Privacy Policy

1. Who We Are

Klarvyn is a marketing attribution and analytics platform operated by:

Northpunch Media Group Limited
Registered in Cyprus
Kosta Ourani 5, Petoussis Court, 5th floor, 3085 Limassol, Cyprus
Email: privacy@klarvyn.com
Website: https://klarvyn.com

For questions about this Privacy Policy or our data practices, contact us at privacy@klarvyn.com.

2. Our Role: Data Controller vs. Data Processor

Klarvyn processes data in two different capacities depending on the context.

2.1 Klarvyn as Data Processor

For Personal Data processed through our Services on behalf of our customers (businesses using Klarvyn to track their marketing attribution), Klarvyn acts as a data processor. Our customers are the data controllers and determine:

• What data is collected from their website visitors
• The lawful basis for collecting that data (typically consent or legitimate interest)
• How long they wish to retain the data
• How they respond to their end users' data subject requests

If you are an end user (a visitor to a website that uses Klarvyn), your primary point of contact for your personal data is the website operator, not Klarvyn. We process your data only on their instructions. However, you may also contact us directly at privacy@klarvyn.com for assistance.

2.2 Klarvyn as Data Controller

For Personal Data we collect directly for our own purposes, Klarvyn acts as a data controller. This includes:

• Information about visitors to klarvyn.com
• Information about our direct customers and their account users
• Information collected through our marketing activities
• Information about job applicants and business partners

This Privacy Policy governs both roles, with specific sections addressing each.

3. Information We Collect

3.1 Information You Provide Directly

When you use klarvyn.com or sign up for our Services:

• Name, email address, phone number
• Company name and business information
• Billing address and payment information (processed by Stripe, or by Shopify for merchants who install Klarvyn from the Shopify App Store)
• Communications with us (support requests, sales inquiries)
• Content you submit through forms, chat, or emails

When you accept our terms:

• Acceptance timestamp and version of terms accepted
• Marketing communication preferences
• IP address at the time of acceptance (for legal record)

3.2 Information Collected Automatically on klarvyn.com

When you visit our website, we automatically collect:

• IP address and geographic location (country, city)
• Browser type, operating system, device information
• Pages visited, time spent, click patterns
• Referrer URL and search terms that led you to us
• Cookie and session identifiers

3.3 Information Collected Through Our Services (as Data Processor)

When our customers use the Services to track their own website visitors, Klarvyn processes the following categories of data on their behalf:

Identifiers:

• IP addresses
• Cookie IDs (including Klarvyn's kv_vid visitor cookie)
• Session IDs
• Device identifiers

Contact information (when provided by the data subject to our customer):

• Email addresses (hashed with SHA-256 before being sent to advertising platforms)
• First and last names
• Phone numbers (hashed with SHA-256 before being sent to advertising platforms)
• Physical addresses

Behavioral data:

• Page views, click paths, form submissions
• Ad interactions
• Session data

Technical data:

• User agent strings
• Referrer URLs
• Geographic location (country, region, city — derived from IP)

Advertising identifiers:

• Facebook Click ID (fbclid)
• Google Click ID (gclid)
• TikTok Click ID (ttclid)
• Reddit Click ID (rdt_cid)
• LinkedIn Click ID
• Microsoft Advertising / Bing Click ID (msclkid)
• Snapchat Click ID (ScCid)
• X (Twitter) Click ID (twclid)
• AdRoll Click ID (adct)
• Adform Click ID (adf)
• Other platform-specific identifiers

Transaction data (when applicable):

• Purchase amounts, order IDs, product information
• Currency and transaction timestamps

Attribution data:

• UTM parameters
• Campaign identifiers
• Touchpoint sequences

3.4 Information from Third Parties

We may receive information about you from third parties, including:

• Advertising platforms our customer connects (such as Meta, Google, TikTok, LinkedIn, Reddit, Microsoft, Snapchat, Pinterest, X, AdRoll, OpenAI (ChatGPT Ads) and Whop (Whop Ads))
• Analytics providers
• Integration partners (CRM, e-commerce, payment processors) — only when our customers connect these integrations
• Publicly available sources
• Shopify, when a merchant installs the Klarvyn app for Shopify (see the section 'Klarvyn for Shopify')

4. How We Use Information

4.1 As a Data Processor (Services)

When processing data on behalf of our customers, we use the information solely to:

• Provide marketing attribution, analytics, and reporting services to our customers
• Send server-side conversion events to advertising platforms authorized by our customer (Conversions API integrations)
• Enable integrations with third-party services our customer has connected
• Provide customer support and troubleshoot technical issues
• Ensure security, prevent fraud, and comply with legal obligations

We do not use data processed on behalf of our customers for our own marketing purposes or combine it with data from other customers.

