← All articles
What a cart recovery app should do with your shoppers' data — a merchant's checklist
21 July 2026 · 3 min read
A cart recovery app necessarily touches personal data: shopper emails, names, what they almost bought. Most app listings say "GDPR compliant" and leave it there. As the merchant, you're the data controller — so it's worth asking any vendor (including us) the questions below.
The checklist
- Is shopper PII encrypted at rest — at the application layer? Database-level disk encryption protects against a stolen disk, not a leaked database. App-layer encryption means a database dump alone exposes nothing. Cartback encrypts emails and names with AES-256-GCM above the database's own encryption, and looks them up via keyed hashes.
- What does it collect at all? Less is safer. Cartback never stores payment details, addresses or phone numbers — only what recovery actually needs.
- How long is data kept? Cart records should expire automatically. Cartback purges them after a limited retention window — and deletes everything the moment you uninstall.
- Are the GDPR webhooks real? Shopify sends data-request, customer-redact and shop-redact webhooks. An app must honor all three; Cartback does, automatically.
- Is consent respected? Reminders should be consent-aware, and every email must carry a working unsubscribe that is honored promptly. Unsubscribes in Cartback are global suppressions stored as hashes — no raw address sits in a do-not-contact list.
- What lands in the logs? Application logs are a commonly overlooked leak surface. Cartback's logs mask every email address.
- Who else sees the data? Ask for the sub-processor list. Ours is short: Shopify (source of truth), our hosting and database (EU region), and the email delivery provider. Nothing is ever sold or shared beyond that.
- Does the vendor publish any of this? If security claims only exist in a sales deck, treat them as absent. Ours are in the privacy & security policy — the same one shoppers see.
Why we lead with this
Trust is the actual product in cart recovery: shoppers hand your checkout an email, and you hand it to an app. We built Cartback security-first because a recovered cart is never worth a leaked inbox — and because merchants increasingly (rightly) ask these questions before installing anything.
More from the blog