Read-only by design. Disconnect, and we delete what we read from Klaviyo.

How we keep your account safe, and what we read from it. In plain words.

Get early access hello@synapseretention.com

Klaviyo access: Read-only
Sign-in: An emailed link, and a second step for owners and admins
Our keys to Klaviyo: Stored encrypted
Disconnect: Deletes what we read from Klaviyo. A weekly backup can keep a copy for up to 4 weeks.

We can read your account. We can’t change it.

Our Klaviyo app asks for eight permissions, and every one only reads. What each one reads.

None of our eight permissions reaches your customers’ profiles.
We can’t change anything in your account.
We can’t send email from it.
We see how many people are on a list, never who.

Encrypted connections, and keys kept sealed.

The portal, and every call we make to Klaviyo, travel encrypted. So are the keys Klaviyo gives us.

Both use TLS 1.2 or newer, the standard that encrypts web traffic.
The keys Klaviyo gives us to read your account are stored encrypted.
Only one program of ours can open those keys. A copy of our database opens nothing.
Our app’s own password with Klaviyo is kept in a locked vault, never in our code or files.

You sign in with a link we email you. There’s no password to steal or forget.

Each link works once, within 15 minutes.
Owners and admins must add a second step: a passkey, or an authenticator app like Google Authenticator.
Members and viewers can add one too.
Ten backup codes, each good for one use, cover a lost phone.
Lost those too? Write to us from your address. We check it’s you before we reset it.

Each person can do what their role allows.

Each workspace sees its own brands, and no one else’s.

Owner: Everything an admin can do. Only an owner can make an owner, or change or remove one.
Admin: Invites people and changes their roles. Adds or removes a brand, and connects its Klaviyo.
Member: Sees everything, and asks for welcome tests and proof addresses.
Viewer: Sees everything. Changes nothing.

Where your data is kept

What we read from your Klaviyo account is stored and processed in the United States.

It’s kept on servers we rent from DigitalOcean.
The emails that reach our addresses arrive through Amazon Web Services, in the United States.
Our privacy notice lists everyone who handles personal data for us. Read it.

Disconnect, and what we read from Klaviyo is gone.

Press Disconnect, or remove our app in Klaviyo. Either way, we delete everything we read from the account. A weekly backup can keep a copy for up to 4 weeks.

Disconnect ends our access straight away, and removes our app from your Klaviyo account.
We keep when it was connected and read, by whom, and when and why it ended.
Our security log keeps a note of each time we read the account, for at least a year.
The full list of what goes, and what stays.

A record of every sign-in and every read.

Our security log has its own database. Our programs can add to it, but never change it. It holds no email addresses, no IP addresses and no email contents.

It records every sign-in, every step of a connection and every call to Klaviyo.
Each entry is linked to the one before, so changing or deleting one breaks the chain.
We keep it for at least a year.
A locked copy is kept apart at Amazon, where no one can change or delete it for a year.
Every five minutes, we check it for warning signs, like repeated failed sign-ins. Any we find are emailed to our founder.
Every day, we check the code libraries we build on for known security holes.

Found a problem?

Email hello@synapseretention.com with what you found. A person reads it.

Questions before you connect?