Privacy policy

1.Who we are and what this covers

R10N is a design tool for email. You give it your brand, it designs on-brand emails, and you export them to the platform you already send from. This policy explains what we do with the information that passes through it.

The service is operated by Kracked Retention Inc, a corporation based at 3345 Thorpe Road, Nashville, Tennessee 37207, United States (“R10N”, “we”, “us”).

For the purposes of UK and EU data protection law we are the controller of the information described in What we collect. Where your emails or your brand kit contain personal data belonging to other people, you are the controller of that and we process it on your instructions. We do not offer a separate data processing agreement today. If your business needs one, write to us.

Contact us about anything in this policy at hello@r10n.app. We have not appointed a data protection officer or a representative in the UK or the EU.

2.What we collect

Your account

• Your email address and password, handled by our authentication provider. We never see your password in a readable form.
• Your workspace name, your role in it, and when you last used it.
• The email addresses of people you invite, until the invite is accepted, revoked or expires.
• A single attribution tag recorded once when your account is created, saying which campaign, which member of our team, or which independent referrer you came from. See If somebody referred you and Cookies.
• If you arrived through a referrer's link, the fact that you did, and what we show that referrer about it. See If somebody referred you.

Your brand

When you onboard a brand you give us its website address, and we read that public site once: the logo, the colors, the typefaces, the product photography and how the brand writes. We also pick up the contact details the site publishes, including a postal address, a support email address and a phone number, because an email footer legally needs them. All of that becomes a brand kit you can correct.

Your work

• What you type into the chat, and what the designer types back.
• Every email you design, and every saved version of it.
• Campaign notes: the concept, the angle, the products, the audience label you chose and the date you scheduled it for.
• Images you upload, images the tool generates, and the prompt that generated each one.
• Files you attach to a brief. Images, PDFs and text files up to 10MB each. We decide what a file actually is from its bytes rather than from its name.

Your billing

Your customer and subscription identifiers at our payment processor, your plan, your subscription status, and the amount, currency, status and period of each invoice, refund and chargeback. Card details never reach our servers. See Payments.

Your use of the product

Which actions you took and when, which project they belonged to, how long each design run took and what it cost us to run, your credit balance and every movement in it, and an audit record of significant administrative actions such as a credit grant, a suspension or a workspace deletion. An audit record holds who did it, what they did, when, and the workspace it happened to. It does not hold your content.

What we do not collect

We do not store IP addresses, browser user agent strings or referrer headers in our database. We run no analytics product, no advertising tags, no session recording and no third-party tracking of any kind. The one thing we do measure is our own automated emails to you, described in Emails we send you. Our hosting and database providers do keep their own request and access logs, which will include IP addresses, in their own systems and under their own retention rules.

3.Why we use it, and our lawful basis

We rely on three lawful bases, and nothing here is processed for advertising or sold to anybody.

• To perform our contract with you. Creating and running your account, reading your brand site to build a brand kit, designing and editing emails, storing your work, metering credits, taking payment, exporting to your sending platform, and answering your support requests.
• Our legitimate interests. Keeping the service secure and available, preventing abuse and fraud, rate limiting, keeping an audit record of administrative actions, understanding which parts of the product get used so we can improve them, knowing where a signup came from, and running a referral program in which the person who referred you can see that you signed up. If somebody referred you says exactly what they see and how to stop it.
• Legal obligation. Keeping billing and tax records, and responding to lawful requests.

Where we rely on legitimate interests you can object. See Your rights.

4.What we send to the design models

This is the part of the product people most want a straight answer about, so here it is in detail.

To design an email we send the following to Anthropic, which provides the model that does the design work:

• Your brief and the conversation you are having in the chat.
• Your brand kit: the brand name, its colors, its typefaces, how it writes, its product names and prices.
• Screenshots of your own brand website, sent as images, so the designer can see what your brand actually looks like rather than reading a description of it.
• Reference emails from our own library, which are our material and not yours.
• The email document itself, on every edit, so a change can be made in place.

During a design run the model is also able to fetch and search the web itself, and it uses that to read your brand's own pages, several times per page. So your public site is visited both by us and by the model provider on our behalf.

To generate or edit a picture we send the image prompt to OpenAI, and for an edit we also send the actual image bytes, which may be your real product photography. This is how the label on your product stays your label.

To read your brand site in the first place we send its URL to Firecrawl, which loads and renders the page and returns the design information it finds.

We do not use your content to train our own models, and we have no model of our own to train. What our providers do with content sent to their APIs is governed by their own terms. Under their standard terms for business use of their APIs: Anthropic deletes what we send within 30 days, keeping it longer only where it must to enforce its usage policy or the law, and does not train its models on it. OpenAI does not use what we send to train its models, and keeps it for up to 30 days to monitor for abuse.

