Privacy Policy — Retail Savage Voice

Effective date: [INSERT DATE OF PUBLICATION] Last updated: 2026-04-30 (draft)

This Privacy Policy describes how Retail Savage LLC ("Retail Savage," "we," "us") collects, uses, stores, and shares information when you use Retail Savage Voice (the "Service"), available at https://voice.retailsavage.com.

We are committed to collecting only what we need to deliver the Service, using it only for the purposes you agreed to, and giving you control over your data. This policy explains what that looks like in practice.

Legal review note: This is a draft prepared 2026-04-30. Before publication, have a qualified attorney review for compliance with applicable laws in your jurisdiction (US state privacy laws including CCPA/CPRA where applicable, and any international regulations like GDPR if EU users may access the Service).

1. Who we are

Retail Savage LLC operates the Service. You can reach us at voice@retailsavage.com for any privacy-related question, including data access, correction, or deletion requests.

For privacy inquiries, we will respond within 30 days. If your request is more complex, we may take up to an additional 30 days, and we will notify you within the first 30 days if so.

2. What we collect

We collect three categories of information.

2.1 Information you authorize us to read from Klaviyo via OAuth

When you connect your Klaviyo account, you authorize us to read the following via Klaviyo's API:

• Account metadata — your organization name, public Klaviyo API key, website URL, sender name and email, time zone, and address
• Sent campaigns — campaign names, send times, recipient counts, channel (email or SMS), status
• Campaign message content — subject lines, preview text, and HTML body content for sent campaigns
• Lists — list names, profile counts, and opt-in process metadata
• Flows — flow names, statuses, and trigger types
• Metrics and segments — metric definitions and segment metadata, used to identify high-performing campaigns and audience structure for generation

We do not request, read, store, or process:

• Klaviyo subscriber profiles, names, email addresses, phone numbers, or any other subscriber-level personal data
• Any send permissions or write access to your Klaviyo account
• Any data from Klaviyo accounts you have not explicitly connected to the Service

We use the OAuth 2.0 Authorization Code flow with PKCE. Tokens are scoped read-only. You may revoke access at any time from your Klaviyo Apps dashboard.

2.2 Information you provide directly

When you use the Service, you may provide:

• An email address (provided by Klaviyo via OAuth, which we use to identify your account and send service-related communications)
• Edits to your generated voice profile (you may modify any of the six sections after synthesis)
• Generation inputs — campaign briefs, channel selections
• Marketing-consent preference — at signup, captured from the consent checkbox above the Connect button

2.3 Information collected automatically

When you use the Service, we automatically collect:

• Authentication state — encrypted access and refresh tokens for your Klaviyo account (AES-256-GCM at rest)
• Usage data — counts of synthesis runs, generation runs, channels generated; anonymized or aggregated for service operation and improvement
• Technical data — IP address (transient, used for security and rate limiting; not retained beyond 30 days), browser type and version, request timestamps
• Cookies — strictly necessary cookies for authentication. We do not use third-party advertising cookies or non-essential tracking cookies.

We do not use analytics tools that profile users or transmit personally identifiable information to third parties.

3. How we use the information

We use the information we collect for the following purposes:

• Synthesizing your brand voice profile — analyzing the Klaviyo content and your account metadata to produce the six-section voice profile
• Generating copy on your behalf — when you request a generation, your voice profile and your inputs are sent to our AI inference provider (currently Anthropic, see Section 5) along with our proprietary prompt structure to produce the requested output
• Operating the Service — authenticating your sessions, enforcing free-tier usage limits, ensuring service availability and security
• Communicating with you — sending account-related emails (e.g., voice profile ready, free-tier usage notifications), responding to support requests
• Marketing communications — if you opted in via the Connect-step checkbox, sending you Retail Savage product updates and IGC marketing tips. You can unsubscribe at any time via the link in any marketing email.
• Improving the Service — analyzing aggregated, anonymized usage patterns to refine the synthesis quality, the prompt engineering, and the user interface
• Legal compliance — meeting our obligations under applicable laws

We do not:

• Use your data to train AI models
• Sell, rent, or trade your data to third parties
• Use your campaign content or voice profile for any merchant other than you
• Show your generated content to other users
• Use your data for advertising

4. Legal basis for processing (where applicable)

For users in jurisdictions requiring a stated legal basis (e.g., GDPR), our processing is based on:

• Performance of a contract (Section 3 uses related to providing the Service you signed up for)
• Legitimate interest in operating, securing, and improving the Service (Section 3 service operation and improvement uses, balanced against your interests)
• Consent for marketing communications and any processing not covered above, withdrawable at any time

5. Third-party service providers

We share your information only with the following service providers, only for the purposes listed, and only under written agreements requiring them to protect your data with at least the same standard we apply.

