Privacy notice

Synapse Retention — last updated 14 October 2026. See also the crawler page.

This notice covers two activities: a crawler that reads public storefront pages, and a research subscription to brands' own marketing mailing lists. Neither is aimed at individuals, and both are described here in full because a notice that omits the second would be the more convenient half of the truth.

If one of our addresses is on your list

Addresses ending in @in.storeretention.com are ours. We used them for one thing: subscribing to brands' mailing lists so that we can read what the brands send.

To have one removed, reply to any email we have sent you, or email bot@storeretention.com with your domain. It is off your list within 48 hours. If our address has never received an email from you, delete it from your list; we won't add it back. No reason is required. The details are under How to be removed.

Who we are

storeretention.com, its addresses and the RetentionBench crawler belong to Synapse Retention (synapseretention.com). For the personal data described here, the controller is Mohamed Hamed and Mohamed Belal, who run Synapse Retention. Synapse Retention's privacy notice names the same controller. Contact: bot@storeretention.com. That address is monitored and is also the exclusion route.

1. The crawler

We fetch publicly available pages from Shopify storefronts — the homepage, the public product listing, and public DNS records for the domain — and record technical facts about them.

We do not collect personal data through the crawler. We do not read customer reviews for names, we do not scrape staff or contact pages for individuals, and we do not attempt to identify anybody. Where a business address or a generic company address appears in a page we have fetched, it is incidental and is not extracted into any field.

Legal basis: legitimate interest (Article 6(1)(f) UK/EU GDPR) — the legitimate interest being market research into publicly published business practices, and identifying businesses that may want our services. We consider this proportionate because the data is published by businesses about themselves, the volume per site is small, robots.txt is obeyed before any other request, and opting out is free, immediate and permanent.

2. Mailing-list research

Between September and early October 2026 we subscribed to brands' marketing mailing lists using our own addresses at in.storeretention.com, and we record the emails those brands send us. This is how we study how brands' email marketing is built and how it changes over the year. Since 7 October 2026, we only join a list with the brand’s permission. Lists we joined before then, we stay on until the brand asks us to leave. With a brand’s permission, our addresses join its list for our email checks. We make a teardown only when a brand asks for its own. It uses only the emails we already hold, and public data.

• The only personal data involved is our own. The subscriber is us; the address is ours; the name given is the operator's.
• We record what the brand sent, when it arrived, and its authentication results.
• We don’t open images or click links in the emails we receive, apart from the one link that confirmed our subscription, for brands whose list asked for it. When a brand asks us to leave its list, we use the one-click unsubscribe its emails carry.
• We do not purchase. We stay subscribed to see how a brand’s mail changes over time, and unsubscribe within 48 hours when a brand asks us to leave its list.
• We do not republish brands' creative. What we share with our customers, the agencies and brands we work with, is what we found and short quotations, such as a subject line or a sentence: never a whole email.

Marketing emails we receive may contain a sender's name — a founder signing their own newsletter, for instance. We do not extract, index, or build profiles of those people, and they are not the subject of any analysis.

Legal basis: legitimate interest, as above. Where any personal data appears incidentally in a received email, the interest is research into business marketing practice, and the data is not used to make any decision about the individual.

What we never do

• We do not sell data to anybody.
• We do not send sales or marketing email to brands or their staff, and we keep no lists of their contact details: the ones we held were deleted on 7 October 2026.
• We do not build profiles of individuals.
• We do not collect special-category data.
• We do not use automated decision-making that produces legal or similarly significant effects on a person.
• We do not collect payment details, and we never ask for a password. When a brand connects its Klaviyo account, we hold the keys Klaviyo gives us to read it, stored encrypted.

Retention

Crawl records and captured emails are kept while the research is active. When a domain is excluded, we stop immediately; see below for what is deleted.

Who else sees it

Data is held on servers we control and with these processors:

• Cloudflare, which serves this website and forwards mail sent to bot@storeretention.com.
• Amazon Web Services, which receives the mail sent to our addresses (us-east-1).
• DigitalOcean, which hosts the servers the crawler and the mailing-list research run on.
• Google, which hosts our own email, such as hello@synapseretention.com. We also use its Docs for teardowns, and for reports when someone asks for a Doc.
• Anthropic, whose software we use to run our systems. The personal data described here, including the emails we receive, may be processed with it.
• GitHub, which stores our code and our working notes. They can include customers’ contact details, and emails we received.

Nothing is sold. Data is processed in the United States; transfers rely on the providers' standard contractual clauses.

Cloudflare, which delivers this site, sets one security cookie, cf_clearance, to tell people apart from automated traffic. It isn’t used for advertising or analytics, and we set no cookies of our own.

How to be removed

Reply to any email we have sent you, or email bot@storeretention.com with the domain. No reason is required and we will not ask for one.

• Within 48 hours our address is off your list and the domain is on our exclusion list. The list is checked before any request to a host, including before robots.txt, so the exclusion takes effect on first contact.
• If our address has never received an email from you, delete it from your list; we won't add it back.
• Exclusion covers the whole registrable domain, including every subdomain.
• It is permanent. The list is version-controlled, so a removal cannot be quietly reversed later.

On request we will also delete the records already collected for that domain, and confirm when it is done.

Your rights

Where we hold personal data about you, you have the right to access it, to have it corrected or erased, to restrict or object to processing, and to data portability. Because our processing is based on legitimate interest, you have the right to object at any time — and for the crawler and the mailing-list research, an exclusion request is that objection and we act on it without asking you to justify it.

You can complain to the data protection authority where you live or work, or where we’re based: Hungary’s NAIH or the UK’s ICO.

Changes

If this notice changes materially, the date at the top changes with it.