Privacy Policy

Effective Date: 2026-07-17 | Last Updated: 2026-07-17 | Version 2.1

Northpunch Media Group Limited, operating as Klarvyn ("Klarvyn", "we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you interact with our website (klarvyn.com), our marketing attribution platform (the "Services"), or when we process data on behalf of our customers.

By using our Services, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Services.

1. Who We Are

Klarvyn is a marketing attribution and analytics platform operated by:

Northpunch Media Group Limited
Limassol, Cyprus
Email: privacy@klarvyn.com
Website: https://klarvyn.com

For questions about this Privacy Policy or our data practices, contact us at privacy@klarvyn.com.

2. Our Role: Data Controller vs. Data Processor

Klarvyn processes data in two different capacities depending on the context.

2.1 Klarvyn as Data Processor

For Personal Data processed through our Services on behalf of our customers (businesses using Klarvyn to track their marketing attribution), Klarvyn acts as a data processor. Our customers are the data controllers and determine:

  • What data is collected from their website visitors
  • The lawful basis for collecting that data (typically consent or legitimate interest)
  • How long they wish to retain the data
  • How they respond to their end users' data subject requests

If you are an end user (a visitor to a website that uses Klarvyn), your primary point of contact for your personal data is the website operator, not Klarvyn. We process your data only on their instructions. However, you may also contact us directly at privacy@klarvyn.com for assistance.

2.2 Klarvyn as Data Controller

For Personal Data we collect directly for our own purposes, Klarvyn acts as a data controller. This includes:

  • Information about visitors to klarvyn.com
  • Information about our direct customers and their account users
  • Information collected through our marketing activities
  • Information about job applicants and business partners

This Privacy Policy governs both roles, with specific sections addressing each.

3. Information We Collect

3.1 Information You Provide Directly

When you use klarvyn.com or sign up for our Services:

  • Name, email address, phone number
  • Company name and business information
  • Billing address and payment information (processed through Stripe)
  • Communications with us (support requests, sales inquiries)
  • Content you submit through forms, chat, or emails

When you accept our terms:

  • Acceptance timestamp and version of terms accepted
  • Marketing communication preferences
  • IP address at the time of acceptance (for legal record)

3.2 Information Collected Automatically on klarvyn.com

When you visit our website, we automatically collect:

  • IP address and geographic location (country, city)
  • Browser type, operating system, device information
  • Pages visited, time spent, click patterns
  • Referrer URL and search terms that led you to us
  • Cookie and session identifiers

3.3 Information Collected Through Our Services (as Data Processor)

When our customers use the Services to track their own website visitors, Klarvyn processes the following categories of data on their behalf:

Identifiers:

  • IP addresses
  • Cookie IDs (including Klarvyn's kv_vid visitor cookie)
  • Session IDs
  • Device identifiers

Contact information (when provided by the data subject to our customer):

  • Email addresses (stored hashed with SHA-256 for cross-platform matching)
  • First and last names
  • Phone numbers (stored hashed)
  • Physical addresses

Behavioral data:

  • Page views, click paths, form submissions
  • Ad interactions
  • Session data

Technical data:

  • User agent strings
  • Referrer URLs
  • Geographic location (country, region, city — derived from IP)

Advertising identifiers:

  • Facebook Click ID (fbclid)
  • Google Click ID (gclid)
  • TikTok Click ID (ttclid)
  • Reddit Click ID (rdt_cid)
  • LinkedIn Click ID
  • Microsoft Advertising / Bing Click ID (msclkid)
  • Snapchat Click ID (ScCid)
  • X (Twitter) Click ID (twclid)
  • AdRoll Click ID (adct)
  • Adform Click ID (adf)
  • Other platform-specific identifiers

Transaction data (when applicable):

  • Purchase amounts, order IDs, product information
  • Currency and transaction timestamps

Attribution data:

  • UTM parameters
  • Campaign identifiers
  • Touchpoint sequences

3.4 Information from Third Parties

We may receive information about you from third parties, including:

  • Advertising platforms (Meta, Google, TikTok, LinkedIn, Reddit)
  • Analytics providers
  • Integration partners (CRM, e-commerce, payment processors) — only when our customers connect these integrations
  • Publicly available sources

4. How We Use Information

4.1 As a Data Processor (Services)

When processing data on behalf of our customers, we use the information solely to:

  • Provide marketing attribution, analytics, and reporting services to our customers
  • Send server-side conversion events to advertising platforms authorized by our customer (Conversions API integrations)
  • Enable integrations with third-party services our customer has connected
  • Provide customer support and troubleshoot technical issues
  • Ensure security, prevent fraud, and comply with legal obligations

We do not use data processed on behalf of our customers for our own marketing purposes or combine it with data from other customers.

