Privacy Policy
Overview
This policy explains what data Haggler processes when a merchant installs our Shopify app and how we handle it. We act as a processor of your store's data on your behalf, and as a controller of the limited account data we need to run the Service.
What we process
To recover abandoned carts, we process store data provided through Shopify:
- Abandoned checkout and cart details, including line items and totals.
- Customer contact details needed to send and route recovery messages.
- Product and order data used to choose the right recovery response.
- The recovery messages we send and the replies customers send back.
How we use it
We use this data solely to provide the Service: sending recovery micro-mail, routing replies by reason, applying the appropriate fix, and reporting results back to you. We do not sell personal data or use it to build advertising profiles.
Data minimization in our logs
Customer email addresses are never written to our operational logs. Where we need to correlate log entries to a customer, we use a pseudonymous reference derived with a keyed one-way hash, so the raw address is not recoverable from the logs.
Data isolation between stores
Every operation is scoped to the requesting store. When two stores happen to share the same customer, one store's request can never read, change, or erase another store's data.
Data requests and deletion
We implement Shopify's mandatory privacy webhooks. When a store or a customer requests data access or erasure through Shopify, we inventory or remove the relevant data for that store. Customer redaction nulls personal fields on that store's records while retaining stripped financial records where required, and shop redaction removes the store's data. These operations are idempotent and scoped to the requesting store.
Storage and security
Data is stored in managed infrastructure with access controls and encryption in transit. Sensitive credentials, such as store access tokens, are encrypted at rest. We retain data only as long as needed to provide the Service or as required by law.
Sub-processors
We rely on a small set of providers to run the Service, each processing data only as needed and under appropriate data-protection terms:
- OpenAI - generates recovery messages and classifies replies. It receives the customer's message content and cart context; we do not permit it to train on this data.
- Resend - delivers recovery micro-mail and receives replies. It processes the customer's email address and message content.
- Amazon Web Services - hosts the Service and stores data in managed infrastructure.
Your rights
Depending on your location, you or your customers may have rights to access, correct, or delete personal data. Merchants can raise these requests through Shopify's privacy tools or by contacting us; we route them to the appropriate store.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated through the app or by email.
Contact
Questions about privacy or a data request? Reach us at cart@email.haggler.live.