Plain-English summary: We collect account and shopping data to provide AbanCart. We do not sell personal information. You can request account deletion; see Account Deletion for what is removed and what may remain.
1. Who We Are
AbanCart ("AbanCart", "we", "us", "our") operates the AbanCart browser extension, the AbanCart mobile app, the web platform at abancart.com, and associated services. We help shoppers save and revisit their shopping carts, and help retailers recover abandoned carts through WhatsApp-based conversations.
If you have questions about this policy, contact us at privacy@abancart.com.
2. What Data We Collect
2.1 Shopper accounts (extension and mobile app)
| Data | Why we collect it | When |
|---|---|---|
| Email address | To create and secure your account, and send verification, password-reset, or one-time sign-in links | When you register or use an account email flow |
| Optional display name and phone number; account password hash if you set a password | To personalize your profile, secure password sign-in, or support an opted-in WhatsApp recovery flow | When you add profile details or choose password sign-in; a phone number is optional |
| Cart contents (item names, variants, quantities, prices, product images, store name, store origin, and eligible product links) | To save your cart so you can return to it later. New captures from a store can update its active uncategorized basket; folders and carts marked as restored are kept separate. Mobile auto-save sends only these approved cart fields and the HTTPS store origin; eligible same-store product links have query strings and fragments removed. Product-image URLs may retain source image rendition parameters. It does not collect the cart-page URL, checkout or payment fields, or form values. | When you save a cart via the extension, or when you are signed in and mobile auto-save is enabled on an HTTPS cart page in Shop, including supported Magento carts. Checkout and payment pages are excluded. |
| Product alternative search details (product title, store name, and known price) | To find similar public retailer listings when you explicitly choose Find alternates. AbanCart's servers use web search and Anthropic to find candidates, then fetch limited metadata from public HTTPS product pages without browser cookies or signed-in access. Only these three product details are used for the text search; product images, account details, other cart items, and page or cart URLs are not sent. | When you start a text-based Find alternates search |
| Mobile auto-save preference | To remember whether you have enabled or disabled automatic cart saving. This account-scoped preference is stored on your device and is not uploaded. | When you change the preference in the mobile app Profile |
| Saved product-link URL and public product-page metadata (title, image, price, currency) | To keep the link you chose and show a preview. We fetch only bounded public metadata without browser cookies or signed-in access; cart and checkout links are not fetched for metadata. | When you save a product link and the public page makes metadata available |
| Device type and browser | To secure your session and debug issues | When you sign in |
| Rotating IP-derived fingerprint | Security and service monitoring; request telemetry does not store the raw IP address | On API requests; telemetry is retained for 30 days |
| Marketing/analytics consent choices | To respect your preferences | When you set them in mobile app Profile or extension Settings |
| Support request (name, email, and message) | To respond to your question | When you submit the in-app support form |
2.2 Business customers (brands)
If you represent a brand using AbanCart's recovery platform, we collect your business name, contact email, portal account information, store connection settings, and data imported from that brand's connected Shopify store, together with its recovery records and website-chat messages.
Each brand portal user is scoped to one brand. Its recovery dashboard shows aggregate recovery figures and limited recent-recovery details (customer name, product names, amount, and time). The separate website-chat inbox shows visitor names, email addresses, and messages assigned to that same brand. WhatsApp recovery conversations use the shopper's phone number and may contain messages and cart or checkout details for that brand. Portal users cannot access another brand's records.
2.3 Website visitors
If you accept the website cookie banner, we record page path, referrer, browser user-agent, campaign parameters, a pseudonymous visitor ID, and your IP address for approximate country and city lookup. The visitor ID can persist for up to 365 days and may also be associated with a demo/contact request. Contact forms may include your name, email, phone, company, website, and message; website chats include your name, email, and messages. We also process the submitting IP address. Website visit and contact-request records are kept for 12 months and then deleted. To request earlier deletion, email privacy@abancart.com; we verify requests before acting.
3. How We Use Your Data
- Providing the service: Saving your carts, sending you your personal cart-view link, enabling you to restore carts, and updating your mobile auto-saved cart snapshot for a store when you save another cart there.
- Mobile Shop auto-save: When enabled in Profile, the signed-in app checks eligible HTTPS cart pages and sends only approved cart fields, the store origin, and eligible same-store product links. You can switch it off at any time. Checkout/payment pages, form values, and the cart-page URL are excluded.
- Find alternates: For text-based product searches, AbanCart's servers use web search and Anthropic, then fetch limited metadata from candidate public HTTPS product pages without browser cookies or signed-in access. Only the product title, store name, and known price are used; product images, account details, other cart items, and page or cart URLs are not sent. Image searches are separate: the selected product image or its public image URL goes to Google Lens; query strings and fragments are removed from saved image URLs, and a device photo goes directly to Google rather than through AbanCart. These searches never send page or cart URLs.
- WhatsApp cart recovery messages: If you have opted in and a brand you've shopped with is a partner, we may send you a WhatsApp message about your saved cart on that brand's behalf. You control this at all times via the mobile app Profile or extension Settings.
- Security: Detecting abuse, verifying sign-in sessions.
