Privacy Policy
Effective date: September 8, 2026
CartBack provides abandoned-cart follow-up, customer messaging, WhatsApp widgets, message templates, and related automation for Shopify merchants. This policy explains how CartBack processes personal information when a merchant installs or uses the app.
Information we process
- Shop and account information, including shop domain and app configuration.
- Customer and commerce information needed for enabled features, such as customer name, phone number, order or checkout identifiers, cart contents, order status, and message history.
- WhatsApp and YCloud connection information supplied by the merchant, including channel identifiers and encrypted credentials.
- Technical and diagnostic information needed to secure, operate, and troubleshoot the service.
How we use information
We use information only to provide and secure CartBack, synchronize merchant-authorized Shopify data, deliver requested messages, display conversations, run enabled automations, provide support, prevent abuse, and comply with legal obligations. CartBack does not sell personal information.
Service providers and transfers
CartBack sends only the information required to complete a requested function to Shopify, WhatsApp Business Platform/Meta, YCloud, hosting and infrastructure providers, and other processors selected or enabled by the merchant. These providers may process information in other countries under their own terms and applicable safeguards.
Merchant responsibilities
Merchants control the purposes and settings of their customer communications. Merchants must obtain all required consent, honor opt-outs, use approved WhatsApp templates where required, and comply with applicable privacy, marketing, and messaging laws.
Security and retention
We use access controls, encryption in transit, protected credential storage, webhook verification, and operational logging. Customer, conversation, and messaging records are retained for no longer than 365 days after their last activity unless a shorter period is requested or continued retention is legally required. Webhook delivery records and completed privacy exports are retained for no longer than 30 days. Shopify customer redaction requests are applied to matching records, and shop data is deleted after Shopify sends a shop redaction request.
Your rights and deletion requests
Customers should normally contact the Shopify merchant that collected their information. Merchants and customers may also request access, correction, export, or deletion by emailing virgilthomson1@gmail.com. We verify requests and respond as required by applicable law. CartBack also processes Shopify's mandatory privacy webhooks.
Changes
We may update this policy as the service or legal requirements change. The effective date above identifies the latest version.
Contact
Email: virgilthomson1@gmail.com