We collect account email, organization and membership, templates, render metadata, a 90-day anonymous id with first-touch and latest-touch campaign fields (no email or raw query string), and (if you opt in) hashed payload shapes — not raw variable values. Test Inbox HTML/text expires in 7 days. We never store OAuth provider access tokens. API keys and session tokens are stored as SHA-256 hashes only.
Processors and windows are listed under subprocessors and retention. A DPA can be requested from data processing.
Questions: admin@bytelon.com.