Privacy Notice
Last updated: July 11, 2026
This notice covers deadweight.email, the Deadweight dashboard, and the Klaviyo audit, cleanup, and monitoring service.
Contracting provider. Deadweight is operated by the service provider identified in your applicable order confirmation, invoice, or signed order form. The provider's legal name and postal address will be supplied before a paid order is accepted or a DPA is signed. Privacy requests can be sent to hello@deadweight.email.
Deadweight is an independent service. It is not operated by Klaviyo.
Data we process
| Category | Examples | Purpose |
|---|---|---|
| Deadweight account | Email address, password hash, session and verification records | Authentication, account security, and support |
| Lead form | Email, source, profile-count scenario, inactive-percentage scenario, marketing choice | Return the requested next step and respond to the inquiry |
| Security logs | IP address, route, result, timing, and redacted event metadata | Rate limiting, abuse prevention, incident investigation, and reliability |
| Klaviyo connection | Encrypted OAuth access and refresh tokens, scopes, account ID, account name | Operate the connected workspace on your instruction |
| Audit evidence | Aggregate billable, candidate, and protected counts; segment ID; recipe version and hash; timestamps and blockers | Produce an auditable inactive-profile result |
| Cleanup evidence | Typed approval, approver, approved count, Klaviyo list and bulk-job IDs, completed and skipped counts, rollback state | Control, monitor, verify, and if requested roll back the write action |
| Payment records | Processor event key, contract and product IDs, amount, currency, status, workspace binding | Verify payment, grant the correct capability, prevent replay, and keep required financial evidence |
Subscriber data
Deadweight evaluates profile membership through Klaviyo. It does not persist a raw list of subscriber email addresses in the Deadweight database. Before cleanup, profile IDs are copied to a temporary static list inside your Klaviyo account. Deadweight stores the Klaviyo object ID and aggregate evidence needed to operate and verify the job.
The temporary list is scheduled for deletion after the seven-day rollback window. If Klaviyo rejects or delays deletion, the retention worker retries and records that cleanup is pending.
Why we process data
- To provide the service you requested and perform the applicable contract.
- To protect the service and connected workspaces against abuse, fraud, and unauthorized access.
- To keep accounting and payment evidence where law requires it.
- To send marketing only when a separate valid permission or another documented lawful basis applies.
Deadweight does not sell personal data and does not use Klaviyo subscriber data for advertising.
Retention
- OAuth tokens remain until disconnection, workspace deletion, or provider revocation.
- Workspace, audit, settings, and cleanup records remain until workspace deletion or an applicable retention obligation.
- The Klaviyo rollback list is targeted for deletion after seven days.
- Sessions expire after the configured session period; expired authentication and OAuth state records are purged automatically.
- Non-consented lead records are removed on the configured retention schedule or sooner on a valid request. Consent records may be retained to document the choice.
- Security logs use operational rolling retention. Payment and tax records may be kept for the period required by applicable law, with workspace and user identifiers removed after workspace deletion where supported.
Sharing and international transfers
Deadweight uses only the providers needed for hosting, network security, email, payments, and the connected Klaviyo service. See Subprocessors. Where a restricted transfer applies, the parties will use the provider's applicable transfer mechanism, including Standard Contractual Clauses where required.
Cookies and local storage
The dashboard uses a secure session cookie. Theme and interface preferences may be stored locally in your browser. Deadweight does not run advertising pixels or session-replay software on the dashboard.
Your choices and rights
You can revoke Klaviyo access, disconnect, sign out, or delete workspace data from Settings. Depending on applicable law, you may also request access, correction, deletion, restriction, portability, or objection. Send a request to hello@deadweight.email. We may need to verify the request before acting.