Legal

Privacy Policy

Last updated: August 14, 2026

{{COMPANY_LEGAL_NAME}} (“Kiln,” “we,” “our,” or “us”) provides tools that read public storefronts and create email-campaign drafts. This policy explains how we handle information when you use Kiln, visit a Kiln page, submit a domain, or connect a Klaviyo account.

1. Information We Collect

1.1 Information You Provide

When you create an account, we collect the name, work email address, and password you provide. We also collect a domain when you submit one, the campaign content and edits you make, and any Klaviyo private API key, sender email address, or sender label you choose to connect.

1.2 Public Storefront Information

Kiln can read a brand's public storefront without that brand having an account or relationship with us. This can include public pages, product-catalog details, images, colours, fonts, and copy, as well as public reference emails obtained from a third-party source. We use this material to build a brand kit and draft a four-email campaign.

We do not use a storefront login or access content behind a login as part of this crawl. A public campaign may be published at /for/[domain], including for brands that have not signed up. These pages are intended to be public and unaffiliated. A brand can contact us at {{CONTACT_EMAIL}} with a question or request about its page.

1.3 Information Collected Automatically

We use PostHog analytics to record product events such as a domain submission, a public campaign-page view, a campaign generation, an account connection, an export, or an email revision. Event properties can include the submitted or viewed domain and related campaign identifiers.

1.4 California / CPRA Categories

Depending on how you use Kiln, the information above can include identifiers such as your name and email address, internet or network activity related to use of the service, and commercial information in a public storefront catalog. We use these categories for the purposes described below.

2. How We Use Information

We use information to operate Kiln: to create and retain accounts; read submitted public storefronts; create, render, inspect, and revise campaign drafts; export drafts to a connected Klaviyo account; measure use of the product; maintain and secure the service; respond to requests; and comply with legal obligations.

2.1 Legal Bases for Processing

Where applicable law requires a legal basis, we process personal data to provide the service you ask for, to pursue legitimate interests in operating and securing Kiln, to meet legal obligations, or with your consent where required. You may contact {{CONTACT_EMAIL}} with a privacy request.

3. Artificial Intelligence and Automated Processing

Kiln sends public storefront material and campaign-editing instructions to third-party language-model providers through the Vercel AI Gateway to generate or revise campaign content. AI-generated content is a draft for review: Kiln shows the source material behind catalog claims, and customers remain responsible for deciding whether to use an output.

Kiln does not make decisions that are intended to produce legal, employment, credit, or similarly significant effects on an individual.

4. Sharing Your Information

4.1 Service Providers and Subprocessors

We use the following providers to operate the service:

Neon/PostgreSQL for application data.
Vercel for application hosting and the AI Gateway.
Cloudflare R2 for object storage.
Trigger.dev for background generation jobs.
Resend for preview and transactional email.
Klaviyo for connected-account exports.
AI Gateway model providers for generation and revision requests.
PostHog for product analytics.

4.2 Legal Requirements

We may disclose information when required by law, regulation, legal process, or a valid government request, or when reasonably necessary to protect Kiln, our users, or others.

4.3 Business Transfers

If Kiln is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction.

5. Data Retention

We retain account records, public-storefront material, campaign drafts, and related operational records for as long as needed to provide Kiln and for legitimate operational, legal, and security purposes. Public campaign pages remain public unless we change or remove them. To ask about a specific record or page, contact {{CONTACT_EMAIL}}.

6. Your Rights and Choices

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of your personal information; to object to or restrict certain processing; or to withdraw consent. To make a request, contact {{CONTACT_EMAIL}}. We may need to verify your request before acting on it.

7. Security

Kiln stores a connected Klaviyo private API key encrypted at rest with AES-256-GCM. We also use measures intended to protect information in the service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Cookies and Similar Technologies

Kiln loads PostHog analytics when its browser analytics key is configured. Your browser may offer controls for cookies and similar technologies; changing those controls can affect analytics behavior.

9. Third-Party Links and Services

Kiln pages and campaign drafts can link to third-party sites, including storefronts and Klaviyo. Their privacy practices are governed by their own policies.

10. International Data Transfers

Our service providers may process information in locations that have privacy laws different from those where you live.

11. Children's Privacy

Kiln is not directed to children. If you believe a child has provided personal information to Kiln, contact {{CONTACT_EMAIL}}.

12. Updates to This Policy

We may update this policy from time to time. The date at the top shows when it was last updated.

13. Data Processing Addendum

If we process personal data on behalf of a business customer, the parties may enter into a separate data processing addendum. Contact {{CONTACT_EMAIL}} to request one.