Klaviyo is a B2C marketing-automation and customer-data platform ('Klaviyo Data Platform') operated by Klaviyo, Inc., a Delaware corporation headquartered in Boston, Massachusetts and publicly traded on the NYSE (KVYO). Its 10-K describes the platform as consolidating retailers'/businesses' first-party consumer data — profiles, events, purchase and engagement history — from over 350 third-party integrations into a single unified consumer record used by roughly 193,000 business customers; it is a B2B data processor, so the end consumers whose data it processes are not Klaviyo's own users. Klaviyo's public Trust Center lists a broad vendor/subprocessor roster including major cloud and AI providers (Amazon, Microsoft, Google-adjacent, OpenAI, Anthropic, Cloudflare) and, notably, Meta as a named vendor, and separately lists a 'Klaviyo 2025 Type 2 SOC 2' document as an available compliance artifact, though the auditing firm's name could not be confirmed and the report itself was not reviewed. Klaviyo's own mobile admin app declares no App Store 'Data Used to Track You' category. The company's consumer-facing marketing site (klaviyo.com) is a fully client-rendered single-page app that returns only a JavaScript-shell page, so its published privacy policy text could not be fetched and no claim cites it here. No breach, FTC action, or litigation judgment was found in the 10-K beyond standard privacy-law risk-factor boilerplate (GDPR/CCPA compliance obligations), so no incident claim is made.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
[2026-02-01] · COLLECTION
Klaviyo's 10-K states its Klaviyo Data Platform is used by roughly 193,000 businesses to turn real-time consumer data into personalized experiences, and that its 'customer data store' consolidates customers' first-party data at scale, synchronizing and unifying data from over 350 integrations into a single system-of-record covering the complete history of consumer profile and event data.
Klaviyo's 10-K states the company was incorporated in Delaware in 2012 as Klaviyo, Inc., is headquartered at 125 Summer Street, Boston, MA, and that its Series A common stock is registered on the New York Stock Exchange under the ticker symbol KVYO.
Klaviyo's own public Trust Center (trust.klaviyo.com) lists a 'Subprocessors' section among its published document categories, and its embedded vendor roster names Meta as a Vendor-type entry alongside major cloud and AI infrastructure providers, indicating Meta is disclosed among the third parties Klaviyo works with.
Klaviyo's own public Trust Center lists a published document titled 'Klaviyo 2025 Type 2 SOC 2', dated September 2025, among its compliance artifacts, indicating an independent SOC 2 Type II audit was completed and made available to prospective customers; the auditing firm's name could not be confirmed from the publicly accessible page in this research.
Klaviyo's 10-K risk factors disclose that the company is subject to GDPR, UK GDPR and the California Consumer Privacy Act (CCPA), including obligations around personal-data processing, access/deletion rights, and disclosure of how personal information is used and shared, framed as ongoing compliance exposure rather than a specific past incident.
The App Store privacy label for Klaviyo's own business/admin mobile app ('Klaviyo - K:LDN', seller Klaviyo, Inc.) declares no 'Data Used to Track You' category; data linked to identity is limited to identifiers/usage data for the developer's own advertising, analytics, product personalization and app functionality, plus contact info (email, name) for app functionality.