Data and safety

Counts, not customer lists

Walkoff works from counts, not customer lists. When Claude sets your brand up from Shopify, it reads counts by postal code from Shopify's analytics: a country, a postal code or state, and a number of customers. Walkoff cuts each postal code to its area as it arrives, keeps the area and the count, and lets go of the rest. It never asks for names, emails or addresses, and it refuses rows that hold them. What Walkoff sees from Shopify

Not on Shopify? Your browser turns each export into customers, orders and revenue per postal area before anything is sent, and Walkoff refuses anything finer. What leaves your browser

So Walkoff never has your customers' names, emails or addresses, and there's no customer list to leak. Klaviyo, which already has your list, does the sending.

Your products come from your store's public product feed, or your product file: product details only. Claude reads those details, through Anthropic's API, to tag your catalog. No customer data goes with them.

Brands are walled off

Each brand's data is walled off from every other brand's. You see only the brands you were invited to, and only the ones you picked when you signed in. Every tool checks this on every request.

Your upload link

Your upload link is for stores not on Shopify, and it's private to your brand. Anyone with it can upload files for your brand and see your fan map. Walkoff sends it only to the people invited to your brand, in their welcome email.

• Keep it within your team, and don't post it anywhere public.
• If someone leaves, ask your Walkoff contact to replace it. The old link stops working, and everyone who should keep uploading gets the new one.

Sign-in and tokens

Walkoff doesn't use passwords. You sign in with a code emailed to your work address, and only invited addresses get one.

Walkoff keeps only hashed tokens, never the tokens themselves. Access lasts a day at a time and renews by itself. A sign-in you haven't used in 90 days ends.

When someone is removed from a brand, it takes effect on their next request.

Approval first

Walkoff never sends anything. It builds the campaign, Claude drafts it in your Klaviyo account, and it goes out only when you say so. Walkoff tells Claude never to schedule or send without your go-ahead, and to ask before it creates a segment.

Your Klaviyo settings stay as they are: unsubscribes, suppressions and Smart Sending all apply. Triggers fill your queue. They don't send.

Team names and licenses

Walkoff isn't affiliated with any league, team or player. When we set up your brand, we note whether you're licensed to use your teams' names and marks. Most brands aren't.

Without a license, campaign copy never names a team, league, player, stadium or event, and never implies an endorsement. It nods with the colors, and the city for pro teams, through your own products. The copy rules

Walkoff's rules lower the risk but aren't legal advice.

Athletes

Walkoff keeps public facts about the athletes it follows: their team, position and where they're from, from ESPN, Wikipedia, Wikidata and our own research. No birth dates, ages or photos.

When you ask Claude which athletes are from near your customers, you see their names. Those are for you. Campaign copy never names or describes an athlete: no name, number, position, school or photo. The one exception is an athlete who agreed in writing that your brand may name them, with the agreement on file with Walkoff.

Athletes can ask what Walkoff keeps about them, correct where they're from, or ask Walkoff to stop using them, at hello@walkoff.io. When one does, Walkoff takes back the moments about them that are still in your queue. Privacy Policy