• Klaviyo Inc. — your information is read from your Klaviyo account via OAuth, with your express authorization. Klaviyo's privacy policy governs Klaviyo's own use of your data; we don't change that. https://www.klaviyo.com/legal/privacy-policy
• Anthropic, PBC — generation requests are sent to Anthropic's Claude API for inference. Per Anthropic's API terms, prompts and outputs are not used to train Anthropic's models. https://www.anthropic.com/legal/privacy
• Vercel Inc. — application hosting. https://vercel.com/legal/privacy-policy
• Neon Inc. — managed Postgres database. https://neon.tech/privacy-policy
• Email service provider — operational email delivery (e.g., service notifications, support replies). Provider TBD before launch; this section will be updated to name the specific provider.

We do not use any third-party advertising networks, behavioral analytics platforms, or data brokers.

6. Retention and deletion

We retain your information only as long as necessary for the purposes for which it was collected.

• Voice profile, editorial inputs — retained while your Klaviyo account is connected to the Service. Within 30 days after you disconnect from Klaviyo (or earlier upon your request), we delete this information from our active systems.
• Generation outputs — retained for 90 days for your reference and for service quality monitoring, then deleted from our active systems.
• Authentication tokens — deleted immediately upon disconnection or token revocation.
• Usage and technical logs — retained for up to 12 months for security and service operation, then deleted or anonymized.
• Backups — backups containing your data are retained for up to 60 days for disaster recovery, then automatically purged.
• Legal hold — if we are required by law or legal process to retain information beyond these periods, we will retain it only as required and only for as long as required.

You can request deletion of your data at any time by emailing voice@retailsavage.com. We will confirm deletion within 30 days.

7. Security

We use commercially reasonable technical and organizational measures to protect your information, including:

• Encryption at rest — Klaviyo OAuth tokens are encrypted with AES-256-GCM in our database
• Encryption in transit — all communication between your browser and our servers uses TLS 1.2 or higher
• Access controls — internal access to production systems is limited to personnel who need it for service operation, logged, and reviewed
• Principle of least scope — we request only the Klaviyo scopes we need for the features we offer, and we do not retain access beyond what those features require
• Vulnerability management — we apply security updates to our dependencies promptly and follow industry-standard practices for the underlying platform (Vercel)

No system is perfectly secure. If we discover a security incident affecting your data, we will notify you within 72 hours of confirming the incident, in accordance with applicable breach-notification laws.

8. Your rights

Depending on where you live, you may have rights including:

• Access — request a copy of the information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your information (subject to limited exceptions for legal compliance)
• Restriction — request that we limit our processing of your information
• Portability — receive your information in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Consent withdrawal — where processing is based on consent, withdraw it at any time
• Complaint — file a complaint with your local data protection authority

To exercise any of these rights, email voice@retailsavage.com. We will not discriminate against you for exercising your rights.

For California residents (CCPA/CPRA): in the past 12 months, we have collected the categories of information described in Section 2 for the purposes described in Section 3. We do not sell or share personal information for cross-context behavioral advertising. You have the right to know, delete, correct, and opt out (where applicable).

9. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, contact voice@retailsavage.com and we will delete it.

10. International users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored in, and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (using the address associated with your Klaviyo account) and post the updated policy at https://voice.retailsavage.com/privacy with a revised effective date. Continued use of the Service after the effective date constitutes acceptance.

12. Contact

Questions about this Privacy Policy, your data, or our practices?

Email: voice@retailsavage.com Mail: [Retail Savage business address — INSERT BEFORE PUBLICATION]

We aim to respond within 5 business days for general inquiries and within 30 days for formal data rights requests.