Privacy Policy

The controller of personal data described in this policy is the administrator of the cartabandon.com service ("we", "us"). You can reach us about any privacy matter at support@cartabandon.com. We answer every request in writing.

CartAbandon is a tool that online stores use to recover lost sales. Because of that, we handle two kinds of personal data, and our role is different for each.

Controller for merchant account data

When a store owner or a member of their team creates an account, buys a plan or writes to support, we decide why and how that data is used. For this data we are the controller.

Processor for shopper data

Stores (merchants) send us data about their own shoppers so that CartAbandon can run recovery flows for them. This includes contacts, carts, consent records and store events. For this data the merchant is the controller and we are the processor. We use it only on the merchant's documented instructions, under the Data Processing Agreement that applies to every subscription.

If you are a shopper and got a message from a store that uses CartAbandon, the store is responsible for your data. See the section on shopper requests below.

We do not ask for and do not want sensitive data, such as health data, in any field.

Our legitimate interest is running a secure, working service and improving it. You can object to processing based on legitimate interest, as described under your rights.

We process shopper data only to deliver what the merchant has set up: recovery emails, SMS, WhatsApp messages, web push, onsite offers, retargeting audience lists and the reports behind them. We do not sell shopper data, we do not use it for our own marketing, and we do not combine it across different merchants.

The merchant is responsible for having a lawful basis and recorded consent before marketing messages go out. CartAbandon helps by storing the consent source and timestamp per contact and channel, adding one-click unsubscribe to every email, handling the STOP keyword for SMS and the WhatsApp opt-out, and keeping quiet hours by the shopper's time zone.

We share data only with providers we need to run the service, under written contracts that require them to protect it. We list them by category:

• Hosting provider with data centres in the EU and the US
• Payment operator, which processes card payments and stores card details on its side
• Email delivery provider
• SMS and WhatsApp messaging provider
• AI model provider, used to draft messages in the store's brand voice
• Error monitoring provider

The AI model provider receives only what is needed to draft a message, such as the store's brand voice settings and product names. No shopper data is used to train AI models. Merchants can ask for the current list of providers through support@cartabandon.com.

We may also disclose data when the law requires it, for example to a court or a public authority with a valid legal request.

Some providers process data outside the European Economic Area, including in the US. Where a country does not have an adequacy decision, we rely on the standard contractual clauses approved by the European Commission, plus extra safeguards such as encryption. Merchants on Plus can choose to keep data in the EU or the US.

• Account and usage data: for the life of the account. After you close it, we delete it within 30 days, except what we must keep.
• Invoices and billing records: for the period required by tax and accounting law.
• Support messages: up to 24 months after the conversation ends.
• Free estimate data from people who never create an account: up to 12 months.
• Shopper carts and events: deleted or anonymised after 13 months.
• Shopper consent records: kept as proof of consent for as long as the law requires.
• All shopper data of a merchant: deleted within 30 days after the merchant closes the account, unless the merchant asks for an export first.

Backups follow the same rules and roll over on a fixed schedule.

Under data protection law you have the right to:

• Access the data we hold about you and get a copy
• Correct data that is wrong or incomplete
• Ask us to erase your data
• Ask us to restrict how we use it
• Get your data in a portable, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting processing done before
• Complain to a data protection supervisory authority, for example in the country where you live or work

To use a right, email support@cartabandon.com. We reply within one month. We may ask you to confirm your identity first.

If you are a shopper, the store that sent you a message controls your data. Please contact that store. If you write to us instead, we forward your request to the store without delay and help the store answer it. You can always stop marketing messages yourself with the unsubscribe link in any email, by replying STOP to any SMS, or by opting out in WhatsApp.

• Shopper contact data is encrypted at rest
• Store access tokens are encrypted
• Role-based access in the panel, and SSO (SAML) with an audit log on Plus
• Access by our staff is limited to what is needed and is logged
• Encrypted connections (HTTPS) for every page and API call

You can read more on our security page. If a breach affects your data, we tell you and the authorities as the law requires.

The cartabandon.com website and panel use only cookies that are strictly necessary, such as a session cookie and a security token. We do not use analytics cookies, advertising pixels or third-party tracking, so no cookie banner is needed. The storefront script that a merchant adds to their store uses only first-party strictly necessary identifiers. Details are in our Cookie Policy.

CartAbandon is built for stores and their teams. We do not knowingly collect data from children for our own purposes. Merchants must not use the service to send marketing to children where the law does not allow it.

We may update this policy when the service or the law changes. We change the date at the top of this page, and for important changes we tell account holders by email before the change applies.

Last updated 14 October 2026.