cartback — Privacy & security

cartback helps Shopify merchants recover abandoned carts by sending timed reminder emails and web push notifications. This policy explains what we process, how we protect it, and your rights.

Data we process

• Abandoned checkout details: shopper email, name, cart contents, and recovery URL.
• Marketing consent captured at checkout.
• Store catalog metadata (product titles/types) used to configure send timing.
• Send and recovery outcomes used to improve timing for the store.

We do not collect payment details, addresses, or phone numbers. We never sell personal data.

Note on the App Store's data-access disclosure: Shopify lists every field an app's API permissions could technically read (which may include phone number, IP address, or browser details). Access is not collection — regardless of what the API exposes, cartback only stores the data listed above.

How we protect it

• Shopper email addresses are encrypted at rest (AES-256-GCM) at the application layer, on top of database-level encryption. Lookups use a keyed hash, so a database dump alone never exposes an address.
• All data is transmitted over TLS (HTTPS).
• Suppression (do-not-contact) records store a hashed identifier only — no raw email.
• Access is scoped per store; secrets are held in an encrypted secret store, never in code.
• Application logs never contain raw email addresses.

Retention & deletion

Cart records are deleted automatically after a limited retention period and immediately on app uninstall. We honor Shopify’s GDPR data-request, customer-redact, and shop-redact webhooks. Shoppers can unsubscribe from any email via the link it contains, or via a browser’s notification settings for web push.

Sub-processors

We share the minimum necessary data with:

• Shopify — the platform your store runs on.
• Resend — email delivery.
• Anthropic — store classification (catalog metadata only; never shopper personal data).
• Vercel and Neon — application hosting and database.

Roles under GDPR

For shopper personal data, the merchant (the store you purchased from) is the data controller and cartback acts as a data processor on the merchant’s behalf. We process shopper data only to deliver cart-recovery reminders for that store, never for our own marketing, profiling, or resale. A data processing addendum is available to merchants on request.

Your rights

Under the GDPR and similar laws you can request access to, correction of, or deletion of your personal data, object to or restrict its processing, and receive a copy of it. As a shopper, the fastest route is contacting the store you bought from — deletion and export requests made there flow to us automatically via Shopify’s compliance webhooks. You can also contact us directly and we will handle or forward the request. Every reminder email contains a one-click unsubscribe; web push can be disabled in your browser’s notification settings.

Contact

support@cartback.shop — Pálinkás András E.V., Petőfi utca 6, 7668 Keszü, Hungary (tax ID: 55597096-1-22)