Privacy and GDPR

Cart recovery touches personal data — email addresses and what people nearly bought — so the plugin is built to keep you on the right side of GDPR, CAN-SPAM and CASL by default. Settings → Privacy & GDPR.

Consent

Guests are captured only after ticking the consent box at checkout; its text is yours to edit, and it links to your Privacy Policy automatically. Signed-in customers can be captured from the cart page on the basis of your customer relationship — see How carts are captured for when to use each.

Unsubscribe

Every reminder carries an unsubscribe link, and one-click unsubscribe headers for mail providers that support them. An address that unsubscribes goes onto a suppression list and is never emailed again — by the sequence, by a manual send, by anything. The list is on the Privacy tab, with a Remove action for when someone asks to be re-added.

Retention

Data retention deletes carts that weren’t recovered after a number of days (60 by default; 0 keeps them forever). Recovered carts are kept because they’re your revenue record; the order itself lives in WooCommerce regardless.

Export and erasure requests

The plugin plugs into WordPress’s built-in tools under Tools → Export Personal Data and Erase Personal Data. A request for an email address includes that address’s captured carts and its unsubscribe entry.

Wording for your privacy policy

Go to Settings → Privacy → Policy Guide in wp-admin. The plugin contributes a ready-made section covering what is captured and on what basis, what is stored, the open-tracking image, unsubscribe, bounces and retention — written to match your current settings (if you’ve turned open tracking off, that paragraph is omitted). Copy it into your published policy and edit as you see fit.