Privacy
What the audit reads, keeps, and deletes.
Written plainly, because the whole product is a promise about what happens to your data. Last updated 28 September 2026.
Who
Growth Legend, LLC, Scottsdale, Arizona. The practice of Andrew Lauchner. Contact: andrew@growthlegend.com.
The Klaviyo key
You paste a private API key that you created as read-only. It is sent once over HTTPS to our server, used to read your account for this one audit, and discarded when the audit finishes. It is not written to a database, a log, or a file. Our error logs strip anything that looks like a key. We ask for a read-only key so that even in the worst case nothing could be sent, changed, or exported with it. You can revoke it in Klaviyo (Settings → API keys) as soon as the report appears; the report does not depend on it.
What is read
Account name and settings; the list of metrics; aggregate order counts and values by month, by attributed channel and by flow; the list of flows and the structure of live flows (triggers, delays, message names and subject lines); ninety days of flow and campaign performance statistics; the campaigns sent in the last ninety days (names, subjects, audiences, settings); lists and segments (names, definitions, and profile counts for a few); sign-up forms and their ninety-day statistics. No customer profile, email address, phone number, or event belonging to an individual customer is ever requested.
What is kept
The finished report (the numbers above, summarised, plus the findings), the work email you entered, the brand name, and the date. That is all. The report is stored in a private store under an unguessable link, and the email is added to Growth Legend's list of people who ran an audit so Andrew can reply to questions and, occasionally, send something useful. Every email has an unsubscribe link. Nothing is sold or shared with anyone else, and no advertising or third-party analytics run on this site.
How long
Reports are deleted 90 days after they are created. Your email stays on the list until you unsubscribe or ask for it to be removed.
Deleting sooner
Email andrew@growthlegend.com from the address you used, with the report link if you have it. The report and your email are deleted within two business days.
Cookies and tracking
The site sets no cookies and loads no trackers. Fonts are loaded from Google Fonts, which sees your IP address when they load. The site is hosted on Vercel, which keeps standard server logs (IP address, time, page) for a short period for security.
Klaviyo
Klaviyo is a trademark of Klaviyo, Inc. Growth Legend is not affiliated with or endorsed by Klaviyo. Using the audit is subject to your own agreement with Klaviyo, including the terms that govern API keys; you confirm before running it that you are authorized to connect the account.
Changes
If this note changes, the date at the top changes with it. Changes never apply backwards to a report you have already run.