4.2 As a Data Controller (klarvyn.com and Direct Customers)

For data we control directly, we use it to:

• Operate, maintain, and improve klarvyn.com and our Services
• Communicate with you about your account, our Services, and marketing (with your consent)
• Process payments and manage billing
• Respond to customer support inquiries
• Comply with legal obligations
• Enforce our Terms and Conditions
• Prevent fraud and ensure platform security
• Analyze usage patterns to improve our products (aggregated and anonymized)

5. Legal Basis for Processing (GDPR)

For data subjects in the European Economic Area, United Kingdom, and Switzerland, we rely on the following legal bases under GDPR Article 6:

• Contract performance (Article 6(1)(b)) — to provide the Services you have subscribed to
• Legitimate interests (Article 6(1)(f)) — to operate and improve our business, prevent fraud, and secure our platform
• Consent (Article 6(1)(a)) — for marketing communications, cookies (where required), and certain data processing activities
• Legal obligation (Article 6(1)(c)) — to comply with applicable laws, including tax and accounting requirements

For processing performed on behalf of our customers, the lawful basis is determined by our customer as the data controller.

6. Data Retention

6.1 Our Approach

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to legal, accounting, and contractual requirements.

6.2 Retention Periods

Direct customer data (Klarvyn as controller):

• Account data: Retained for the duration of your active subscription plus 60 days after account closure to allow for reactivation or dispute resolution
• Billing records: Retained for up to 7 years as required by applicable tax and financial regulations
• Support communications: Retained for up to 24 months after resolution
• Marketing communications: Retained until you opt out or for up to 24 months of inactivity
• Server logs: Retained for up to 90 days for security and debugging purposes
• klarvyn.com visitor data: Retained in accordance with our internal data minimization practices

End user data (Klarvyn as processor):

For data we process on behalf of our customers, retention is determined by our customer as the data controller. Our customers are responsible for:

• Setting appropriate retention periods for their business
• Communicating retention practices to their end users
• Requesting deletion of specific data when required by law or business need

We retain the data associated with our customer's workspace for the duration of their active subscription. After a customer terminates their subscription, we retain the data for a 60-day recovery period, after which it is scheduled for deletion. For data received from Shopify stores, the deletion timelines in the section 'Klarvyn for Shopify' apply.

6.3 Deletion Requests

Individual data subjects, our direct customers, and end users of our customers' websites may request deletion of their personal data at any time by emailing privacy@klarvyn.com. See Section 9 for the complete process.

6.4 Backups

Encrypted backups containing residual data may retain deleted personal data for up to 90 days after deletion from production systems, after which backups are automatically expired.

7. How We Share Information

We do not sell your personal data. We share information only in the following circumstances:

7.1 With Sub-Processors and Service Providers

We share information with trusted service providers who help us operate our business, subject to confidentiality obligations. Current sub-processors include:

Infrastructure:

• Tiger Data (Timescale, Inc.) — Database hosting (Frankfurt, Germany, EU)
• Northflank Limited — Application hosting (Netherlands, EU)
• Cloudflare, Inc. — CDN, security, and file storage for cached ad images (global network; stored data kept in the EU)

Advertising Platforms (only when connected by our customer):

• Meta Platforms, Inc. — Conversions API
• Google LLC — Enhanced Conversions
• TikTok Inc. — Events API
• LinkedIn Corporation — Conversions API
• Reddit, Inc. — Conversion API
• Microsoft Corporation — Conversions API (Microsoft Advertising / Bing)
• Pinterest, Inc. — Conversions API
• Snap Inc. — Conversions API
• X Corp. — Conversions API
• NextRoll, Inc. (AdRoll) — Cost data sync
• OpenAI, L.L.C. — Conversions API (ChatGPT Ads)
• Whop, Inc. — Whop Ads spend import and Whop Events API

Business Operations:

• Stripe, Inc. — Payment processing for customers who sign up on klarvyn.com
• Mailgun Technologies, Inc. — Account and notification emails (EU region)
• Anthropic PBC — AI-powered features (aggregated queries only)

A current sub-processor list is available upon request at privacy@klarvyn.com.

7.2 With AI Assistants You Connect (MCP)

Customers can connect an AI assistant of their choice — for example Claude (Anthropic), ChatGPT (OpenAI) or Grok (xAI) — to their Klarvyn workspace through Klarvyn's MCP connector. When they do, Klarvyn sends the assistant the data it requests on the customer's behalf, only on the customer's instruction.

By default, this data contains no personal information: it consists of campaign, ad, attribution and funnel reports, and event lists without names, email addresses, phone numbers or other contact details. A workspace administrator can choose to include contact details in what the assistant receives by turning on a setting in Klarvyn; this is off unless they turn it on, and they can turn it off at any time.

