Retainora (“we”, “us”) is the controller of the personal information described in this policy.

You can contact us about anything in this policy at hello@retainora.com.

We only collect what you give us or what we need to do our work:

• Enquiries — when you book an audit or contact us: your name, email address, company, website, and anything you tell us about your email program (such as list size or an estimate of email revenue).
• Client work — when we work for you: contact details for your team, and access to the marketing platforms and data you choose to share with us.
• Correspondence — emails and messages you send us.

We don't buy personal data and we don't collect special category data.

• To reply to your enquiry and deliver the free audit you asked for — our legitimate interests in responding to business enquiries.
• To provide the services you engage us for, invoice you and manage the relationship — performance of a contract.
• To keep records we are required to keep, such as for tax — legal obligation.
• To send you occasional marketing emails, only where the law allows — see below.

We follow the Privacy and Electronic Communications Regulations (PECR). We'll only send you marketing if you've agreed to it, or if you're an existing client or have enquired about our services and we're telling you about similar services — and you can opt out at any time using the link in any email or by writing to hello@retainora.com.

We never sell your personal information. We share it only with service providers who help us run the business, under contracts that require them to protect it:

• our website hosting provider, which stores the site and the enquiries it receives;
• our email provider, which delivers our messages and enquiry notifications;
• AI drafting tools we use to prepare first drafts of audits, copy and reports — we don't send your contact details to them;
• professional advisers such as accountants, where needed.

When we work on a client's own customer data (for example inside their Klaviyo account), we act as that client's processor and only use the data on their instructions, under a data processing agreement.

Some of our providers are based in, or store data in, the United States or elsewhere outside the UK. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement / Addendum, so your information keeps an equivalent level of protection.

This website doesn't use analytics, advertising or tracking cookies. The only cookie we set is a strictly necessary sign-in cookie for our own team's admin area, which doesn't need consent. If we ever add analytics, we'll ask for your consent first and update this policy.

Enquiries that don't lead to work together are deleted within 24 months. Client records are kept for as long as we work together and then for up to six years, to meet UK tax and legal record-keeping requirements. We delete or anonymise information once it's no longer needed.

We use encrypted connections (HTTPS), access controls and reputable providers to protect your information, and we limit access to people who need it to do their job.

Under UK data protection law you have the right to access your personal information, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent at any time where we rely on consent. To use any of these rights, email hello@retainora.com — we'll respond within one month.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

We'll update this page if the way we handle personal information changes, and change the date at the top when we do.