Privacy notice

Who we are

Synapse Retention checks online stores’ marketing emails, for the stores and for the agencies that run their email. It’s run by its founder, Mohamed Hamed, and co-founder, Mohamed Belal, from Budapest and London. For the personal data described here, the controller is Mohamed Hamed and Mohamed Belal, who run Synapse Retention.

hello@synapseretention.com

When you email us

We keep your name, your email address and what you write. If you ask for a teardown of your own brand, we also keep its web address. We check that your email address is at that web address. That’s how we know the request comes from the brand. We use this to reply and to do what you asked.

Our customers

Contact details for the people we work with at the agencies and brands that are our customers, the lists of brands agencies send us, our agreements and invoices, and our correspondence.

Your portal account

The portal at portal.synapseretention.com keeps each portal user’s email address, their role in each workspace, and sign-in records.

If a new workspace isn’t set up, we email its owners up to three short reminders. One click stops them.

There’s no password. You sign in with a link we email you, which works once, within 15 minutes. We keep each link only in a scrambled form, which can’t be turned back into the link. When you ask for a link, we keep your IP address for 24 hours. That limits how many links anyone can ask for.

Everyone in a workspace also needs a second sign-in step: an authenticator app, or a passkey.

• An authenticator app’s secret is stored encrypted, with a key kept apart from our database.
• For a passkey, we keep only its public half. The private half never leaves your device.
• Your ten backup codes are kept only in a scrambled form, and each works once.

The portal sets six cookies, all strictly necessary. One keeps you signed in, for up to 14 days. One protects its forms. Four more last an hour at most, while you finish one step. That step is signing in, a second sign-in step, a new workspace, or a client’s Klaviyo link.

The Klaviyo connection

A brand can connect its Klaviyo account, so we can check inside it. We can only read it. We can’t change anything in it, or send email from it.

What we read, as our Klaviyo guide lists it:

• Your account’s name, its public ID and its website, so you can check it’s the right one.
• Your automated emails, what starts each one, and their spam reports, bounces and unsubscribes.
• The designs of those emails: their words, offers and codes. And the words in their pictures, read on our own servers.
• Your campaigns, what each one offers, and their spam reports, bounces and unsubscribes.
• Your lists, by name and size. Never who is on them.
• Your groups of customers, by name and size. Never who is in them.
• Your signup forms, and which list each one feeds.
• The names of your results, like orders, and how many came in each hour. To tell what starts each automated email and to notice when your store’s orders stop reaching Klaviyo. Never who.

We never read your customers’ names, email addresses or other details. None of our eight permissions reaches them.

When a brand connects its Klaviyo account, we hold the keys Klaviyo gives us to read it, stored encrypted. Only one program of ours can open those keys.

We keep what we read while the account stays connected. It’s disconnected when you press Disconnect, when you remove the brand, or when you remove our app in Klaviyo. Then we delete everything we read from it, and our keys to it. We also take that part out of your monthly reports.

We keep only when it was connected and read, by whom, and when and why it ended. Our security log keeps its note of each read, with the account’s public ID, for at least a year.

Email checks and reports

Our email checks read what a brand sends to our addresses on its list, and to its test address. We keep each email whole, as it arrived, with what our checks found in it. They’re the brand’s marketing emails, so they can include the names of its staff, such as a founder’s sign-off. We read the words in their pictures, on our own servers. We never load the hidden picture that tells a brand an email was opened. We never click their links, except the one unsubscribe test a brand asks for.

Alerts, monthly reports and our weekly email go to the workspace’s owners and admins. Each monthly report is kept in the workspace, as a page and a PDF. Ask for a report as a Google Doc, and we make one. Anyone with its link can read it.

We keep these emails, what we found and the reports until the brand asks us to delete them. Removing a brand stops its checks, but keeps its past emails and reports. Emails not from the brand, or to an address it no longer uses, are deleted after 7 days.

The free email grader

• Anyone can get a free grade of one email at portal.synapseretention.com/grade.
• We use the email address you give us to send you a link.
• To count grades, we keep a scrambled copy of that address and its web address for one day.
• To stop misuse, we keep a scrambled copy of the internet address you asked from, for one day.
• We delete the test email you send as soon as it’s graded.
• We keep your grade, and what we found, for 30 days. Then we delete it.
• Before we keep a grade, we hide any subscriber’s name, email address or phone number we find in it.
• Anyone you share the grade’s link with can see the grade.
• If you make a share link, anyone with it sees the grade, never your email address. You can stop sharing it at any time.
• If you tick “Send me tips and early access”, we send you three emails over ten days. One click in any of them stops them. We keep your address only until the last one, or until you stop them. Otherwise we add you to no list, and send you no other email.

Agencies and their clients

An agency can connect a client’s Klaviyo account itself, or send the client a link to connect it. What we read from a client’s account, and what our checks find, is shown only in that agency’s workspace. It’s never in the Market, our weekly view of what brands send, or shown to any other workspace. It’s never on our Black Friday page either. When a client opens a link, we record that it was opened, not who opened it.

