Independent listing assessment
Klaviyo: Email Marketing & SMS
Klaviyo's Klaviyo: Email Marketing & SMS asks for 6 write permissions and reads shoppers' name, email address, phone number, and physical address. Rated 4.7 from 3,371 reviews. Kairo's independent security audit: higher risk, 39/100.
Higher risk
This assessment uses public listing information. It does not inspect source code, test an installation, or verify a vulnerability. A higher score means lower risk under this model, not a security certification.
Data access and permissions
What the app is allowed to read and change once installed, as declared on its App Store listing.
Reads shoppers' contact details beyond email
The app can read name, email address, phone number, and physical address for your customers. Phone number and physical address are the details a leak turns into a real-world problem — make sure the app's job needs them.
Tracks shopper devices and behaviour
The app collects geolocation, ip address, browser and operating system, browsing behavior, and client id cookie. That is a tracking footprint on your storefront, which your cookie consent and privacy notice need to cover.
Reads staff and store-owner details
The developer receives name, email address, phone number, physical address, ip address, and browser and operating system for your staff. Ordinary for an app that needs to email the owner; worth knowing when it includes a physical address.
Can change 6 areas of your store
Write access to customers, orders, discounts, store analytics, Online Store, and other data. Every one of these is something the app — or anyone who compromises it — can alter without asking you.
Edit orders: the app can create and change orders
Declared as "Edit orders" covering all order history, order edits. The app can create and change orders, including what was paid and where it ships. Check what it actually installs after setup, and again after you uninstall it.
Edit Online Store: the app can change your theme and storefront pages
Declared as "Edit Online Store" covering online store pages, online store script tags, theme, online store page content on a path controlled by the app. The app can change your theme and storefront pages, which is where a compromised app puts code in front of every shopper. Check what it actually installs after setup, and again after you uninstall it.
Reads your full order history
Orders carry customer names, addresses and what they bought. "Edit orders" covers all order history, order edits.
Privacy policy published and reachable
The developer's privacy policy at klaviyo.com answers. Read it for retention and sub-processors.
Developer reputation
How long the developer has been accountable on the App Store, and what Shopify says about them.
On the App Store since 2012
14 years listed. An app that has stayed on the store this long has been through Shopify's reviews and its merchants' complaints many times over.
Not Built for Shopify
The app has not earned Shopify's Built for Shopify badge. Many sound apps have not; it means only that Shopify has not vouched for it beyond listing it.
Publishes 2 apps on the App Store
Klaviyo maintains 1 other app averaging 4.8 stars: Klaviyo: Product Reviews .
Developer website: developers.klaviyo.com
A public company behind the app, with somewhere to go when support inside the app fails.
Business address listed
Registered at 125 Summer St, Floor 7, Boston, MA, 02111, US. A developer with a fixed address is one a data-protection request can actually reach.
What merchants report
The App Store's ratings, and what the critical reviews say — with the developer's replies to them.
Rated 4.7 from 3,371 reviews
A high rating over many reviews is hard to fake and slow to build.
8% of ratings are one star
A visible minority of merchants left angry. The critical reviews below say why.
Developer answers critical reviews
Replied to 10 of the 10 most recent one- and two-star reviews. A developer who answers in public is one who will answer you.
Critical reviews mention leftover code after uninstall
1 of the 10 most recent one- and two-star reviews touch on it. Quoted below, with the developer's reply where there is one.
Developer and listing
Free to install
Merchant ratings and concerns
Merchant comments are individual reports, not independently verified incidents. Follow the original review for its full context and any developer reply.
Leftover code after uninstall
i have already uninstalled the app, it is still charging my company card for service fee
Luna Skin · June 28, 2026 · 1/5 · Developer replied
How this score is calculated
Neo reads the app's public listing on the Shopify App Store — the data-access section the developer declares, the developer panel, the ratings, and the most recent one- and two-star reviews — and applies the same rules to every app. The score starts at 70, adds 5 for each good sign, and takes 3 for each thing worth knowing and 12 for each thing to weigh.
This assessment uses public listing information. It does not inspect source code, test an installation, or verify a vulnerability. A higher score means lower risk under this model, not a security certification.