The AI provider processes the data under its own terms with the customer. Customers can disconnect an assistant at any time by revoking its access in Settings › API keys. A workspace on hold cannot be connected to an assistant.

7.3 With Our Customers (When Klarvyn as Processor)

When we process data on behalf of our customers, we share the processed insights, attribution data, and reports back to the customer through their Klarvyn dashboard.

7.4 Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or to protect our rights, property, or safety.

7.5 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users and comply with applicable law.

7.6 With Your Consent

We may share information with third parties when you have given us explicit consent to do so.

8. International Data Transfers

8.1 Primary Data Location

Personal data processed through our Services is primarily stored and processed within the European Union:

• Database: Frankfurt, Germany (Tiger Data, AWS eu-central-1)
• Application processing: Netherlands, EU (Northflank)

8.2 Transfers Outside the EEA

Some of our sub-processors are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-U.S. Data Privacy Framework certification where applicable
• Adequacy decisions by the European Commission
• Transfer Impact Assessments to verify adequate protection

Transfers to advertising platforms (such as Meta, Google, TikTok, LinkedIn, Reddit, Microsoft, Snapchat, Pinterest, X, AdRoll, OpenAI (ChatGPT Ads) and Whop (Whop Ads)) occur only when our customer has explicitly connected the corresponding integration.

9. Your Rights

9.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate or incomplete data
• Right to erasure — Request deletion of your personal data ("right to be forgotten")
• Right to restriction — Limit how we process your data
• Right to data portability — Receive your data in a machine-readable format
• Right to object — Object to certain types of processing, including for direct marketing
• Right to withdraw consent — Withdraw consent at any time (where processing is based on consent)
• Right to lodge a complaint — File a complaint with your local data protection authority

9.2 Rights Under CCPA/CPRA (California)

If you are a California resident, you have additional rights including:

• Right to know — Request information about the personal data we collect, use, and share
• Right to delete — Request deletion of your personal data
• Right to correct — Request correction of inaccurate personal data
• Right to opt out — Opt out of the "sale" or "sharing" of personal data (we do not sell personal data)
• Right to non-discrimination — Not receive discriminatory treatment for exercising your rights

9.3 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@klarvyn.com. We will:

• Acknowledge your request within 2 business days
• Verify your identity as required
• Complete your request within 30 days (with possible extension of up to 60 additional days for complex requests)
• Provide written confirmation upon completion

If you are an end user of one of our customers' websites, we recommend contacting the website operator first, as they are the primary data controller. However, you may contact us directly at any time.

For deletion requests specifically, please include:

• Your full name and email address
• Any account, cookie ID, or visitor ID you can reference
• The website(s) where you interacted with our customer
• Any additional information that will help us identify the data to delete

We will delete the requested personal data from our active production systems within 30 days. Encrypted backups containing residual data may retain the data for up to 90 days before automatic expiration.

10. Cookies and Similar Technologies

10.1 Cookies on klarvyn.com

When you visit klarvyn.com, we use cookies for:

• Essential functionality (session management, security)
• Analytics (understanding site usage, with consent where required)
• Marketing (with consent, tracking effectiveness of our advertising)

You can manage cookie preferences through our cookie consent banner or your browser settings.

10.2 Cookies Deployed Through Our Services

When our customers install Klarvyn's tracking script on their websites, the following cookies may be set:

• kv_vid (visitor ID) — Persistent cookie identifying a unique visitor across sessions. Duration: up to 24 months.
• kv_sid (session ID) — Session cookie for grouping activities within a single browsing session. Duration: session only.

These cookies are set on our customers' websites, and our customers are responsible for obtaining appropriate consent from their visitors before setting non-essential cookies. Our customers must comply with the ePrivacy Directive and similar regulations regarding cookie consent.

10.3 Third-Party Cookies

We may read third-party cookies set by advertising platforms (such as Meta, Google, TikTok, LinkedIn, Reddit, Microsoft, Snapchat, Pinterest, X, AdRoll, OpenAI (ChatGPT Ads) and Whop (Whop Ads)) to enable attribution matching. These cookies are set by those platforms, not by Klarvyn.

11. Klarvyn Browser Extension

Klarvyn offers an optional Chrome browser extension that displays your Klarvyn attribution metrics as an overlay inside supported advertising platforms (e.g., Meta, Google, Microsoft, TikTok, Pinterest, Snapchat, X, Reddit, LinkedIn, AdRoll). The extension is available only to our authenticated customers and their account users.

