Functionize

GDPR overview

The privacy policy dated 10 July 2026 acknowledges that, depending on your location, you may hold specific rights under frameworks such as the GDPR or CCPA: access to a copy of your data, rectification, deletion under conditions, objection to and restriction of processing, including automated decision-making and direct marketing. Rights are exercised through a formal request to the privacy team, and a Data Protection Officer is reachable at privacy@functionize.com. Beyond that the documentation stops short: Functionize never claims GDPR compliance in so many words, designates no EU representative under Article 27, offers no data processing agreement, publishes no list of its own sub-processors and names no transfer mechanism apart from Stripe. The declared offices are San Francisco and New Delhi, with no EU establishment, and the service is B2B, closed to anyone under 16.

Who owns the data?

The privacy policy in force since 10 July 2026, replacing the 12 May 2026 version, separates the Customer Content and proprietary application data you bring in from the platform metadata Functionize, Inc. collects: name, work email, job title, company, IP address, browser and cookie data, test execution logs and configurations. Raw Customer Content stays under your control, since the publisher undertakes not to use it to train models for the benefit of other customers without your explicit written consent. It states that it does not sell personal information to third parties for marketing purposes and limits sharing to hosting, analytics and CRM providers bound by confidentiality, plus Stripe for payments. Data may follow the business in a merger, acquisition or asset sale.

Reuse rights

Functionize declares it uses the data it collects to operate, maintain and improve the platform, deliver personalized support and send product and security notifications. It also trains its machine learning models on de-identified and aggregated metadata derived from platform usage, in order to improve test accuracy and self-healing for all users, and the homepage confirms that every run trains Studio on your application. Raw Customer Content and proprietary application data are excluded from training for the benefit of other customers unless you give explicit written consent, and a declared Sandbox Doctrine keeps test environments isolated and strictly segregated from production. No opt-out from the metadata-based training is documented on the published pages. On the customer side, reports and exports are available and consume no credits, but the public pages set out no reuse rights over the data itself: those terms sit in a PDF Terms of Service that is worth reading before assuming anything.

Data retention & training

Hosting summary

Functionize names no hosting country and no hosting region on its public pages. The Enterprise page offers configured residency, keeping data in the region you operate in, configured to your requirements, but that region is the customer's own, not a published hosting location. Two routes exist: the Functionize cloud, or an installation inside the customer's environment, which is the only option that makes the jurisdiction certain. Each test run executes in an isolated virtual machine that is destroyed when the run ends. Encryption is AES-256 at rest and TLS 1.2 or higher in transit, production access is restricted on a least-privilege basis, and the company holds SOC 2 Type II with the report available on request. The one named cross-border flow concerns payments: Stripe systems may sit in or outside India, with transfers to Stripe LLC in the United States. The publisher's declared offices are San Francisco and New Delhi. Buyers with data-residency obligations should obtain written confirmation of the hosting jurisdiction before signing, because nothing on the site provides it.