Privacy Policy

Last updated: November 5, 2026

Reclaim ("the App", "we", "us") is a Shopify app operated by Shaul Software that helps merchants recover abandoned checkouts by sending WhatsApp messages to customers. This policy explains what personal data we collect, why we collect it, and how it is handled.

1. Data we collect

From merchants (Shopify store owners)

• Shopify shop domain and access token (granted via OAuth)
• App settings you configure (recovery delay, message templates, discount codes)

From customers of the merchant's store

• Name (first and last)
• Email address
• Phone number
• Country code from the billing or shipping address (used to format the phone number)
• Order total and currency at the time the checkout was abandoned
• Total paid and currency, if the customer buys after a recovery message
• Whether the customer ticked the WhatsApp opt-in checkbox at checkout
• The recovery URL Shopify generates for the abandoned checkout
• The time the customer first tapped the link in a recovery message
• WhatsApp replies the customer sends to a recovery message, and the rest of that conversation, so the merchant can read it in the App

2. Why we collect it

We use this data exclusively to send WhatsApp recovery messages to customers who started but did not complete a checkout. Specifically:

• Phone — to send the message
• Country code — to format local-format phone numbers correctly
• Name — to personalize the message
• Email — to identify the same customer across checkouts
• Order total / currency — to display the abandoned cart amount in the message
• Opt-in flag — to ensure messages are only sent to customers who consented
• Total paid — to show the merchant the sales that followed their recovery messages
• Link tap time — to show the merchant which recovery messages led to a purchase
• Conversation messages — to show the merchant what the customer replied. We only store conversations with customers who received a recovery message; no other WhatsApp chats are stored.

We do not sell, rent, or share customer data with third parties. We do not use it for advertising or profiling. We do not transfer it outside the systems strictly required to deliver the messaging feature.

3. Where it is stored

Data is stored in a managed PostgreSQL database hosted on Railway, encrypted at rest by the cloud provider. Connections to the database are encrypted in transit (TLS). Backups are encrypted.

WhatsApp session credentials needed to send messages are stored on an encrypted persistent volume on the same hosting platform.

4. Retention

• Abandoned-cart records, message logs and conversations are retained for 180 days after the cart was created, then automatically deleted.
• If a customer opts out, their phone number is kept so they aren't messaged again, until the merchant's data is deleted or the customer requests deletion.
• When a merchant uninstalls the App, all data associated with their shop is deleted within 30 days, in line with Shopify's GDPR webhooks (shop/redact).
• When a customer requests deletion (via Shopify's customers/redact webhook), their personal data is removed within 30 days.

5. Customer rights

Customers can request access to or deletion of their data by contacting the merchant whose store sent them a message; the merchant will pass the request to us via Shopify's GDPR webhooks, which we honor automatically.

6. WhatsApp delivery

Messages are delivered through WhatsApp. The message content and the recipient's phone number transit WhatsApp's infrastructure, which is governed by WhatsApp's Business Messaging Policy. We do not control WhatsApp's data handling beyond what we send.

7. Sub-processors

• Shopify, Inc. — provides the e-commerce platform and webhook delivery.
• Railway Corporation — hosts the application, database, and Redis queue.
• WhatsApp / Meta Platforms, Inc. — delivers the messages.
• Crisp IM SAS — provides the live-chat support widget in the App's admin. When a merchant uses it, Crisp receives their shop domain, support messages, IP address, approximate location, browser and device details, and their email address if they choose to provide it.
• Resend, Inc. — delivers our internal email telling us that a store installed or uninstalled the App. Resend receives the store's name and shop domain.

8. Security

We follow standard security practices: HTTPS everywhere, encrypted storage, minimal scopes, regular dependency updates, and a separate production environment isolated from development data. Access tokens are stored encrypted and never logged.

9. Children

The App is offered to merchants for use with their adult customers. We do not knowingly process data from anyone under 16.

10. Changes

If we materially change this policy, we will notify installed merchants via the App's admin and update the "Last updated" date above.

11. Contact

Questions or data requests: sshaul2704@gmail.com.