11.1 What the Extension Accesses

• Account email and authentication token — used solely to authenticate you to your Klarvyn account and retrieve your own attribution data.
• Advertising-manager page content — the extension reads campaign, ad set, and ad identifiers and spend figures visible on the ad-manager pages you open, in order to match them to your Klarvyn attribution metrics and position the overlay.

11.2 How the Data Is Used

This information is used exclusively to render your attribution metrics within the ad manager. The extension does not collect browsing history, does not track activity outside supported ad-manager pages, and does not read pages unrelated to its function.

11.3 What We Do Not Do

We do not sell or transfer extension data to third parties, do not use it for advertising, and do not use it to determine creditworthiness or for lending purposes. Data handled by the extension is processed under the same security and retention practices described in this Policy.

12. Klarvyn for Shopify

This section applies to merchants who use the Klarvyn app for Shopify. For this data, Klarvyn acts as the merchant's data processor.

12.1 Data We Receive from Shopify

When a merchant installs the Klarvyn app, we receive the following through Shopify's APIs, webhooks and app extensions:

• Store information: store name and domain, currency and time zone, and the access token the app needs to work
• Order data: order ID, totals, currency, products, timestamps, landing page, and the Klarvyn visitor and session IDs attached to the order
• Product data: product names, variants and prices, and inventory item costs, used to calculate profit and return on ad spend
• Checkout data from Shopify's checkout webhooks: the checkout steps reached, and the email address or phone number, city and country the buyer entered, used to attribute started and completed checkouts
• Customer data on orders: name, email address and phone number
• Checkout and purchase events from Klarvyn's web pixel
• Storefront activity from the Klarvyn Tracking app embed: page views, ad click IDs, UTM parameters and session data, as described in Section 3.3
• Plan and subscription status from Shopify billing. We do not receive card or payment details.

12.2 How We Use It

We use this data only to provide the app to the merchant: attributing orders to channels and campaigns, showing customer journeys and reports, and, when the merchant turns it on, sending conversion events to the advertising platforms they connect. Email addresses and phone numbers are hashed before they are sent to advertising platforms. We do not use Shopify data for our own marketing, we do not sell it, and we do not use it for automated decisions with legal or similarly significant effects.

12.3 Consent

Klarvyn's web pixel follows the buyer's consent choices in Shopify. Merchants remain responsible for collecting the consent their store requires, as described in Section 10.2.

12.4 Uninstalling and Data Requests

• When a merchant uninstalls the app, it stops working immediately: we delete the store's access token, and Shopify removes Klarvyn's web pixel from the store.
• 48 hours later, Shopify sends us a request to delete the store's data. We then delete the store's remaining credentials and app settings automatically. Order, contact and event data received from the store stays in the merchant's Klarvyn workspace as part of their account and is deleted as described in Section 6.2, or within 30 days when the merchant asks us at privacy@klarvyn.com.
• When a merchant asks Shopify to delete one of their customers' data, Shopify forwards the request to us and we automatically delete that customer's contact records and linked activity from the store's Klarvyn workspace.
• Merchants and their customers can ask for a copy of their data, or for its deletion, by emailing privacy@klarvyn.com. We respond within 30 days.
• Our Data Processing Agreement is available at https://klarvyn.com/dpa.

12.5 Billing

Merchants who install Klarvyn from the Shopify App Store pay through Shopify. Shopify processes these payments under its own privacy policy. We receive only the plan and subscription status.

13. Data Security

We implement industry-standard technical and organizational security measures to protect personal data, including:

• Encryption in transit: TLS 1.2 or higher for all data transmission
• Encryption at rest: AES-256 encryption for stored data
• Hashed identifiers: Email addresses and phone numbers are hashed with SHA-256 before being sent to advertising platforms
• Access controls: Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA)
• Infrastructure security: Firewalls, DDoS protection, intrusion detection
• Monitoring: Continuous security monitoring, vulnerability scanning, and incident response
• Employee training: Regular security awareness training for personnel with data access

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users and authorities in the event of a data breach.

14. Children's Privacy

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete the data promptly. If you believe we may have collected data from a child under 16, please contact us at privacy@klarvyn.com.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be:

• Communicated via email to registered users (where applicable)
• Posted with a prominent notice on klarvyn.com
• Reflected in the "Last Updated" date at the top of this Policy

Continued use of the Services after material changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Northpunch Media Group Limited
Registered in Cyprus
Kosta Ourani 5, Petoussis Court, 5th floor, 3085 Limassol, Cyprus

Privacy contact: privacy@klarvyn.com
Support: support@klarvyn.com
Website: https://klarvyn.com
Data Processing Agreement: https://klarvyn.com/dpa

For data subject requests (access, deletion, correction), please email privacy@klarvyn.com with sufficient information to verify your identity and identify the data you wish to access, correct, or delete.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For EU/EEA residents, a list of national data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en