Privacy Policy

CartHound — cart recovery app for Shopify · Last updated September 16, 2026

This Privacy Policy explains how CartHound (“we”, “us”, the “App”) collects and uses information when a Shopify merchant installs our abandoned-cart recovery app, and when we send reminder messages to that merchant’s customers on the merchant’s behalf.

CartHound is operated by PE Hrin Tamara, Ostafia Dashkevycha street, 22, Kyiv, 02139, Ukraine.

Controller and processor roles

For personal data about a merchant’s customers (shoppers), the merchant is the data controller and CartHound acts as a data processor, processing that data solely to provide the App’s recovery features, under the Data Processing Agreement. For data about the merchant’s own account, CartHound is the controller.

Information we collect

• Merchant account data: store domain, store name, contact email, staff identity, plan/billing.
• Shopper data (via Shopify webhooks): email address, phone number, cart and order contents, order value, and marketing-consent status (email and SMS).
• Usage data: which reminders we sent and their delivery status, and which orders were recovered, for the merchant’s analytics and for billing. We do not use tracking pixels and do not record message opens, link clicks, or how shoppers browse a store.

We do not collect payment card numbers. Billing is handled by Shopify.

How we use information

• Send abandoned-cart reminder emails and, where the shopper has given SMS marketing consent, reminder SMS — each with a link to complete the purchase and, optionally, a discount.
• Attribute recovered orders and calculate the merchant’s revenue-share fee.
• Provide analytics and support to the merchant.

Consent and opt-out

Marketing SMS are sent only to shoppers who gave explicit SMS marketing consent at Shopify checkout. Shoppers can opt out of SMS at any time by replying STOP, and out of email via the unsubscribe link. We honour Shopify’s consent state as the source of truth.

Sub-processors

We share data only with service providers needed to run the App:

• Shopify — source of store and shopper data.
• Resend — email delivery (United States).
• Telnyx — sms delivery.
• Neon — database hosting (United States).
• Fly.io — application hosting (United States).

International transfers

Our infrastructure is hosted in the United States. Where data of EU/EEA residents is transferred, it is done under appropriate safeguards (e.g. Standard Contractual Clauses) between us and our sub-processors.

Data security

Data is encrypted in transit: the App is served over HTTPS and our database connections require TLS. Infrastructure security is handled by the managed providers listed above. Webhooks from Shopify are verified by their HMAC signature before we act on them, so we don’t process forged requests. Administrative accounts are protected by salted, hashed passwords. We request only the Shopify access scopes the App needs to work, and all credentials are held as platform secrets — never in source code.

Selling of personal data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Data is disclosed only to the sub-processors listed above, and only to operate the App.

Retention and deletion

We keep shopper data only as long as needed to provide the service to the merchant, and delete it automatically once each period below has passed:

• Abandoned carts — 90 days after the last activity on the cart. By then the reminder sequence has ended and every recovery discount has expired.
• Shoppers who have opted out of every channel — 30 days after opting out. We keep a one-way hash of their email address or phone number, so that an opt-out keeps working if the same contact is added again.
• Discount codes — 30 days after they expire.

When a merchant uninstalls the App, Shopify sends us an erasure request approximately 48 hours later, and we then delete every shopper record for that store — email addresses, phone numbers and names.

We retain the merchant’s own business records: order numbers, amounts, which reminders were sent and what they cost, and billing history. These no longer identify any shopper, and we are required to keep them under accounting and tax law and to be able to substantiate an invoice if a merchant later disputes it.

We also act on the data requests Shopify forwards on a shopper’s behalf: an access request is answered with the data we hold about that shopper, and an erasure request deletes their contact details and identifiers from our records. Both are completed within 30 days. Aggregate figures that no longer identify anyone (such as a merchant’s recovered-revenue totals) may be retained.

Your rights

Depending on your location (e.g. GDPR/UK GDPR, CCPA), you may have rights to access, correct, delete, or restrict processing of your personal data, and to withdraw consent. Shoppers should contact the merchant (the controller) first; you may also contact us at info@thecarthound.com and we will assist the controller.

Contact

Questions about this policy: info@thecarthound.com.

We may update this policy; the “Last updated” date reflects the latest version.