- Improving the product: Aggregate, anonymised usage analytics (only if you've consented in the extension).
- Business development: We may share aggregate, anonymised statistics (e.g. "340 carts saved from store X this month") with retailers as part of our sales process. No personal data is included in these statistics.
4. WhatsApp Messages — Opt-In and Opt-Out
We only send WhatsApp messages to shoppers who have explicitly opted in through the AbanCart extension or a brand's own opt-in flow. Messages are sent on behalf of the specific brand whose store you shopped at.
You can opt out at any time by:
- Replying STOP to any WhatsApp message from us
- Toggling off "Marketing updates" in the mobile app Profile or extension Settings
- Emailing privacy@abancart.com
5. How We Share Your Data
We do not sell, rent, or trade your personal information.
Service providers may process data in the United States and other countries where they operate, under their own terms and safeguards. They keep data only as long as needed to provide their services.
We may share data with:
- Service providers and connected platforms listed below, to operate AbanCart and provide the features you request.
- Partner brands — each brand can access only records scoped to its own store. Its recovery dashboard shows aggregate recovery metrics and limited recent-recovery details (customer name, product names, amount, and time). The separate website-chat inbox shows visitor names, email addresses, and message history for that same brand. WhatsApp recovery conversations use the shopper's phone number and may include messages and cart or checkout details for that brand; the dashboard does not expose another brand's records.
- Law enforcement where required by applicable law.
5.1 Providers and data handled
| Provider | Data handled | Purpose |
|---|---|---|
| Resend | Account email address and verification, password-reset, or sign-in emails and links; support request name, email address, and message. | Deliver account emails and route support requests to AbanCart support. |
| Twilio / WhatsApp | Recipient phone number, message content, and delivery information for opted-in cart-recovery or account-related messages. | Send and deliver requested WhatsApp messages. |
| Anthropic | Prompts, conversation messages, and relevant cart or product context submitted to generate an AI response. For text-based Find alternates, only the product title, store name, and known price are sent. Account passwords and sign-in tokens are not needed for these prompts. | Provide AI-assisted responses and product research. |
| Shopify | Abandoned-checkout records, including customer and cart/recovery fields returned by the connected retailer's own store under its granted access. | Enable that retailer's checkout-recovery service. |
| ip-api.com | Website visitor IP address for approximate country and city lookup. Lookups use an encrypted HTTPS connection under a commercial plan. | Approximate website visit location. |
| Google Lens | Only a selected product image or public image URL for image searches. Query strings and fragments are removed from saved image URLs; device photos go directly to Google. Saved page and cart URLs are not sent. | Find products from image searches. |
| Replit hosting and database | Account, saved-link/cart, retailer conversation, website, and operational records needed to run AbanCart. | Host and operate the service. |
6. Data Retention
| Data type | Retention period |
|---|---|
| Account and saved cart/link data | Until account deletion. Separately stored retailer recovery records and backups may remain as described at Account Deletion. |
| Access and refresh sessions | Access tokens expire after 1 hour; refresh tokens after 30 days or when revoked. Expired session records are deleted within 30 days after expiry. |
| Magic sign-in tokens | Valid for 15 minutes and single-use. Used or expired token records are deleted within 30 days after expiry. |
| Email verification and password-reset tokens | Valid for 30 minutes and single-use. Used or expired token records are deleted within 30 days after expiry. |
| Request telemetry | 30 days in the current service configuration. |
| Text-based product alternative searches | Search inputs and public candidate results may remain in a short-lived server-memory cache for up to 24 hours. They are not saved to your account or cart history. |
| Authentication-abuse records | Pseudonymous email and IP fingerprints are used for login-abuse throttling. Attempts older than the 15-minute rate-limit window are pruned on a later login rate-limit check; cleanup is opportunistic, not a fixed 90-day purge. Account deletion does not remove these rows. |
| Extension analytics and retailer recovery records | Account-linked extension events are removed with the account. Retailer recovery conversations and checkout records are kept while the retailer uses AbanCart and for 90 days afterward, then deleted. Aggregated analytics contain no personal data and may be kept indefinitely. |
| Website visits and contact requests | 12 months, then deleted; earlier deletion may be requested by emailing the privacy contact. These records are separate from shopper-account deletion. |
| Backups | Deleted data is removed from backups within 30 days. |
7. Your Rights
Depending on where you live, you may have the right to:
- Access a copy of your data — use "Export my data (GDPR)" in the extension Settings
- Delete your account — in the mobile app Profile or extension Account, choose Delete account, or follow the account deletion instructions; some separate retailer records may remain as explained there
- Correct inaccurate data — email us
- Object to processing — email us
- Withdraw consent for marketing at any time
We will respond to verifiable requests within 30 days. Email privacy@abancart.com.
8. Cookies
Our website uses minimal cookies. See our Cookie Policy for details.
9. Children
AbanCart is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, please contact us immediately.
10. Changes to This Policy
We may update this policy. If we make material changes, we will notify extension users via an in-app notice. Continued use after the effective date constitutes acceptance.
11. Contact
Email: privacy@abancart.com
Website: abancart.com