Who owns your email list?What Mailchimp, Klaviyo, Kit and beehiiv terms actually say, checked 2026.

This page quotes the current terms of four platforms creators and small teams actually use. Terms change; every quote carries the document's own "last updated" date and the day I read it. If you are on a different platform, the checklist at the end tells you which clauses to look for.

Read the last two rows of each provider together. The right to terminate without notice plus no obligation to keep your data afterwards means the export you did last month is the list you own. The one in the platform is the list you are allowed to use today.

These are anonymised sentences from people who wrote publicly about it in the last two months. None of them had done anything they knew to be wrong.

• "Suspended, no explanation." The most common shape: a login that fails, an email that says a policy was violated, no line saying which one.
• "Compliance hold and nobody will say why or for how long." The list is intact and unreachable; the scheduled send did not go out.
• "Paid $356, then suspended within hours." Money taken, account closed, support reply pending.
• "They disabled the whole account over one compromised API key." A developer's key leaked; every sender on the account stopped, including password resets.

In each case the list was, contractually, the customer's. What they lacked was a copy, the consent records to mail it from anywhere else, and a sending path that did not run through the account that had just been closed.

Three distinct things hide under "we may use your data", and they are worth separating because only one of them should worry you.

• Aggregated, anonymised product analytics. Every platform does this (Klaviyo's "Derived Data", Kit's "Anonymized Data", beehiiv's "aggregate and anonymized manner"). Your subscribers are not identifiable in it. Normal.
• A licence to your actual data for machine learning. Mailchimp's beta and AI features, since August 2024: inputs and outputs including Customer Data, licensed to Mailchimp and to OpenAI, irrevocably, with an opt-out in settings. This is the clause to read before switching on an AI feature. Klaviyo, by contrast, states it will not use Customer Data to train third-party foundation models.
• Your subscribers as an audience for someone else. beehiiv's ad network builds subscriber profiles across publications and enriches them from third-party providers. The data stays anonymised to advertisers by the terms, but it is your readers' behaviour funding the network, and it is a reason some publishers leave.

A list is not a CSV of addresses. Owning it means holding five things at once, and the platform usually holds three of them.

Number 2 is the one people forget. Addresses without a consent record are, in most jurisdictions, a list you cannot lawfully mail from a new platform. Number 3 is the one that protects your reputation: re-mailing someone who unsubscribed on the old platform is the fastest way to a complaint rate that gets the new one suspended too.

1. Export the list monthly, with everything. Address, fields, list membership, status, consent source and date, unsubscribe and complaint history. Store it somewhere the platform cannot reach.
2. Send from your own domain, never theirs. Reputation attaches to the domain and its DKIM keys. A shared platform domain is theirs to keep when you go.
3. Read the termination clause once. Find "without notice", "without cause", and what happens to data after termination. Klaviyo and beehiiv both say they need not keep it.
4. Check the AI clause before turning on an AI feature. If it licenses your Customer Data to a third party, decide with your eyes open and use the opt-out if there is one.
5. Keep a second sending path. Your own AWS account with a verified domain, or a second provider you have warmed, so a suspension is an inconvenience rather than an outage.
6. Test the restore. Once a quarter, import last month's export somewhere else and confirm suppressed addresses stay suppressed.

SendBunny is built so that all five parts sit in an account you administer: a complete email platform installed into your own AWS account as a CloudFormation stack, with campaigns, lists, templates, a transactional API, a shared inbox and an MCP server for AI agents. Your contacts, consent fields and the account-wide suppression list live in your AWS account and region; it sends through your own Amazon SES at Amazon's price; unlimited contacts with no per-contact fee; $199 one time. There is no vendor-side kill switch. AWS still controls SES, and production access is AWS's decision. Not for you if you will not run an AWS account, or if you need double opt-in or a hosted signup form today (CSV import and the API add contacts; there is no hosted form).