Help
Everything Campn reads from your Klaviyo account, everything it creates or changes there, what it never touches, and what it keeps on its own servers. There’s no background sync: Campn calls Klaviyo only to carry out what you do in the app.
Campn asks for seven Klaviyo permissions when you connect. Each one covers only the requests listed next to it.
| Permission | Why | Requests |
|---|---|---|
accounts:read | Identifies which Klaviyo account you connected. | GET /api/accounts |
templates:read | Lists your templates and reads their layout and content. | GET /api/templatesGET /api/templates/{id} |
templates:write | Creates a temporary working copy of your template for each campaign, then deletes it. Your original is never edited. | POST /api/template-clonePATCH /api/templates/{id}DELETE /api/templates/{id} |
images:write | Uploads your images to your Klaviyo image library, and re-uploads any template image a copy loses (or a grey placeholder). | POST /api/image-uploadPOST /api/images |
campaigns:write | Creates draft campaigns. It never sends or schedules them. | POST /api/campaignsPOST /api/campaign-message-assign-templateDELETE /api/campaigns/{id} |
lists:read | Shows your lists in the audience picker. | GET /api/lists |
segments:read | Shows your segments in the audience picker. | GET /api/segments |
| Request | Fields used | When |
|---|---|---|
GET /api/accounts | Your Klaviyo account ID. | Once, when you connect. |
GET /api/templates | Each template’s ID, name, editor type and last-updated time. | When you open Create Campaigns. |
GET /api/templates/{id} | The template’s name, HTML and last-updated time, and its drag-and-drop layout: sections, text, images, alt text and desktop/mobile display settings. | When you preview, download or build from that template. |
GET /api/listsGET /api/segments | Each list’s and segment’s ID and name. | When you open a template’s Build page, for the audience picker. |
When you download a template’s CSV and images, each image is fetched from its public web address. That isn’t a Klaviyo API request and uses no permission.
| Request | What it does | What stays in Klaviyo |
|---|---|---|
POST /api/template-clone | Makes a working copy of your template for one campaign. | Deleted as soon as the campaign has its content. |
PATCH /api/templates/{id} | Writes that campaign’s text, images and alt text into the working copy. | Only ever the working copy. Your original template is never edited. |
DELETE /api/templates/{id} | Deletes a working copy Campn created. | Nothing. |
POST /api/image-upload | Uploads each image you supply. | Stays in your Klaviyo image library. |
POST /api/images | Re-registers a template image, by its web address, when the working copy lost it, or adds a grey placeholder if that fails. | Stays in your Klaviyo image library. |
POST /api/campaigns | Creates a draft email campaign with its name, its audience (the lists and segments you picked) and, if you filled them in, its subject line and preview text. | An unscheduled draft campaign. |
POST /api/campaign-message-assign-template | Gives the campaign’s email its finished content. Klaviyo keeps its own copy of it. | Part of the draft campaign. |
DELETE /api/campaigns/{id} | Only removes a campaign Campn has just created, when the rest of that campaign’s build then failed. | Nothing. |
Connecting also uses Klaviyo’s authorization service to receive and renew Campn’s access tokens, and disconnecting revokes them there.
| Data | What it contains | Kept for |
|---|---|---|
| Your Campn account | Email address, password hash (or Google account ID), email verification status, sign-up date, trial end date. | Until you delete your account. |
| Klaviyo connection | Klaviyo account ID, granted permissions, and access and refresh tokens encrypted with AES-256-GCM. | Until you disconnect, uninstall in Klaviyo, or delete your account. |
| Template field maps | For each template you open: the position, type and name of each editable field. Not the template’s text or images. | Until you disconnect or delete your account. Refreshed when the template’s layout changes. |
| Build records | For each campaign built: its name, the Klaviyo IDs created, success or failure, any error message, the web addresses of template images replaced by a placeholder, and one-way fingerprints of the upload that prevent duplicate campaigns. Not your CSV’s cell values or your image files. | Full detail for 30 days, then only the status and fingerprints. All deleted when you disconnect or delete your account. |
| Email previews | The rendered HTML of each campaign email built, for the thumbnail on its result. | 48 hours. |
| Uploaded CSV and images | Held in server memory only while they’re processed. Images go to your Klaviyo image library. | Not stored by Campn. |
| Usage records | One entry per campaign built, to count your plan’s allowance. Its submission reference, row number and status only — no campaign content. | Until you delete your account. Kept when you disconnect, so disconnecting doesn’t reset your allowance. |
| Billing | Stripe customer and subscription IDs, plan, status, renewal and cancellation dates. Card details stay with Stripe. | Until you delete your account. |
| Security audit log | Sign-ups, logins, Klaviyo connections and disconnections, exports, builds, billing changes and account deletion, with time, IDs and IP address. | At least 365 days. Not deleted on disconnect or account deletion. |
| Application logs | Technical server logs, which may include IP addresses and IDs. | 14 days. |
Database backups are kept for a limited rolling period, so deleted data can remain in them until they expire.
The app and its database run in the United States, on Fly.io in Ashburn, Virginia. The Privacy Policy lists every service provider involved, explains your rights, and describes how to delete your data. To see how these requests fit together in practice, read Build campaigns from a CSV.
Need help?
Email support@campn.org with any question. Include the email address you log in with so we can find your account.