Privacy Policy — Checkout Recall

Last updated: August 1, 2026

Operator: ArquenGroup OÜ (registry code 17293845), Tööstuse tn 75-71, 10416 Tallinn, Estonia.
Contact: arquengroupou@gmail.com

What the app does

Checkout Recall helps Shopify merchants recover abandoned checkouts by placing an automated voice call to the customer about their own incomplete order and, with their agreement, delivering a discount code by SMS or via the merchant's Klaviyo account.

Data we process

On behalf of the merchant (the data controller), we process for each abandoned checkout: customer name, phone number, email, cart contents and value, and the checkout resume link. For each call: call metadata (time, duration, outcome), a text transcript of the conversation, and an automated summary. Calls are not audio-recorded. We also store discount codes issued and phone numbers on the merchant's do-not-call list.

Why (legal basis)

Processing is performed under the merchant's instructions (Art. 28 GDPR) to contact the merchant's own customers about orders those customers initiated. Merchants are responsible for ensuring a lawful basis for calls and SMS in their region and acknowledge this inside the app before calling can be enabled.

Sub-processors

Retention & deletion

Call transcripts and analysis are automatically deleted after the merchant-configured retention period (default 90 days, maximum 365). Customer data is deleted in response to Shopify customer-redaction requests, and all shop data is deleted after app uninstallation via Shopify's mandatory privacy webhooks. Do-not-call entries are retained in order to honor opt-outs. Uninstalling the app immediately stops all calling.

Customer rights

Customers may exercise access or deletion rights via the merchant, which triggers Shopify's data-request and redaction flows that this app implements. Customers who ask not to be called again during a call are permanently excluded from future calls.

Security

Data is encrypted in transit (TLS); store credentials and connected API keys are encrypted at rest. Webhook endpoints are cryptographically authenticated. Access is limited to the operator.

Contact

Questions or requests: arquengroupou@gmail.com. EU residents may also contact their local supervisory authority.