Privacy Policy
Effective Date: March 1, 2026 · Last Updated: September 12, 2026
1. Introduction and Scope
Sallift (“Sallift”, “we”, “us”, or “our”) provides an e-commerce revenue automation platform designed to help online merchants recover abandoned shopping carts and checkouts through email, WhatsApp, and automated workflows.
In the context of data protection laws, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA):
- For Merchant Account Data: Sallift acts as a Data Controller when collecting merchant registration, login credentials, billing details, and platform settings.
- For Store Customer and Shopper Data: Sallift acts as a Data Processor (or Service Provider) processing customer names, emails, phone numbers, and cart contents on behalf of our merchant customers (the Data Controllers).
2. Categories of Information We Process
We process the following categories of information:
- Merchant Profile Information: Name, business email, organization name, store domain, and encrypted credentials for third-party integrations (e.g. Shopify, Resend, Meta WhatsApp).
- Commerce & Cart Events: Product IDs, titles, cart totals, checkout tokens, timestamps, and abandoned cart activity transmitted via platform webhooks or APIs.
- Customer & Recipient Contacts: Shopper first name, email address, normalized E.164 phone number, channel marketing opt-in consent timestamps, and communication status.
- Delivery & Attribution Logs: Outbound message timestamps, delivery receipts, opens, link clicks, returned orders, and attributed revenue net of refunds.
3. Purpose and Legal Basis for Processing
We process personal data strictly for:
- Executing autonomous cart and checkout recovery campaigns configured by merchants.
- Verifying explicit opt-in consent before dispatching communications on WhatsApp and Email.
- Enforcing suppression lists to prevent contacting customers who have unsubscribed or hard bounced.
- Calculating accurate revenue attribution across the verified 168-hour attribution window.
- Providing audit trails, platform telemetry, and merchant-specific intelligence via Sallift AI.
4. Third-Party Sub-Processors
Sallift uses vetted third-party sub-processors to deliver core infrastructure:
- Shopify: Commerce platform API integration and webhook ingestion.
- Resend / AWS SES: Email infrastructure and deliverability services.
- Meta WhatsApp Cloud API: Official business messaging infrastructure.
- Stripe: Subscription billing and payment processing (PCI-DSS Level 1 compliant).
- OpenAI: Grounded AI intelligence (zero customer data retention for model training).
5. Data Retention and Suppression
Commerce events and abandoned cart records are retained for the active billing and attribution period. Customer email suppressions and WhatsApp opt-out records are retained indefinitely to permanently safeguard shopper preferences and prevent accidental messaging.
6. Merchant and Consumer Rights
Merchants and shoppers have the right to request access to, correction of, or deletion of their personal information. Shoppers may unsubscribe from recovery emails at any time using the one-click unsubscribe link included in every email.
7. Contact Us
For questions regarding this policy or data processing practices, please contact our Data Protection Officer at:
privacy@sallift.com