5.If somebody referred you

We run a referral program. Creators, partners and members of our own team each have their own link, and if you arrived through one we record which one, once, when your account is created.

The person who referred you can see that somebody signed up through their link. They can see your name only if you say so. They are paid a share of what you pay us for as long as you stay, so they can see enough to check they are being paid correctly. That is the whole reason they can see anything at all.

What they see whether or not you agree

• That somebody signed up through their link, and on what date.
• Which plan it is, and whether it is still running.
• The date the subscription started paying.

What they see only if you agree

When you sign up through somebody's link we tell you who sent you and ask whether we may give them your first name. If you say yes, that is what they see, and nothing more. If you say nothing, or say no, they see the referral without a name and we do not ask again.

We never show them a brand. Not its website, not its name, not how many you have. An earlier draft of this policy offered the website of the brand you onboarded, and it was withdrawn before this page was ever published, for a reason worth stating: a workspace can hold several brands, and if you are an agency those brands are your clients rather than you. You cannot consent on their behalf and we will not ask you to.

Exactly what they do not see

• Your email address, your surname, or any other contact detail.
• Anything you design, write, upload or export. They never see your work.
• Your card, your invoices, or the amounts on them.
• Anybody else's referral. A referrer sees only their own.

Changing your mind

You can withdraw at any time and we will hide your name from them again. Your referrer keeps being paid, because that is between us and them and does not depend on them being able to see who you are. Ask from your account settings or by writing to hello@r10n.app and we will do it without asking why.

Your name is shown on the basis of your consent, which is why we ask rather than assume, and withdrawing it is as easy as giving it. The referral itself, without your name, we record on the basis of our legitimate interest in running the program and paying the people in it, and you can object to that under Your rights.

If you never sign up

When somebody follows a referral link we record which link it was and when, so that the referrer can be paid and can see whether their audience is arriving. We keep no name, no account and no advertising profile, and we do not use it to build one. We do not record the page you came from. We store a one way fingerprint built from your network and browser rather than any address itself, so that repeat visits from one person are not counted as several, and we delete it after ninety days whether or not an account was ever created.

This section applies to accounts created on or after September 17, 2026. Anybody who signed up before it is not shown to a referrer by name, because they were not told they would be.

6.Who else touches your data

These are the companies we use to run R10N, and what each one receives. We do not sell your data to anybody, and nobody on this list is an advertiser or a data broker.

One more, worth naming because it is a request from your device rather than from ours: our own notification emails, such as an invite, load a webfont from Google Fonts when the recipient opens them, so the recipient's mail client contacts Google. The emails youdesign do not do this. We copy your brand's fonts into our own storage and point your exported email at those, precisely so your recipients are not calling out to a font host.

This table is the complete list as of the date at the top of this page. When we add a company that receives your content, we update it and tell account owners by email, as described in Changes to this policy.

7.Payments

We use Stripe. When you subscribe or buy credits we send you to a page hosted by Stripe, and when you manage your plan we send you to Stripe's billing portal. Your card number, expiry and security code are entered on Stripe's pages and are never sent to, seen by or stored on our servers.

What we keep is the record of the transaction: your Stripe customer and subscription identifiers, your plan, your subscription status, and the amount, currency, status and period of each invoice, refund and chargeback.

8.Where your data goes

R10N is not run from one country. The application is served from the United States, our rendering and design engine runs in Belgium, and our other providers operate in the United States and elsewhere. Using R10N therefore involves transferring your data internationally, including outside the United Kingdom and the European Economic Area.

We are a United States company, and our database and file storage are hosted in the United States (Oregon).

9.How long we keep it, and what deletion actually removes

We would rather be exact than reassuring, so this section says what the software does today, including where it falls short of what it should do.

While your workspace is open

We keep your brand kits, emails, chats and images for as long as your workspace exists, because they are the work you came here to do and you will want them next month. Deleting a project or an image inside the app hides it and marks it deleted rather than erasing it immediately.

• An invite expires seven days after it is sent if nobody accepts it.
• A share link you create does not expire unless you give it a date, so that an email you sent to somebody does not turn into a dead link. You can revoke one at any time.
• An attached file carries a date thirty days out, recorded when you upload it and intended as its life expectancy. We should be honest that nothing currently acts on that date, so an attachment persists until the workspace is closed or we remove it on request. This is a gap we are closing.
• Administrative audit records are kept permanently and on purpose. Deleting the record of who deleted an account would make that question unanswerable at exactly the moment it matters. Such a record holds the actor, the action, the time and the workspace identifier, never your content.