4.2 As a Data Controller (klarvyn.com and Direct Customers)

For data we control directly, we use it to:

  • Operate, maintain, and improve klarvyn.com and our Services
  • Communicate with you about your account, our Services, and marketing (with your consent)
  • Process payments and manage billing
  • Respond to customer support inquiries
  • Comply with legal obligations
  • Enforce our Terms and Conditions
  • Prevent fraud and ensure platform security
  • Analyze usage patterns to improve our products (aggregated and anonymized)

5. Legal Basis for Processing (GDPR)

For data subjects in the European Economic Area, United Kingdom, and Switzerland, we rely on the following legal bases under GDPR Article 6:

  • Contract performance (Article 6(1)(b)) — to provide the Services you have subscribed to
  • Legitimate interests (Article 6(1)(f)) — to operate and improve our business, prevent fraud, and secure our platform
  • Consent (Article 6(1)(a)) — for marketing communications, cookies (where required), and certain data processing activities
  • Legal obligation (Article 6(1)(c)) — to comply with applicable laws, including tax and accounting requirements

For processing performed on behalf of our customers, the lawful basis is determined by our customer as the data controller.

6. Data Retention

6.1 Our Approach

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to legal, accounting, and contractual requirements.

6.2 Retention Periods

Direct customer data (Klarvyn as controller):

  • Account data: Retained for the duration of your active subscription plus 60 days after account closure to allow for reactivation or dispute resolution
  • Billing records: Retained for up to 7 years as required by applicable tax and financial regulations
  • Support communications: Retained for up to 24 months after resolution
  • Marketing communications: Retained until you opt out or for up to 24 months of inactivity
  • Server logs: Retained for up to 90 days for security and debugging purposes
  • klarvyn.com visitor data: Retained in accordance with our internal data minimization practices

End user data (Klarvyn as processor):

For data we process on behalf of our customers, retention is determined by our customer as the data controller. Our customers are responsible for:

  • Setting appropriate retention periods for their business
  • Communicating retention practices to their end users
  • Requesting deletion of specific data when required by law or business need

We retain the data associated with our customer's workspace for the duration of their active subscription. After a customer terminates their subscription, we retain the data for a 60-day recovery period, after which it is scheduled for deletion.

6.3 Deletion Requests

Individual data subjects, our direct customers, and end users of our customers' websites may request deletion of their personal data at any time by emailing privacy@klarvyn.com. See Section 9 for the complete process.

6.4 Backups

Encrypted backups containing residual data may retain deleted personal data for up to 90 days after deletion from production systems, after which backups are automatically expired.

7. How We Share Information

We do not sell your personal data. We share information only in the following circumstances:

7.1 With Sub-Processors and Service Providers

We share information with trusted service providers who help us operate our business, subject to confidentiality obligations. Current sub-processors include:

Infrastructure:

  • Tiger Data (Timescale, Inc.) — Database hosting (Ireland, EU)
  • Northflank Limited — Application hosting (EU)
  • Cloudflare, Inc. — CDN and security (global, EU edge for EU traffic)

Advertising Platforms (only when connected by our customer):

  • Meta Platforms, Inc. — Conversions API
  • Google LLC — Enhanced Conversions
  • TikTok Inc. — Events API
  • LinkedIn Corporation — Conversions API
  • Reddit, Inc. — Conversion API
  • Adform A/S — Conversion API
  • Microsoft Corporation — Conversions API (Microsoft Advertising / Bing)
  • Pinterest, Inc. — Conversions API
  • Snap Inc. — Conversions API
  • X Corp. — Conversions API
  • NextRoll, Inc. (AdRoll) — Conversion API

Business Operations:

  • Stripe, Inc. — Payment processing
  • Sentry — Application error monitoring (with PII scrubbing)
  • Anthropic PBC — AI-powered features (aggregated queries only)

A current sub-processor list is available upon request at privacy@klarvyn.com.

7.2 With Our Customers (When Klarvyn as Processor)

When we process data on behalf of our customers, we share the processed insights, attribution data, and reports back to the customer through their Klarvyn dashboard.

7.3 Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or to protect our rights, property, or safety.

7.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users and comply with applicable law.

7.5 With Your Consent

We may share information with third parties when you have given us explicit consent to do so.

8. International Data Transfers

8.1 Primary Data Location

Personal data processed through our Services is primarily stored and processed within the European Union:

  • Database: Ireland (Tiger Data EU-WEST-1)
  • Application processing: EU regions (Northflank)

8.2 Transfers Outside the EEA

Some of our sub-processors are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we ensure adequate protection through:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • EU-U.S. Data Privacy Framework certification where applicable
  • Adequacy decisions by the European Commission
  • Transfer Impact Assessments to verify adequate protection

Transfers to advertising platforms (Meta, Google, TikTok, LinkedIn, Reddit) occur only when our customer has explicitly connected the corresponding integration.

