Introduction and Scope

This Privacy Policy explains how Ecom Checkout Handbook ("we," "us," or "our") collects, uses, and shares personal information when you visit ecomcheckouthandbook.com or use our checkout optimization and cart recovery services (the "Services"). Our Services help online stores reduce cart abandonment by analyzing checkout interactions and sending recovery messages to shoppers who leave items in their carts.

This policy applies to information we collect through our website, the Services we provide to merchants, and any communications you have with us. It does not apply to third-party websites or services that we do not control, including the websites of the merchants who use our Services. If you are a shopper on a merchant's website, that merchant's privacy policy also applies to your information, and you should review it.

Information We Collect

We collect information in three ways:

Information you provide to us

• Account information: When a merchant signs up for our Services, we collect the merchant's name, email address, company name, website URL, billing address, and payment details (processed by our payment processor; we do not store full payment card numbers).
• Communications: If you contact us for support or privacy inquiries, we collect your name, email address, phone number (if provided), and the content of your message.

Information collected automatically through the Services

When a shopper interacts with a merchant's checkout or cart, we may collect:

• Device and browser data: IP address, browser type and version, operating system, device type, and unique device identifiers.
• Usage data: Pages viewed, time spent on checkout pages, clicks, form field interactions (such as whether a field was completed or abandoned), and cart contents (product names, quantities, and prices).
• Recovery data: Email address or phone number if a shopper provides it during checkout (e.g., to receive a cart recovery message), along with the status of any recovery messages sent.

We do not collect payment card numbers or sensitive financial account information from shoppers. Payment information is handled directly by the merchant's payment processor.

Information from third parties

We may receive information from merchants (such as their customer lists, if they choose to import them for recovery campaigns) and from analytics providers that help us understand how the Services are used.

How We Use and Process Information

We use personal information for the following purposes:

• Providing the Services: To operate checkout optimization features (such as A/B testing of checkout flows) and cart recovery (such as sending reminder emails or SMS messages to shoppers who opt in).
• Improving the Services: To analyze usage patterns, diagnose technical issues, and develop new features. We may use aggregated or de-identified data for these purposes.
• Communicating with merchants: To send service updates, invoices, security alerts, and respond to inquiries.
• Legal compliance: To comply with applicable laws, respond to lawful requests, and enforce our terms.

Legal bases for processing (where applicable): For individuals in jurisdictions that require a legal basis, we process personal information based on: performance of a contract (providing the Services to merchants), legitimate interests (improving the Services, ensuring security), consent (where required for recovery messages), and legal obligations.

Data retention: We retain merchant account information for as long as the account is active and for a reasonable period afterward to comply with legal obligations. Shopper recovery data is retained for 12 months after the last interaction, unless a longer period is required by law or agreed with the merchant. Aggregated or de-identified data may be retained indefinitely.

Data Security Measures

We implement technical and organizational measures to protect personal information, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest (such as recovery email addresses) using industry-standard algorithms.
• Access controls limiting employee access to personal information on a need-to-know basis.
• Regular security assessments and monitoring for unauthorized access.
• Incident response procedures to address potential breaches.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we strive to protect your information and will notify affected parties as required by law if a breach occurs.

User Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to legal exceptions.
• Restriction: Request that we restrict processing of your information.
• Portability: Request a machine-readable copy of your information.
• Objection: Object to processing based on legitimate interests.
• Opt-out of marketing: Unsubscribe from marketing communications at any time using the link in the email or by contacting us.

To exercise these rights, contact us at privacy@ecomcheckouthandbook.com. We will respond within the time required by applicable law (typically 30 days for access and deletion requests). We may need to verify your identity before fulfilling a request.

For California residents (CPRA): You have the right to know what personal information we collect, use, and share; the right to delete; the right to correct; the right to opt out of the sale or sharing of personal information (we do not sell personal information); and the right to limit use of sensitive personal information (we do not collect sensitive personal information as defined by the CPRA). To exercise CPRA rights, contact privacy@ecomcheckouthandbook.com. You may designate an authorized agent to make a request on your behalf.

For shoppers on merchant websites: If you are a shopper and wish to exercise rights regarding data we process on behalf of a merchant, please contact the merchant directly. We will assist merchants in responding to such requests.

Third-Party Services and Cookies

We use cookies and similar technologies to operate the Services, analyze usage, and improve performance. Cookies are small text files stored on your device. You can control cookies through your browser settings, but disabling certain cookies may affect functionality.

We use the following categories of cookies:

• Essential cookies: Required for authentication and security.
• Analytics cookies: Help us understand how the Services are used (e.g., Google Analytics).
• Recovery cookies: Used to recognize a shopper's cart across sessions for recovery purposes.

We may share personal information with third-party service providers who perform functions on our behalf, such as:

• Email and SMS delivery providers: To send cart recovery messages.
• Payment processors: To process merchant payments.
• Cloud hosting providers: To store data securely.
• Analytics providers: To analyze usage.

These providers are contractually obligated to protect personal information and use it only for the purposes we specify. We do not sell personal information. We may disclose information if required by law or to protect our rights.

Do Not Track: Our website does not currently respond to Do Not Track signals. You can manage cookies as described above.

How to Contact Us for Privacy Inquiries

If you have questions about this Privacy Policy or our data practices, or to exercise your privacy rights, contact us:

• Privacy email: privacy@ecomcheckouthandbook.com
• Phone: +1 (415) 555-0134
• Mailing address: 1580 Valencia Street, Suite 304, San Francisco, CA 94110

We will respond to privacy inquiries within a reasonable timeframe.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify merchants by email or through the Services and update the "Last updated" date below. Your continued use of the Services after changes become effective constitutes acceptance of the revised policy.

Last updated: October 29, 2026