Privacy Policy

Who this covers

There are two kinds of people whose data we handle:

• You, our user. For your account details, Klyve ([company name, address]) is the data controller.
• Your contacts, the people on the lists you upload. For their data, you are the controller and we are your processor: we only use it to provide the service to you, following your instructions.

What we store

Your account

• Your name, email address and a securely hashed password (we never store the password itself).
• Whether your email address is verified, and which workspaces you belong to.
• For each login session: the IP address and browser type, so you can stay logged in and we can spot misuse.

Your workspace

• Lists, segments, custom fields, templates, campaigns, automations, sign-up forms and brand kit settings.
• Images and files you upload to use in your emails.
• API keys you create (stored so we can check them, not so we can show them again).

Contacts you upload (as your processor)

• Email addresses, names and any custom fields you add.
• List membership, subscription status and consent records (for example, double opt-in confirmations).
• Email activity: deliveries, opens, clicks, bounces, complaints and unsubscribes.

Your sending provider credentials

API keys and SMTP passwords for your provider are encrypted (AES-256-GCM) before they are saved, are only decrypted to send your email, and are never shown again in the app.

Logs

• Records of the emails sent from your workspace, so you can see what was delivered and why something failed.
• For the transactional email API, the full email content is kept for 30 days, then cleared. The log entry (who, when, status) is deleted after 90 days.
• Basic security and error logs from our servers.

How we use it

• To run the service: log you in, store your work and send your emails through your provider.
• To keep it safe: prevent spam and abuse, and protect accounts.
• To contact you about your account, for example to verify your email or reset your password.

We don't sell your data or your contacts' data, and we don't use it for advertising.

Cookies

We only use cookies that are needed for the service to work: one to keep you logged in, and one to remember which workspace you have open. We don't use advertising or analytics cookies. The API docs page also remembers your preferred code language in your browser's storage; it never leaves your device.

Who else receives data (sub-processors)

• Your chosen sending provider (for example Amazon SES, Resend, SendGrid, Mailgun, Postmark or your SMTP server). When you send, they receive the recipient's address and the email content. Their own privacy policy and terms apply, under your account with them.
• [Hosting provider] and [database provider], which run our servers and store data in [region].

We may also disclose data if the law requires it.

How long we keep it

• Account and workspace data: for as long as your account exists.
• Transactional email content: 30 days. Transactional log entries: 90 days.
• Suppressed addresses (unsubscribes, bounces and complaints) are kept while your workspace exists, so those people are never emailed again by mistake.
• When an account is deleted, its data is removed within [30] days, and from backups within [90] days.

Your rights (GDPR and similar laws)

You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and you can complain to your local data protection authority.

• Users: you can change most details yourself in the app. For anything else, email privacy@your-domain. We'll reply within 30 days.
• Contacts of a Klyve user: please contact the sender who emailed you first; they control your data and can export or erase it from their workspace. Every marketing email also has an unsubscribe link. If you can't reach them, email us and we'll help.

Security

Each workspace's data is kept separate, and every request checks that you belong to the workspace. Passwords are hashed, provider credentials are encrypted, and connections use HTTPS. No system is perfect, so if we learn of a breach affecting your data we'll tell you without undue delay.

Children

Klyve isn't meant for children under 16, and we don't knowingly collect their data.

Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll also email account owners before they take effect.

Contact

Questions about privacy? Email privacy@your-domain. See also our Terms of Service.