When you close your workspace

An owner can close a workspace from inside the app. It requires canceling your plan first, so we cannot destroy your data and keep charging you, and it requires typing the workspace name, because there is no undo. Closing it removes the database records across every table that belongs to the workspace, and it deletes the login of anybody left with no other workspace. An audit record of the closure survives, as described above.

It also removes the files stored for the workspace: the images it generated or uploaded and the files attached to its briefs. An image is kept only if another workspace is using the very same file, and then it is kept for that workspace's sake. Font files are stored once and shared by every brand that uses the same typeface, so they are not removed; a font file is a copy of a publicly available font and holds nothing about you.

We keep your billing records for seven years. Tax and accounting law requires it. Before a workspace is deleted we copy its subscription, invoices, refunds, chargebacks and purchased credits, with their Stripe identifiers and the workspace's name, into a separate record that we keep for seven years after the closure and then delete. Nothing else in the workspace is kept with it, nobody can see it from inside the app, and we use it for nothing except meeting those obligations. If that copy cannot be made, the workspace is not closed and nothing is deleted. Stripe also keeps its own record of every payment you made, under its own retention rules.

Emails you have already exported

When you export an email, the sliced images are published so that a mail client anywhere in the world can load them. Those files are permanent and are meant to be: if they disappeared, every email you had already sent would break. See Security for what that means for access.

Our database provider keeps rolling daily backups for a short period set by its plan, after which a deleted record is gone from the backups too. Stored image files are not part of those backups.

10.Your rights, and how to use them

If you are in the United Kingdom or the European Economic Area you have the right to ask for a copy of your personal data, to correct it, to have it deleted, to receive it in a portable form, to restrict or object to how we use it, and to withdraw consent where we relied on it. Similar rights exist in other places.

• Correct it yourself. Your brand kit, your emails and your workspace name are all editable in the app.
• Take your work with you. Every email can be downloaded as an image, and exported as the sliced and linked version that goes into a sending platform, at any time and without asking us.
• Delete it. An owner can close the workspace from inside the app. Read How long we keep it first, because it says exactly what that removes and the billing records we have to keep.
• Everything else. Write to hello@r10n.app. There is no self-serve button that exports your whole account as a file yet, so an access or portability request is handled by a person.

We do not charge for this and we will not ask you why. We answer within 30 days.

If you think we have handled your data badly, tell us first and we will try to fix it. You can also complain to a data protection regulator. If you are in the UK, that is the Information Commissioner's Office; in the EU, the authority in your country.

11.How we protect it

Here is what is actually in place. We hold no security certification, and we are not going to imply one by listing standards we have not been audited against.

• Separation between workspaces is enforced by the database, not by our code. Every table carrying customer data has row level security switched on, and the rule is the same on all of them: you can reach a row only if you are a member of the workspace it belongs to. A mistake in a query cannot leak another customer's row, because the database refuses to return it.
• The privileged key never reaches the browser. The application talks to the database as you, with your own limited credentials. The administrative key that can bypass those rules exists only on the server, and the tables that must never be customer-writable, such as the credit ledger and stored integration credentials, are reachable only through it.
• Connected platform credentials are encrypted. If you connect Klaviyo, Omnisend or Mailchimp, the token that can read your marketing account is sealed with AES-256-GCM before it is stored, with the key held outside the database, and each sealed value is bound to the exact row and column it belongs to so a copied ciphertext will not open.
• Secrets in links are stored only as hashes. Invite links and share links are long random tokens, and we keep only their SHA-256 hash. A copy of our database hands over no working links.
• Transport and browser hardening. HTTPS only, with strict transport security for a year including subdomains. We refuse to be framed by another site, we tell browsers not to guess content types, we do not leak our URL paths to other sites in the referrer header, and we switch off camera, microphone, location and browser payment access.
• Staff access is restricted and recorded. When a member of our team looks at a workspace to help with a problem, that session is read-only and cannot write anything, and significant administrative actions are written to an audit record.

Two limits we would rather state than have you discover. We do not yet set a content security policy on the application, because the email previews inside it would inherit it and a policy loose enough to permit every brand's fonts and images would be protection in name only. And the images that make up a finished email are served without a login, because a recipient's mail client has no login: they sit at long unguessable addresses derived from the file contents. Anyone holding such an address can fetch that image. Treat a share link, and an exported email, as public.

Our database and file storage provider encrypts everything it stores (AES-256) and everything in transit to it (TLS).

