Who is responsible

Polaround OÜ, registry code 14357013, registered at Raba tn 48, Keila, Harju maakond, 76609, Estonia, operates Leavecart. For website visitors, prospects, merchant users, billing contacts, and service administration, Polaround OÜ acts as the data controller.

When Leavecart processes a merchant’s shopper data to provide recovery conversations and reporting, the merchant is normally the controller and Polaround OÜ acts as its processor. Those activities are governed by the Data Processing Agreement.

Data we process

• Contact and account data, including names, work email addresses, store domains, authentication records, team roles, and support requests.
• Merchant configuration, including brand knowledge, policies, offer rules, automations, consent settings, and integration status.
• Shopper data supplied through the merchant’s Shopify and messaging integrations, including contact details, cart and checkout contents, order context, message content, consent state, delivery events, and attribution events.
• Storefront-chat data, including chat content, a pseudonymous session identifier, the page URL and title where chat started, conversation status, and security-rate-limit records. Network addresses used for widget rate limiting are stored as one-way hashes rather than raw addresses.
• Technical records such as request identifiers, security events, audit history, device or browser information, and limited log data.
• Billing and subscription identifiers. Payment card details are handled by the configured payment provider and are not stored by Leavecart.

Why we use data

We process personal data to:

• provide, secure, maintain, and improve Leavecart;
• authenticate users and administer merchant workspaces;
• connect Shopify and approved messaging, AI, and billing providers;
• generate merchant-directed conversations, apply safety rules, and measure recovery outcomes;
• respond to inquiries, provide support, and manage subscriptions;
• detect misuse, investigate incidents, and meet legal obligations.

Depending on the activity, the legal basis is performance of a contract, steps requested before entering a contract, legitimate interests in operating and securing a business service, compliance with law, or consent where consent is required. For shopper data, Leavecart follows the merchant’s documented instructions.

Providers and subprocessors

We disclose data only where needed to operate the service, comply with law, or protect legal rights. Depending on the merchant’s configuration, providers can include Shopify for commerce data, Twilio for messaging, OpenAI for constrained response generation, Stripe for billing, Cloudflare for hosting and storage, and Sentry for privacy-filtered error monitoring. Providers receive only the data needed for their function and are subject to contractual or legal safeguards.

Where processing involves a transfer outside the European Economic Area, we rely on an adequacy decision or appropriate safeguards such as approved standard contractual clauses, as applicable.

Retention and deletion

We retain data only for as long as needed for the purposes described here, the merchant agreement, security, dispute resolution, and legal recordkeeping. Merchant shopper data is returned or deleted at the end of the service on the merchant’s instruction, subject to lawful backup and recordkeeping requirements. Suppression records may be retained to honour opt-outs and prevent prohibited messages.

Security

We use organizational and technical measures appropriate to the nature of the service, including tenant-scoped access, role checks, encrypted provider credentials, signed webhook verification, audit records, redacted logging, frequency controls, and release testing. More detail is available on the Security page.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent where processing relies on consent. If Leavecart processes your data for a merchant, contact that merchant first; we will assist the merchant with the request.

You may also complain to the Estonian Data Protection Inspectorate or another competent supervisory authority. Contact us through the contact form or at polaroundeesti@gmail.com.

Cookies and changes

Leavecart does not currently use advertising cookies. The authenticated product uses essential session and security technologies needed to sign users in and protect the service. We may update this policy when the service or law changes and will post the revised date on this page.