Privacy Policy
Effective date: August 12, 2026
This Privacy Policy explains how Nevin Puri Ventures, LLC ("Linen", "we", "us") handles personal data in connection with our done-for-you email marketing service (the "Service").
Linen is a service business. We build and run email marketing inside our customers' own Klaviyo accounts. That means we handle two very different kinds of data, and the rules differ for each:
- Customer data — information about the business owner who hires us. We are the controller of this data.
- Subscriber data — information about our customers' own email subscribers and shoppers. We are a processor, handling it strictly on our customer's instructions. If you are a shopper who received an email, the business that emailed you is the controller, and you should contact them first. See Section 7.
1. Data We Collect
1.1 Customer account data
When you hire us, we collect and hold:
- Name, business name, email address, and phone number if you give it.
- Your store URL and domain.
- Billing details. Card numbers are processed by our payment processor (Stripe) and are never stored on our systems. We retain the last four digits, card brand, and billing address for records.
- Records of our correspondence with you, including emails and support requests.
- Approvals, feedback, and instructions you give us about the work.
1.2 Access credentials
To do the work you hire us for, you grant us access to systems including your Klaviyo account and sometimes your store platform or DNS. We store any API keys or access tokens encrypted, use them only to perform the Service, and revoke or delete them when the engagement ends or on your request.
1.3 Data from your public website
Before and during an engagement we read your publicly available storefront to understand your brand: product listings, imagery, copy, colours, fonts, and page structure. This is public information and generally contains no personal data, though it may include names or images of founders or staff where you have published them.
1.4 Subscriber data we access on your behalf
Working inside your Klaviyo account necessarily means we can see the data held there, which typically includes subscriber email addresses, names, purchase and browsing history, and engagement metrics.
We access this only as needed to build, segment, test, and report on your email programme. We do not export it, do not use it for our own purposes, do not use it to train models, and do not sell or share it with anyone.
1.5 Website analytics
On our own website we use privacy-conscious analytics to understand aggregate traffic. We may use essential cookies to keep you signed in and to remember preferences. We do not sell website visitor data.
1.6 Pitch pages
We sometimes prepare a personalised proposal page for a prospective customer showing work we have already built for their brand. These pages are unlisted and set to no-index. We may record that a page was viewed, and whether an included video was played, so we know whether to follow up.
2. How We Use Data
We use customer data to deliver the Service, communicate with you, take payment, provide support, meet legal and tax obligations, and improve how we work. We use it to send you service messages about your account. We will only send you marketing email if you have opted in, and every such email has an unsubscribe link.
We use subscriber data solely to perform the Service for the customer who controls it.
3. Legal Bases (GDPR)
Where GDPR applies, we rely on: contract (to deliver a service you have engaged us for and to bill you), legitimate interests (to secure our systems, prevent fraud, and improve the Service, balanced against your rights), consent (for optional marketing, withdrawable at any time), and legal obligation (tax and accounting records).
4. Subprocessors
We use a small number of vendors to run the business. Each is bound by contract to protect the data they handle.
| Vendor | Purpose | Data involved |
|---|---|---|
| Klaviyo | The platform your email programme runs in | Subscriber data, held in your own account |
| Stripe | Payment processing | Billing and card data |
| Supabase | Database and file storage | Customer records, project assets |
| Vercel / Cloudflare | Hosting and content delivery | Request logs, static assets |
| Anthropic, OpenAI, xAI, Google | Generative AI used to produce copy, layouts, and imagery | Brand and product context, drafts |
| Resend / Google Workspace | Our own email to you | Your email address and correspondence |
We send AI providers the brand and product context needed to write your emails. We do not send them your subscriber lists or individual subscriber records. Our agreements with these providers are on terms that do not permit training on our submitted data.
We may add or change subprocessors as the business evolves. Material changes will be reflected here.
5. International Transfers
We operate from the United States and our vendors may process data in the US and elsewhere. Where data moves out of the UK, EEA, or Switzerland, we rely on Standard Contractual Clauses or another lawful transfer mechanism.
6. Retention
We keep customer account and billing records for as long as you are a customer and for up to seven years afterwards, to meet tax and legal obligations.
We delete or revoke access credentials at the end of an engagement.
Subscriber data lives in your Klaviyo account, not ours; you control its retention. Any working copies we hold to perform the Service are deleted within 90 days of termination unless you ask sooner.
7. Your Rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent.
If you are our customer, email hello@linen.so and we will respond within 30 days.
If you are a subscriber of one of our customers and want your data accessed or deleted, please contact the business that emailed you. They control that data and we act on their instructions. If you contact us directly, we will pass your request to them and assist as required, but we cannot act on their data without their instruction.
We will not discriminate against you for exercising any of these rights.
8. California Rights (CCPA / CPRA)
California residents have the right to know what personal information we collect and why, to request deletion or correction, to opt out of sale or sharing, and to be free from discrimination for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.
To exercise a right, email hello@linen.so. You may use an authorised agent, and we will verify the request before acting on it.
9. Email Compliance
Our customers are the senders of record for the email we produce for them. Each customer is responsible for holding valid consent for their list and for complying with CAN-SPAM, CASL, GDPR, and other applicable law. We build unsubscribe handling and sender identification into what we produce, and we will decline or stop work where we believe a list is not properly consented.
For our own marketing email, you can unsubscribe at any time using the link in the message.
10. Security
We use encryption in transit and at rest, encrypted storage for credentials, access controls limiting who can reach customer systems, and reputable infrastructure providers.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and any relevant regulator as required by law.
11. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
12. Other Disclosures
We may disclose personal data where required by law, subpoena, or legal process; to protect our rights, safety, or property, or those of others; to investigate fraud or a security incident; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you and this policy will continue to apply until replaced.
13. Changes
We may update this policy. Material changes will be posted here with a new effective date and, where significant, notified by email.
14. Contact
Nevin Puri Ventures, LLC hello@linen.so