In every workspace, our own team can see what you see, to run the service and to help you.

Our security log

Our security log records every sign-in, every step of a Klaviyo connection and every call to Klaviyo. Each entry says when it happened and what happened. It names the person and the workspace by number, and a Klaviyo account by its public ID. It holds no email addresses, no IP addresses and no email contents. We keep it for at least a year. A locked copy is kept apart at Amazon, where no one can change or delete it for a year.

No sales email

We send no sales or marketing email to brands or their staff, unless they ask for it. Our email grader asks with an unticked box. We keep no other lists of their contact details: the ones we held were deleted on 7 October 2026.

Our research into brands’ emails

Between September and early October 2026 we subscribed to brands’ lists with addresses of our own. We stay subscribed to see how a brand’s mail changes over time, and unsubscribe within 48 hours when a brand asks us to leave its list. We never load the hidden picture that tells a brand an email was opened. We don’t click links in the emails we receive. The one exception: confirming our subscription, where a brand’s list asked for that. The emails can include the names of the brand’s staff, such as a founder’s sign-off, and we keep them as part of the research. Apart from our Black Friday page, we don’t name brands in public examples.

Since 7 October 2026, we only join a list with the brand’s permission. Lists we joined before then, we stay on until the brand asks us to leave. With a brand’s permission, our addresses join its list for our email checks. We make a teardown only when a brand asks for its own. It uses only the emails we already hold, and public data.

What we share with our customers, the agencies and brands we work with, is what we found and short quotations, such as a subject line or a sentence: never a whole email.

We publish one summary of these emails: our Black Friday page, at synapseretention.com/black-friday. It names each brand that has started by its web address, with its category. It shows the day each brand started, and the offer its first email made. It never shows a subject line, a code, a name or a whole email. It never names a brand that is our customer, or an agency’s client. The data it’s made from is public too, as a file on our portal. A brand can ask to be left off it, and we take it off within 48 hours.

This website

This site runs no analytics and loads nothing from third parties. Cloudflare, which delivers this site, sets one security cookie, cf_clearance, to tell people apart from automated traffic. It isn’t used for advertising or analytics, and we set no cookies of our own. Cloudflare also processes standard request data such as IP addresses in order to deliver the pages and keep the site secure.

Why we use it, and our legal basis

We rely on legitimate interest (Article 6(1)(f) of the UK GDPR and the EU GDPR) to reply to people who write to us, to carry out our research into how brands email their subscribers, and to manage our client relationships. Our interest is running and growing a business-to-business service, and you can object at any time. It also covers publishing our Black Friday page. We also rely on it to keep the portal and our customers’ accounts secure. That’s what our security log is for.

Where you’re a client, we also process your details because we need to in order to carry out our agreement with you, and we keep financial records because the law requires it.

Who else handles it

We use a small number of service providers to run the business:

• Cloudflare, which hosts this website.
• Amazon Web Services, in the US. It receives the emails sent to our addresses, and sends ours, such as sign-in links and alerts. It also encrypts our keys to Klaviyo accounts, and keeps the locked copy of our security log.
• DigitalOcean, whose servers in the US run the portal and hold our data.
• Google, which hosts our own email, such as hello@synapseretention.com. We also use its Docs for teardowns, and for reports when someone asks for a Doc.
• Anthropic, whose software we use to run our systems. The personal data described here, including the emails we receive, may be processed with it.
• GitHub, which stores our code and our working notes. They can include customers’ contact details, and emails we received.

Some of these providers are based in, or store data in, the United States. Where personal data leaves the UK or the EU, we rely on the safeguards those providers offer for international transfers, such as standard contractual clauses. We don’t sell personal data.

How long we keep it

• People who email us: for two years after our last exchange.
• Our customers: for as long as we work together and two years after; agreements and invoices for as long as tax and accounting law requires.
• Our research emails: for as long as we use them in teardowns and benchmarks; staff names removed on request.
• Portal accounts: your email address, until you ask us to delete it.
• Sign-in links and sessions: 30 days after they end. IP addresses from link requests: 24 hours.
• Our security log, with its sign-in records: at least a year.
• What we read from a Klaviyo account: until it’s disconnected.
• Email checks: each email, what we found, and the monthly reports, until the brand asks us to delete them.

Apart from our security log, our servers’ logs are kept for 30 days at most.

One of our servers is backed up once a week, and each backup is kept for 4 weeks. So something we delete can stay in a backup for up to 4 weeks.

Your rights, and how to have your data removed

You can ask us for a copy of your data, or ask us to correct it, delete it, restrict what we do with it or stop using it. You can object to our use of legitimate interest at any time, and you don’t need to give a reason.

To have your details removed, email hello@synapseretention.com with the subject “Remove me” and the email address you want removed. We act on removal requests within 48 hours and answer other requests within one month.

You can complain to the data protection authority where you live or work, or where we’re based: Hungary’s NAIH or the UK’s ICO.

Changes to this notice

When the way we handle personal data changes, we’ll update this notice and the date at the top of it.