration, pause or delete automation rules, and request access to, correction of, export of, or deletion of your data. Depending on where you live you may have additional rights under laws such as the GDPR or CCPA; contact us to exercise them.

Cookies

We use only the cookies and local storage needed to keep you signed in and remember your theme preference. We do not use advertising cookies or cross-site tracking.

Children

The Service is for businesses and is not directed to anyone under 16.

Changes and contact

We will update this page when our practices change, and update the date above. Questions or requests: [support@yourdomain.com].