What happens to your designs, keys and accounts.

Your designs

• Uploaded files are checked by their content, not their name: only real PNG and JPG files up to 25 MB are accepted.
• The original and the working image are kept in private storage that is never served to the web.
• Sliced images are served from a public address, because Klaviyo and your subscribers’ inboxes need to load them. Each address contains a hash of the image’s content, so it can’t be guessed, but anyone who has the exact address can open that slice, as with any image in a sent email.
• ZIP downloads are private and reached through links that expire after 24 hours.

Connected accounts and keys

• Klaviyo private keys and login tokens, AI provider keys and Figma tokens are encrypted with AES-256-GCM before they are stored, and are never shown again after you save them.
• “Connect with Klaviyo” uses Klaviyo’s OAuth login with PKCE and asks only for the permissions listed on the Klaviyo integration page. Access tokens last an hour and are refreshed as needed.
• Disconnecting or deleting a brand revokes our access in Klaviyo straight away.
• We never read subscriber profiles, and we never send email from your account.

AI processing

Built-in alt text is generated by Anthropic from a reduced copy of each slice (at most 800 px wide, JPEG). If you add your own OpenAI or Anthropic key, that provider receives the slices instead, under your account with them. We don’t use your designs to train models, and we don’t send them to AI providers for any other purpose. Decorative slices with no content are skipped.

Where everything runs

The full list of providers is on the subprocessors page.

How it is protected

• Every connection uses HTTPS, with HSTS so browsers never fall back to plain HTTP.
• Passwords are stored as bcrypt hashes. You can also sign in with Google.
• The image-processing service isn’t reachable from the internet; requests to it from the app are signed.
• Card details go straight to Dodo Payments’ checkout and never reach our servers.
• Key actions, such as connecting or deleting a brand, deleting a project or changing someone’s access, are recorded in an audit log.
• Every code change is tested automatically, including accessibility and permission checks, before it is deployed.

Who can see what

Inside a workspace, the owner sees everything. Teammates see only the brands in their pods, or brands given to them directly, and the projects for those brands. Only the owner manages billing and deletes brands. On our side, access to production systems is limited to the people who operate the service.

Retention and deletion

• Projects are kept for your plan’s history window (30 days on Free, 1 year on Starter, unlimited on Pro and Agency) or until you delete them.
• A deleted project, its images and slices are permanently removed 30 days later.
• Database backups are kept for up to 4 weeks, then overwritten.
• Removing a key, or deleting a brand profile, deletes the stored credential.

The Privacy Policy lists every retention period.

What we don’t have yet

We are a small team, and we would rather say this plainly: Email Slicer doesn’t hold a SOC 2 or ISO 27001 certification and hasn’t had an independent penetration test. If your organisation needs a security questionnaire answered, email hello@emailslicer.io.

Report a vulnerability

If you find a security problem, email hello@emailslicer.io with the details and steps to reproduce it. Please don’t access other people’s data or disrupt the service while testing. We confirm receipt within two business days and tell you when it is fixed.