Privacy Policy

Pickup is an AI voice abandoned-cart recovery app for Shopify, operated by Exil AI (“Pickup”, “we”, “us”). This policy explains what personal data we process when a merchant installs Pickup, how we use it, who we share it with, and the rights available to merchants and their customers. We act as a data processor on behalf of the merchant (the data controller) for their customers’ personal data.

When a merchant installs Pickup and as it operates, we process:

• Merchant account data — store domain, name, email, plan, and settings, from Shopify.
• Customer personal data — a shopper’s name, email address, and phone number, plus the contents of their abandoned cart and the recovery checkout link. This is “Protected Customer Data” under Shopify’s rules and is used only to attempt a consented recovery contact.
• Call data — call outcome, duration, transcript, a short AI summary, sentiment, and (on Pro plans) the call recording.
• Consent & suppression records — any opt-out or “do not call” request, and the suppression records we keep in order to honor it.

• To place a recovery phone call, on the merchant’s behalf, to shoppers who abandoned checkout.
• To generate the agent’s spoken responses and to email the shopper their checkout link and any discount.
• To produce the merchant’s dashboard analytics, transcripts, and call outcomes.
• To provide support and to keep the service secure and reliable.

Recovery calls are placed on behalf of the merchant, who is responsible for having a lawful basis and any consent required to contact their customers. Pickup honors opt-outs immediately: a customer can opt out at any time — by saying so on a call or using the unsubscribe link in any recovery email — and we suppress all future contact. A merchant can also add a number to their Do Not Contact list on the shopper’s behalf. Merchants also control calling hours, the recovery discount, and which agents run.

We do not sell personal data and do not use it for advertising. We share personal data only with vetted service providers that process it on our behalf, under contract and solely to operate Pickup. These providers fall into the following categories:

• Cloud hosting & database infrastructure (United States) — runs the application and stores app data.
• Telephony & voice processing — connects the phone calls and generates the agent’s speech and responses.
• Email delivery — sends the recovery emails.

We also exchange data with Shopify, the platform Pickup runs on. A current list of our named sub-processors is available to merchants on request at privacy@exil.ai.

We keep personal data only as long as needed to provide the service, then remove it on a scheduled basis. When a merchant uninstalls Pickup, their store data is deleted in response to Shopify’s shop-redaction request. We honor Shopify’s mandatory customers/redact and customers/data_request webhooks: a customer’s data is erased (transcripts, recordings, summaries, phone, and the contact record) on a redaction request, and exported to the merchant on a data request.

Depending on where you live (e.g. the EU/UK under GDPR, or California under the CCPA/CPRA), you may have the right to access, correct, delete, or restrict the use of your personal data, and to withdraw consent. Because the merchant is the controller of their customers’ data, shoppers should contact the store; the store can fulfill access and deletion through Shopify’s data-request and redaction flows, which we support. You may also contact us at the address below and we will assist the merchant.

Data is encrypted in transit (TLS) and at rest. Database access is least-privilege with row-level security so each store’s data is isolated, application credentials are stored in a managed secret store, and secrets are never written to logs. We restrict access to personal data to what the service requires.

Pickup is hosted in the United States, so personal data is processed there. Where required, transfers rely on appropriate safeguards.

Pickup is a business tool and is not directed to children, and we do not knowingly process children’s personal data.

We may update this policy; material changes will be reflected by the effective date above and, where appropriate, communicated to merchants.

Questions about this policy or your data? Email privacy@exil.ai.