9. Your Rights

9.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:

  • Right of access — Request a copy of your personal data
  • Right to rectification — Correct inaccurate or incomplete data
  • Right to erasure — Request deletion of your personal data ("right to be forgotten")
  • Right to restriction — Limit how we process your data
  • Right to data portability — Receive your data in a machine-readable format
  • Right to object — Object to certain types of processing, including for direct marketing
  • Right to withdraw consent — Withdraw consent at any time (where processing is based on consent)
  • Right to lodge a complaint — File a complaint with your local data protection authority

9.2 Rights Under CCPA/CPRA (California)

If you are a California resident, you have additional rights including:

  • Right to know — Request information about the personal data we collect, use, and share
  • Right to delete — Request deletion of your personal data
  • Right to correct — Request correction of inaccurate personal data
  • Right to opt out — Opt out of the "sale" or "sharing" of personal data (we do not sell personal data)
  • Right to non-discrimination — Not receive discriminatory treatment for exercising your rights

9.3 How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@klarvyn.com. We will:

  • Acknowledge your request within 2 business days
  • Verify your identity as required
  • Complete your request within 30 days (with possible extension of up to 60 additional days for complex requests)
  • Provide written confirmation upon completion

If you are an end user of one of our customers' websites, we recommend contacting the website operator first, as they are the primary data controller. However, you may contact us directly at any time.

For deletion requests specifically, please include:

  • Your full name and email address
  • Any account, cookie ID, or visitor ID you can reference
  • The website(s) where you interacted with our customer
  • Any additional information that will help us identify the data to delete

We will delete the requested personal data from our active production systems within 30 days. Encrypted backups containing residual data may retain the data for up to 90 days before automatic expiration.

10. Cookies and Similar Technologies

10.1 Cookies on klarvyn.com

When you visit klarvyn.com, we use cookies for:

  • Essential functionality (session management, security)
  • Analytics (understanding site usage, with consent where required)
  • Marketing (with consent, tracking effectiveness of our advertising)

You can manage cookie preferences through our cookie consent banner or your browser settings.

10.2 Cookies Deployed Through Our Services

When our customers install Klarvyn's tracking script on their websites, the following cookies may be set:

  • kv_vid (visitor ID) — Persistent cookie identifying a unique visitor across sessions. Duration: up to 24 months.
  • kv_sid (session ID) — Session cookie for grouping activities within a single browsing session. Duration: session only.

These cookies are set on our customers' websites, and our customers are responsible for obtaining appropriate consent from their visitors before setting non-essential cookies. Our customers must comply with the ePrivacy Directive and similar regulations regarding cookie consent.

10.3 Third-Party Cookies

We may read third-party cookies set by advertising platforms (Meta, Google, TikTok, LinkedIn, Reddit) to enable attribution matching. These cookies are set by those platforms, not by Klarvyn.

11. Klarvyn Browser Extension

Klarvyn offers an optional Chrome browser extension that displays your Klarvyn attribution metrics as an overlay inside supported advertising platforms (e.g., Meta, Google, Microsoft, TikTok, Pinterest, Snapchat, X, Reddit, LinkedIn, AdRoll). The extension is available only to our authenticated customers and their account users.

11.1 What the Extension Accesses

  • Account email and authentication token — used solely to authenticate you to your Klarvyn account and retrieve your own attribution data.
  • Advertising-manager page content — the extension reads campaign, ad set, and ad identifiers and spend figures visible on the ad-manager pages you open, in order to match them to your Klarvyn attribution metrics and position the overlay.

11.2 How the Data Is Used

This information is used exclusively to render your attribution metrics within the ad manager. The extension does not collect browsing history, does not track activity outside supported ad-manager pages, and does not read pages unrelated to its function.

11.3 What We Do Not Do

We do not sell or transfer extension data to third parties, do not use it for advertising, and do not use it to determine creditworthiness or for lending purposes. Data handled by the extension is processed under the same security and retention practices described in this Policy.

12. Data Security

We implement industry-standard technical and organizational security measures to protect personal data, including:

  • Encryption in transit: TLS 1.2 or higher for all data transmission
  • Encryption at rest: AES-256 encryption for stored data
  • Hashed identifiers: Email addresses and phone numbers stored as SHA-256 hashes
  • Access controls: Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA)
  • Infrastructure security: Firewalls, DDoS protection, intrusion detection
  • Monitoring: Continuous security monitoring, vulnerability scanning, and incident response
  • Employee training: Regular security awareness training for personnel with data access

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users and authorities in the event of a data breach.

13. Children's Privacy

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete the data promptly. If you believe we may have collected data from a child under 16, please contact us at privacy@klarvyn.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be:

  • Communicated via email to registered users (where applicable)
  • Posted with a prominent notice on klarvyn.com
  • Reflected in the "Last Updated" date at the top of this Policy

Continued use of the Services after material changes constitutes acceptance of the updated Privacy Policy.

15. Contact Us

For questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Northpunch Media Group Limited
Limassol, Cyprus

Privacy contact: privacy@klarvyn.com
Support: support@klarvyn.com
Website: https://klarvyn.com

For data subject requests (access, deletion, correction), please email privacy@klarvyn.com with sufficient information to verify your identity and identify the data you wish to access, correct, or delete.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. For EU/EEA residents, a list of national data protection authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en

Related Policies