Privacy

Draft. This policy has not been reviewed by a lawyer yet.

Who we are

Hurdle is operated by Tomtar LLC, State of Texas. Questions: willy@tomtarlabs.com.

What we store

• Your Klaviyo account id, organization name, default sender email and website, and the settings you choose in Hurdle.
• Klaviyo OAuth access and refresh tokens, encrypted (AES-256-GCM).
• For each campaign Hurdle prepares: its name, subject, send time and status, the original and optimized HTML, and the ids of the templates involved.
• Aggregated results per campaign and group: recipients, opens, clicks, orders and revenue. We don't store individual events.
• A log of Hurdle's requests to Klaviyo: method, path, status, duration, and for failures up to 500 characters of the error message.
• An organization record for your store: its name and a copy of your billing status.
• If you add your email: your email address, when you confirmed it, when you last signed in, and your role in your organization. We don't ask for your name.
• For each sign-in or confirmation link: a one-way hash of the link (never the link itself), which works once and expires after 15 minutes.
• For each invite: the invited email address, the role offered, who sent it, when it was accepted or revoked, and a one-way hash of the link, which works once and expires after 7 days.
• To limit how often links can be requested: keyed one-way hashes of the email address and IP address of each request, deleted after a day.
• A sign-in cookie (__Host-io_session, 30 days, sent only to this site's own address) and the matching session record, which says which account and, once you've added your email, which user it belongs to. No analytics or advertising cookies.
• A short-lived security code while you connect Klaviyo, deleted when the connection completes.

What we write to your Klaviyo account

• A profile property inbox_optimizer_bucket (0 to 99) and the time it was assigned, on each profile with an email address.
• Optimized and backup templates, and the optimized template assigned to each prepared campaign. Hurdle can delete the optimized and backup templates it created once their campaign has sent; it never deletes your own templates or the one assigned to a campaign.

To measure results, Hurdle reads email and order events and profile emails from Klaviyo while it runs, and keeps only the totals above.

Where it is stored

In a Postgres database run by Neon in AWS US East (Virginia). The app runs on Vercel in the United States. Sign-in, confirmation and invite emails are sent through Resend, which receives the recipient's address and the email's contents. Neon, Vercel and Resend process the data for us. We don't sell or share it with anyone else.

Who can see it

The Tomtar LLC operator, for running and supporting the service.

How long we keep it

Until you ask us to delete it. Disconnecting in Settings revokes Hurdle's Klaviyo access, stops all jobs and signs you out, but it doesn't currently delete stored data, and the bucket property and templates stay in your Klaviyo account. Email willy@tomtarlabs.com to have your data deleted.