Privacy Policy

Who we are

Unclosed Labs LLC, a Wyoming, USA limited liability company, is responsible for the personal information described in this policy (its “controller,” in GDPR terms). When Campn processes content from your Klaviyo account on your instructions — your templates and campaign content — it does so on your behalf, as your service provider. You can reach us at support@campn.org.

What we collect

• Account information. Your email address, and your password stored only as a one-way (bcrypt) hash. If you use Continue with Google, Google gives us your email address, whether Google has verified it, your Google account ID, and your name and profile picture; we store only the email address and Google account ID. We also record whether you’ve verified your email, when you signed up, and when any free trial ends.
• Klaviyo connection. Your Klaviyo account ID, the permissions you granted, and the access and refresh tokens Klaviyo issues to Campn, stored encrypted.
• Template structure. For each template you open, a list of its editable fields — their position, type and name — so uploads know where each value goes. It doesn’t contain the template’s text or images.
• Campaign content you provide. The text, images, alt text, campaign names, subject lines, preview text and audience choices you enter or upload. We use them to build your campaigns in Klaviyo. Uploaded CSV and image files are held in server memory only while they’re processed and are not saved by us; images you use are uploaded to your own Klaviyo image library.
• Build records. For each campaign you build: its name, the IDs of what was created in Klaviyo, whether it succeeded, any error message, the web addresses of any template images that had to be replaced by a placeholder, and fingerprints (one-way hashes) of the upload used to prevent duplicate campaigns.
• Email previews. The rendered HTML of each email Campn builds, kept briefly to show you a thumbnail of the result.
• Usage. A record of each campaign built, used to count the Free plan’s allowance.
• Billing information. Your Stripe customer and subscription IDs, plan, subscription status and renewal or cancellation dates. Payment card details are collected by Stripe directly; we never see or store them.
• Account emails. A send record for each verification or password-reset email: your address, the link it contained, and whether it was delivered.
• Security audit log. A tamper-evident record of security-relevant events — sign-ups, logins (including failed attempts), email verification, Klaviyo connections and disconnections, template exports, campaign builds, billing changes and account deletion — with the time, your account and Klaviyo IDs, and the IP address the request came from.
• Application logs. Technical records of how the service is running (errors, request paths, response codes and timings), which may include IP addresses and account or Klaviyo IDs.
• Website analytics and advertising data. Collected by the third-party tools described under “Cookies and similar technologies” below.

We never request access to, read or store your Klaviyo profiles, their events or metrics, or who is in your lists and segments — only list and segment names, for the audience picker. The data reference lists every Klaviyo request Campn makes.

Cookies and similar technologies

Campn sets a few cookies of its own, all needed for the app to work or to report a completed sign-up. Our landing page and the first page you see after signing up also load third-party tools that set their own cookies.

You can block or delete cookies in your browser settings. Blocking Campn’s essential cookies will stop you logging in. You can also limit ad measurement through your Meta and Google ad settings, or with a browser that blocks third-party trackers.

How we use information

• To provide Campn: your account, your Klaviyo connection, and the campaigns you ask it to build.
• To take payments and manage your plan and its limits.
• To send account emails, such as email verification and password resets, and to answer your support requests.
• To keep the service and your account secure, prevent abuse, and keep an audit trail.
• To understand visits to our marketing pages and measure our advertising.
• To meet our legal obligations.

If you’re in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you (providing the service and billing); our legitimate interests (security, abuse prevention, the audit log, and improving and promoting Campn); your consent, where the law requires it for non-essential cookies; and complying with legal obligations.

Service providers we share information with

We share personal information only with the providers below, each only as needed for the purpose shown.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or to a successor if our business is sold or merged, in which case this policy continues to apply.

We don’t sell your personal information

We don’t sell personal information and never have. The Meta Pixel and Google tags on our marketing pages may count as “sharing” for cross-context behavioral advertising under California law. To opt out, email support@campn.org, or block these tools as described under Cookies above.

Where your data is stored

Campn’s servers and database run in the United States, on Fly.io in Ashburn, Virginia. If you use Campn from outside the United States, your information is transferred to and processed in the United States, whose data protection laws may differ from yours. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses offered by our providers.

How long we keep it

Security

• Klaviyo tokens encrypted at rest with AES-256-GCM.
• All traffic encrypted in transit with TLS, and browsers told to always use HTTPS (HSTS).
• Passwords stored only as bcrypt hashes.
• Signed, HTTP-only session cookies, and protection against cross-site request forgery.
• Rate limits on sign-in and other sensitive actions.
• A tamper-evident audit log, checkpointed daily outside our own servers.
• Least-privilege Klaviyo access: only the seven permissions Campn needs, none of them covering profiles or sending.

No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires it.

Your rights and choices

Wherever you live, you can disconnect Klaviyo from Settings → Integrations and delete your account from Settings → Profile at any time, and you can ask us for a copy of your information or to correct it.

EEA and UK residents have the right to access, correct, delete and receive a portable copy of their personal information; to restrict or object to its processing; to withdraw consent at any time; and to complain to their local data protection supervisory authority.

California residents have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to opt out of its sale or sharing. We don’t use sensitive personal information (such as your login credentials) for anything beyond providing the service. We won’t treat you differently for exercising these rights, and you may use an authorized agent.

To exercise any of these rights, email support@campn.org from the address on your account. We may need to verify your identity first, and we’ll respond within the time the law requires (generally within one month).

Deleting your account

Go to Settings → Profile and choose Delete account, then confirm with your password (or by typing your email address). This cancels any paid subscription immediately, disconnects Klaviyo — revoking Campn’s access and deleting its template structure, build records and previews — and then deletes your account along with your usage records. Campaigns and images already in your Klaviyo account stay there. The security audit log is kept as described above.

Children

Campn is a business tool and isn’t directed to children under 16. We don’t knowingly collect their personal information; if you believe we have, contact us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the “Last updated” date above. If a change is material, we’ll also tell you by email or in the app before it takes effect.

Contact

Questions or requests about this policy or your information: Unclosed Labs LLC, support@campn.org.