Privacy Policy

Recatchify helps online stores detect shopper hesitation in real time and show on-site responses (such as popups) intended to improve conversion. On Shopify, the app runs embedded in the Shopify admin, injects a storefront script through a Theme App Embed, and may use a Shopify web pixel for checkout-step signals. Merchants use the Recatchify dashboard for strategies, analytics, attribution, settings, and billing.

Account & billing information (Customers). Name, email address, a hashed password (for accounts created on our website), store domain or Shopify shop identifier, plan, and billing status. For website-billed accounts, payment card details are collected and stored by our payment processor — we do not store full card numbers. For Shopify App Store installs, plan selection and billing are handled through Shopify's managed pricing; Recatchify receives plan/status updates needed to apply entitlements.

Shopify store and installation data. When a merchant installs the Recatchify Shopify app, we store the shop domain, an internal merchant identifier, and Shopify API access credentials needed to operate the app (see Section 3). We also write storefront configuration identifiers (merchant ID and a store API key) to Shopify app metafields so the Theme App Embed can load the Recatchify storefront script.

Storefront & behavioral data (Shoppers). When Recatchify is active on a store, we receive first-party session signals from the storefront SDK and, where enabled, the Shopify web pixel. That may include a session identifier, optional visitor identifier, pages viewed, scroll and click activity, cart contents and values, device and browser characteristics (such as user agent), referring source, checkout step names, and similar engagement signals used to detect hesitation and show responses. Limited logged-in customer context from Shopify (for example whether the shopper is logged in, order count, lifetime spend, or account tags) may be included when available on the storefront — not email addresses in the ordinary event batch.

Email & related attributes (only when the merchant enables it). Where a merchant turns on email capture or connects a marketing tool, we may process a Shopper's email address and related handoff fields the merchant chooses to send. Merchants may also connect optional integrations (for example email or advertising tools) that process data at the merchant's direction.

Order & conversion information. To measure which responses influenced a purchase, we process order identifiers and order values associated with a Recatchify session (for example via Shopify's orders/create webhook or a periodic orders sync that uses the read_orders scope). Attribution records typically store merchant ID, session ID, Shopify order ID, order value, and related attribution metadata. The attribution path does not require storing customer name, email, phone, or address from the order payload.

Cookies & local storage. We use a first-party identifier stored in the Shopper's browser to recognize a session and returning visitors. We do not use it for cross-site advertising. Where Shopify Customer Privacy / consent APIs are available on the storefront, the Recatchify SDK can respect analytics-processing consent preferences exposed by those APIs.

We instruct merchants not to send us payment card numbers, government identifiers, health data, or other special categories of data through the Service.

The Recatchify Shopify app currently requests these Admin API scopes: read_orders, read_pixels, write_pixels, and read_customer_events.

• read_orders — receive order events and sync order identifiers/values needed for revenue attribution and related analytics.
• read_pixels / write_pixels / read_customer_events — register and operate the Recatchify web pixel and related customer-event access used for checkout and browsing signals on the storefront.

Shopify access tokens for the installed app are stored so we can call Shopify APIs and process webhooks on the merchant's behalf. Merchant-facing Recatchify API keys used by the storefront script are stored as one-way hashes; the full key is shown once when minted. Optional merchant-supplied Custom App credentials (when used for advanced order sync) are encrypted at rest.

• Provide, operate, and secure the Service for the installing merchant.
• Detect shopper hesitation in real time and show the appropriate on-site response.
• Generate popup copy and imagery using AI when a merchant requests it (see Section 5).
• Measure performance and attribute influenced orders and revenue.
• Provide analytics, conversion intelligence, and dashboard reporting.
• Handle billing (Shopify managed pricing and/or our website payment processor), support, and Service communications.
• Improve our product and develop new features.
• Comply with legal obligations, respond to Shopify privacy webhooks, and enforce our terms.

We use third-party artificial-intelligence providers to generate popup copy and images when a merchant requests generation. Limited context needed to produce a result (for example brand or offer instructions the merchant provides) is sent to those providers to fulfill the request. Generated text and images are returned to the merchant to review before use.

We do not sell personal information. We share information only as needed to run the Service:

• Service providers that host our infrastructure, process website payments, deliver transactional email, and provide AI generation — each engaged to help us operate the Service.
• Shopify and other platforms the merchant connects — for example Shopify (install, webhooks, billing, and Admin API access), and optional email or marketing tools such as Klaviyo or Mailchimp when the merchant connects them.
• Legal & safety — when required by law, to protect rights and safety, or to investigate misuse.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

Questions about our service providers can be sent to [email protected].

We keep Customer account information while an account is active and as needed to meet legal, accounting, or reporting obligations. Shopper visitor-memory records are retained for a configurable window (default 180 days, within an allowed range of 30–365 days) and then aged out by our maintenance processes. Other storefront and attribution data is retained to power analytics and attribution for the installing merchant until deleted through uninstall/GDPR deletion flows described below, account closure, or a valid deletion request, subject to legal retention requirements.

For Shopify merchants, Recatchify implements Shopify's mandatory compliance webhooks:

• customers/data_request — we record an audit log of the request (shop and identifiers needed to locate data; we do not log customer email in that audit path) and fulfill the export manually within the timeframe Shopify requires.
• customers/redact — we delete order attribution records for the listed orders and remove related chat/session data we can associate with those orders or a provided customer email, and we run our visitor-erasure path for matching visitor/session identifiers.
• shop/redact — after uninstall, Shopify sends a shop-level deletion request; we delete merchant-scoped sessions, interventions, order attributions, visitor profiles, related chat data, store-mapping rows, and the Shopify install record, and we run shop-level visitor erasure.

Separately, when a merchant uninstalls the app, our app/uninstalled webhook invalidates stored Shopify API tokens promptly so further Admin API sync stops. Full shop data deletion is completed when Shopify sends shop/redact.

We protect information using industry-standard measures appropriate to the data, including encryption in transit (HTTPS), hashing of merchant API keys, encryption at rest for certain sensitive stored secrets (such as optional Custom App credentials and some integration credentials), and access controls between services. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing (for example under the EU/UK GDPR or the California CCPA/CPRA).

If you are a Shopper, the merchant whose store you visited controls your data — please direct requests to that merchant, and we will assist them in responding (including through Shopify's compliance webhooks when applicable). If you are a Customer, contact us directly using the details below.

We are based in the United States and process information there. Where data is transferred from other regions, we rely on appropriate safeguards as required by applicable law.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children under 16.

Merchants are responsible for having a lawful basis to collect shopper data, for posting their own privacy notice, and for obtaining any consent required in their jurisdiction (including for cookies, email marketing, and behavioral tracking) before deploying Recatchify on their store.

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Questions about this Policy or your data? Contact us at [email protected].