1. Who we are
Retention Systems is run by Retention Systems (“we”, “us”). We are an email and SMS retention agency for ecommerce brands, with our own analytics platform. This policy covers our website, our free retention audit, our client dashboard and our agency services.
We play two roles. For people who visit our website, book a call or work with us, we decide how their data is used, so we are the controller and this policy applies. For the customer data in a brand's Shopify, Klaviyo, Recharge and Meta accounts, the brand decides how it's used and we act on its instructions, so we are a processor and our Data Processing Agreement applies.
2. What we collect about you
- Bookings: your name, email, the time you choose and anything you tell us when booking an audit or call (through Calendly).
- Messages: anything you send us by email.
- Client accounts: when the dashboard is available to you, your name, email address, the brands you can see and your team role.
- Logs: our servers record requests and errors (including IP address, time and the page) to keep the service running and secure.
- Cookies: our website doesn't use advertising or analytics cookies. The dashboard uses a sign-in cookie to keep you logged in.
3. Data from a brand's connected tools
When a brand connects its tools for an audit or the dashboard, we read the following, with read-only access:
- Shopify (Read-only app): Orders, line items, refunds, customers (name, email, phone, country and region), products, discount codes and the source of each customer's first visit.
- Klaviyo (Read-only private API key): Profiles and their email and SMS consent, lists, segments, flows, campaigns, and email and SMS activity such as clicks, opens, unsubscribes and attributed orders.
- Recharge (Read-only API token): Subscriptions, charges, skips, swaps, cancellations and cancellation reasons.
- Meta (Facebook Login with ads_read): Ad spend and results by campaign, ad set and ad. These are totals; Meta doesn't give us details of the people who saw your ads.
This includes personal data about the brand's own customers (shoppers), such as names, email addresses, phone numbers and order history. We never receive payment card details, and we don't store full street addresses.
4. How we use it
- To produce the brand's retention audit, dashboard, risk scores and weekly reports.
- To run our agency services for clients, such as planning campaigns and building segments.
- To arrange and hold calls, answer messages and send sign-in links and reports.
- To keep our services secure, prevent abuse and fix problems.
- To meet legal obligations.
Our legal bases (where the UK GDPR or GDPR applies) are: performing our contract with you or your company; our legitimate interest in running a secure and reliable service and in replying to people who contact us; and complying with the law. For shopper data, the brand is responsible for having a lawful basis, and we process it only on the brand's instructions.
We don't sell personal data, use it to advertise, or show one brand's data to another. We don't send it to AI providers or use it to train AI models.
5. Who we share it with
- Our service providers for hosting, email and bookings. They're listed on our Data Safety page.
- The brand's own team, through the dashboard and reports, according to the access the brand gives them.
- Authorities, when the law requires it or to protect people's safety, our rights or the service.
- A buyer or successor, if our business is sold or merged, under the same protections.
6. How long we keep it
- Audit data for brands that don't become clients: deleted within 60 days of the audit, or sooner on request.
- Client data: kept while we work together, and deleted within 30 days of the brand disconnecting or the engagement ending.
- Access keys: deleted as soon as a tool is disconnected.
- Shopper deletion requests passed to us by Shopify are acted on within 30 days.
- Bookings and emails: kept as long as needed to manage our relationship with you.
Backups are deleted as they expire.
7. Security
Every connection uses HTTPS, access keys are encrypted with AES-256 before they're stored, and only the brand's team and ours can see its data. Details are on our Data Safety page.
8. Where data is stored
Our database is stored in the European Union. Some providers may process data in other countries. Where the law requires it, we rely on safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
9. Your rights
You can ask to access, correct, delete or export your data, or object to how we use it, by emailing privacy@retentionsystems.net. You can also complain to your data protection authority; in the UK that's the Information Commissioner's Office (ico.org.uk).
If you're a shopper at a brand we work with, please contact that brand first, as it controls your data. If you contact us, we'll pass your request to the brand and help it respond.
10. Children
Our services are for businesses. We don't knowingly collect data from children through our website.
11. Changes
We'll update the date at the top when this policy changes, and tell clients about significant changes before they take effect.