Audit Access and Data Handling Policy
Last reviewed: October 2026
This policy sets out exactly what Emailium does, and does not do, when a brand grants us access to its Klaviyo account for a Health Score. By inviting support@theemailium.com and ticking the consent box, you agree to these terms and confirm you are authorized to grant that access on behalf of the brand.
1. What access we ask for
| Report | Role requested | Why that role |
|---|---|---|
| Full Health Score | Manager | Flow logic, segment conditions, form display rules, and sending-domain settings are visible only at Manager level. We use Manager access in read-only fashion; see section 3. |
| Health Score Snapshot | Analyst, or four screenshots | Analyst is read-only and sufficient for the 12 Snapshot checks. |
| Either | One screenshot of Settings, Billing | Plan tier and active-profile count are visible only to Owners and Admins. We do not request Admin or Owner access. |
The invite goes to a single address, support@theemailium.com, which is controlled by Emailium with two-factor authentication enabled.
2. What we do with it
We review account configuration and performance data to produce the report you requested. That includes reading flows, campaigns, segments, lists, forms, deliverability settings, integrations, and the reports Klaviyo generates about them. We take screenshots of configuration screens and aggregate reporting for inclusion in your report.
3. What we will not do
During an audit we will not:
- send, schedule, or test-send any campaign, flow message, or SMS
- edit, pause, enable, or delete any flow, campaign, segment, list, form, or template
- export profiles, lists, segments, or any customer-level data
- add or remove users, change integrations, or alter account settings
- view individual customer profiles beyond what is incidentally visible on configuration and reporting screens
- use anything we see for any purpose other than producing your report
If completing a check would require any of the above, we skip the check and say so in the report.
4. Customer data
Your customers’ personal data stays in your Klaviyo account. We do not copy it out. Where a screenshot would show customer-level data (a profile, an email address, an order), we crop or redact it before it enters the report. The report contains aggregate figures and configuration findings only.
UK and EU brands. For the purposes of UK GDPR and EU GDPR, you are the controller of your customers’ data and Emailium is a processor acting on your documented instruction, which is this policy and your request for the report.
US brands. For the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and the comparable consumer privacy laws of other US states, you are the business or controller and Emailium is your service provider or processor. We process your customers’ personal information only to produce the report you requested. We do not sell or share it, we do not retain, use, or disclose it for any other purpose or outside our direct relationship with you, and we do not combine it with personal information we receive from anyone else. We will meet the obligations these laws place on service providers and processors, and we will tell you promptly if we ever believe we can no longer meet them.
We process the data only in the UK and the countries where Klaviyo itself hosts it. We engage no sub-processor to handle your customer data; our own tooling (Google Workspace, n8n) holds only the report and your business contact details.
5. How long access lasts
| Event | Access |
|---|---|
| You send the invite | Access begins; the 72-hour (Full) or 48-hour (Snapshot) delivery clock starts when we accept it |
| Report delivered | We remind you to remove us. You can do so in Settings, Users, at any time, in about ten seconds |
| 7 days after delivery | If access is still open and you have not asked us to continue, we remove ourselves |
| You become a client | Access continues under the client agreement, which replaces this policy |
6. Confidentiality
Everything we see in your account and everything in your report is confidential to you. We do not name your brand, quote your figures, or use your results in our marketing unless you give separate written consent. Anonymized, aggregated patterns across many audits (for example, “most brands we audit have no browse-abandonment flow”) may inform our published content; nothing in them can identify you.
7. Security
The support@ account uses two-factor authentication and a unique password held in a password manager. Reports are stored in access-controlled Google Workspace folders. If we become aware of a security incident affecting your data while we hold access, we will tell you within 48 hours.
8. Your rights and ours
You can revoke access at any time, ask us to stop the audit, and ask us to delete any report draft. We can decline or stop an audit if the account appears to have been compromised, if we cannot verify you are authorized, or if the account has too little data for the report to be useful; in that case we tell you why and offer the Snapshot or a call instead.
9. Contact
Questions about this policy, an audit in progress, or privacy requests: support@theemailium.com.
