Privacy Policy

This Privacy Policy explains how Andrew James Finlayson (sole trader) trading as Unblot, ABN 87 528 719 524 ("unblot", "we", "us") handles personal information. We comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where applicable, the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

1. Controller vs processor

We act as a controller for the personal information of our account holders (you). We act as a processor for the personal data of your contacts that we access in your Klaviyo account — you are the controller of that data, and our Data Processing Agreement governs it.

2. What we collect

• Account information — your name and email, managed via our authentication provider, Clerk.
• Billing information — handled by Stripe. We receive your subscription status and a customer reference; we do not store your full card details.
• Usage & technical data — log data, device/browser information, and actions you take in the app.
• Support messages — anything you send us via the support form or email.
• Klaviyo contact data (as processor) — profile identifiers, email addresses, and engagement/order events we read to score engagement and perform suppressions you direct. We process this on your behalf and per your instructions.

3. How we use it & legal bases

• To provide, operate, and secure the Service (performance of our contract with you).
• To process payments and manage subscriptions (contract).
• To respond to support requests (legitimate interests / contract).
• To improve the Service using aggregated, de-identified data (legitimate interests).
• To send service and (with your consent where required) marketing emails.
• To comply with legal obligations.

4. Sharing & sub-processors

We do not sell your personal information. We share it with the service providers needed to run unblot — including Klaviyo, Stripe, Clerk, Amazon Web Services, PostHog (product analytics), and Sentry (error monitoring). The current list, with purposes and locations, is in our DPA & sub-processor list. We may also disclose information where required by law.

5. International transfers

We host data in Amazon Web Services' Sydney (ap-southeast-2) region. Some sub-processors may process data outside Australia (for example, in the US or EU). Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.

6. Retention

We keep account and usage data while your account is active and for a reasonable period afterwards as needed for legal, tax, and security purposes. Klaviyo contact data we process on your behalf is retained per your instructions and the DPA, and deleted or returned on termination.

7. Security

We use measures including encryption in transit and at rest, OAuth (never your Klaviyo password), and least-privilege access. See our Security overview.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or object to the processing of your personal information, and to withdraw consent. You can delete your account (and the associated data) from your settings, or contact us to exercise any right. You may also complain to your privacy regulator (in Australia, the OAIC).

9. Cookies

We use essential cookies to keep you signed in and, with your consent, analytics cookies. See our Cookie Policy.

10. Children

unblot is a business tool not directed at children and not intended for anyone under 18.

11. Changes

We may update this policy and will post the new version here with an updated date; we will give notice of material changes.

12. Contact

For privacy questions or data requests, email support@unblot.com.