12.Emails we send you

We send two kinds of email. The ones you need to use your account: sign-in links, invites, billing, and notices about your work. And automated ones, such as a short welcome series when you sign up, which stops once you subscribe to a plan.

Our automated emails contain a small picture and links that pass through r10n.app, so we can see whether each one was opened and which link was clicked. For each email we record the time and whether the open was made by a person or automatically by a mail app (Apple Mail loads every picture in every email by itself). We record no IP address, no device and no browser. Our email provider tells us whether it was delivered, bounced or reported as spam. We use this only to learn which of our emails are useful.

Every automated email has an unsubscribe link, and a one-click unsubscribe your mail app can show beside our name. Unsubscribing stops them for good. Reporting one as spam stops them too. Neither affects the emails you need to use your account, which carry no tracking picture and whose links are left exactly as they are.

13.Cookies

We set no advertising cookies and no third-party tracking cookies. There are six first-party ones, and five of them exist only when they have a job to do.

• Session cookies. Set by our authentication provider when you sign in, so that you stay signed in. Without these the app cannot work.
• An attribution cookie. If you arrive through a link or a QR code we hand out at an event, we set a cookie for twelve hours recording which campaign and which member of our team it was, so that when you create an account a minute or an hour later we know where you came from. It holds a campaign name and a first name, nothing about you, no script can read it, and it is stamped onto your account once and then never updated.
• A referral cookie.If you arrive through a creator's or partner's referral link, we set a cookie for sixty days holding which link it was and when you followed it, so that the person who sent you is credited if you sign up within that time. It holds nothing about you, no script can read it, and the first link you followed is the one that counts. See If somebody referred you.
• Connection cookies. While you connect Klaviyo, Omnisend or Mailchimp, short-lived cookies carry the security state of that handshake.
• A support cookie.Set only on our own team's browsers, when a member of staff is viewing a workspace to help with a problem. It is what makes that session read-only.
• An affiliate dashboard cookie. Set only for people in our referral program, when they sign in to their own dashboard, which is separate from the app. It keeps them signed in for up to thirty days.

We do not show a cookie banner today.

14.The people your emails go to

R10N never sends to your list from its own servers. When you send or schedule an email from R10N, the campaign is created in your own Klaviyo, Omnisend or Mailchimp account and that platform delivers it, so your subscriber list, your deliverability and your reporting stay there. We do not hold your subscribers, we do not import them, and we never see which of them opened what. The only email R10N sends itself is a test of your design, to an address you type in.

What we read about your audiences is small, and it is never the people in them. If you connect Klaviyo or Mailchimp and pick an audience, we ask that platform how many people the list, segment or audience contains, so a plan can say who it is for. Omnisend gives us segment names only. We do not retrieve the profiles themselves.

For each campaign R10N made, we also read which lists and segments it was sent to and which it was kept from: their names, how many people each holds and, where your platform shows it, the rule that defines a segment, such as “opened an email in the last 30 days”. Our team uses this to check that an email reached the audience it was meant for. We read it only for campaigns R10N made, the check changes nothing in your account, and it never reads who is in a list or segment.

We also read how each email R10N made did once it went out: the totals the platform reports for that campaign, such as how many it reached, opened, clicked and bought, and the sales it credits to the email. These are counts for the whole campaign, never which person did what. To recognize a template you send later from your own platform, we look in your sent campaigns for the pictures R10N hosted for it, and read nothing else of a campaign that has none of them.

We may publish figures added together across all our customers, such as how many people R10N emails have reached in total. Those never name you, and never show your figures on their own. We would only ever name you or quote your results with your permission.

If you paste personal data about other people into a brief, a chat or an attachment, you are responsible for having the right to do so, and it will be sent to our model providers along with the rest of the brief. Please do not put anything there that you would not want processed that way.

15.Children

R10N is a business tool sold to businesses. It is not designed for or directed at children, and we do not knowingly collect information about them. If you believe a child has created an account, write to hello@r10n.app and we will remove it.

Accounts are for people aged 18 and over. Nothing in the product checks an age.

16.Changes to this policy

When we change how the product handles data we will update this page and change the date at the top of it. If a change is significant, for example a new sub-processor receiving your content, we will tell account owners by email rather than expecting anybody to notice a quiet edit.

We give account owners 30 days' notice by email before a significant change takes effect, and we will send you an earlier version of this policy if you ask for it.

17.Contact

Write to hello@r10n.app about anything on this page, including a request to see, correct, export or delete your data. A person reads it.

Formal notices can also be sent by mail to Kracked Retention Inc, 3345 Thorpe Road, Nashville, Tennessee 37207, United States.