Skip to content

Privacy Policy

Effective October 28, 2026

Winter Advisory LLC operates KlavyFlow. This policy explains how we handle information when you visit our website, create an account, connect a client workspace, or contact us. For privacy questions and requests, email andrew.clark.winter@gmail.com.

Information we handle

  • Account and workspace information: your Google account identifier, verified email address, name and profile image; workspace names, memberships, roles, and invitations.
  • Connected Klaviyo information: account identity, campaigns, message creative and schedules, flow definitions and messages, list and segment information, profile consent and source observations, event information, and reporting metrics available under the permissions you grant. Preview content may contain information supplied by your business.
  • Connection credentials: OAuth access and refresh tokens, or a private API key if you choose that connection method. Credentials are encrypted before being stored in our application database.
  • Billing information: subscription identifiers, plan, status, billing periods, and payment-provider records needed to manage access. Polar handles checkout and payment details; KlavyFlow does not collect complete payment-card numbers.
  • Technical and support information: requests, errors, performance measurements, device/browser information, IP addresses available to our infrastructure providers, and information you choose to send for support.

Why we use information

We use information to authenticate users, enforce workspace access, connect Klaviyo, display and refresh your reviews, produce creative previews, administer subscriptions, deliver requested invitations or notifications, respond to support and privacy requests, and protect and maintain the service. We do not sell personal information, use connected Klaviyo information for advertising, or use it to train AI models.

Where applicable data-protection law requires a legal basis, we process account and service information to provide the service you request, pursue legitimate interests in operating and securing it, meet legal obligations, or act on consent when required. A Klaviyo authorization permits the selected connection; it does not replace any legal basis your business needs for its customer data.

Your business and its customer data

Your business controls the Klaviyo account it connects and the people it invites. We process connected business data to provide the service on that business's instructions. If your information belongs to one of our customer's audiences, contact that business about its marketing, consent, access, or deletion practices. We can assist the authorized workspace owner with requests relating to information held in KlavyFlow. KlavyFlow does not change marketing consent or send campaigns.

Service providers and sharing

We use Google for sign-in; Klaviyo for the authorized connection; Vercel for hosting, application execution and performance measurements; database and storage infrastructure, including Supabase for generated preview storage; Polar for subscriptions; and Resend for transactional email when configured. If a workspace administrator configures Slack notifications, summaries are sent to the Slack destination they choose. These providers receive information needed for their respective functions and operate under their own service and privacy terms.

Workspace members can access information permitted by their workspace role. We may disclose information when reasonably necessary to comply with law, protect rights or security, investigate misuse, or support a business transfer subject to appropriate protections. We do not publish your connected account data as marketing examples; public product examples use sample data.

Cookies and browser storage

KlavyFlow uses cookies for sign-in, session protection, and the OAuth connection process, and browser storage for preferences such as theme and selected workspace. Vercel Speed Insights measures application performance. We do not deploy advertising cookies. Blocking essential cookies can prevent sign-in or connection. Third-party sites you visit, including Google, Klaviyo, and Polar, control their own cookies.

Storage, security, and international processing

Our application runs on infrastructure configured in the United States; our providers may process information in other countries where they operate. Your information may therefore be processed outside your home jurisdiction. Contact us before connecting data if your business requires specific residency, transfer terms, or a separate data-processing agreement.

We use HTTPS, encrypted connection credentials, and workspace access controls. No service can guarantee absolute security. Do not include passwords, private keys, or payment details in support messages, workspace names, or shared creative. Report suspected security issues to the contact above.

Retention and disconnection

We retain account and workspace information while needed to provide the service and for legitimate legal, billing, dispute, and security purposes. Connected data is cached so reviews can load and continue through refresh failures. Disconnecting Klaviyo revokes the grant and removes connection credentials, but does not automatically erase historical workspace data, cancel a subscription, or delete your Klaviyo account.

To request deletion of your KlavyFlow account or workspace information, contact us from the account email and identify the workspace. We verify identity and authority, address other members' and legal rights, and explain any information that must be retained. Deleted information may remain temporarily in infrastructure backups until their normal retention cycle ends. Do not send us additional audience records to verify a request.

Your choices and rights

You can disconnect in Klaviyo connection settings, revoke access in Klaviyo, leave or manage workspace membership, and manage subscriptions in billing. Depending on applicable law, you may request access, correction, deletion, portability, restriction, or objection to processing, and withdraw consent where processing relies on it. Contact us to exercise these rights; we may need to verify the request. You may also complain to your local data-protection authority.

Children and policy changes

KlavyFlow is a business service for adults and is not directed to children under 18. Contact us if you believe a child has supplied personal information. We may update this policy as the service changes, revise the effective date, and provide additional notice when required by law.