Who we are
DeadCart is a Shopify app published by Shahmir Alam (GDigital), House 55, Street 92, Sector G-6/1-4, Islamabad, Pakistan (“we”, “us”). It helps Shopify merchants collect their shoppers' WhatsApp numbers with a discount popup, track those shoppers' carts and follow up on abandoned carts over WhatsApp.
This policy explains what data the app handles, why, where it is kept, who can see it and how it is deleted. Questions: support@gdigital.pk.
Our role
- Merchant account data (the store using the app): we decide how it is used, so we are the controller.
- Shopper data (people who sign up through a store's popup): the merchant decides why it is collected and how they contact shoppers, so the merchant is the controller and we process it on their behalf. Shoppers who want to exercise their rights should contact the store first; we will help the store respond.
What we collect
From merchants, through Shopify
- Store details: shop domain, store name, store email, currency, time zone, country, primary domain and whether it is a development store.
- The access token Shopify issues when the app is installed, so the app can act for the store.
- App settings, the popup design and the current plan. Images uploaded for the popup are stored in the merchant's own Shopify Files.
From shoppers, when they sign up in the popup
- WhatsApp phone number and the country selected for it.
- Email address and first name, only if the store asks for them or the shopper is logged in to the store.
- The exact consent wording the shopper agreed to and the time they agreed, the page and trigger where they signed up, and the browser language.
- The single-use discount code created for them.
- Their cart: product titles, variants, quantities, prices, product images and links, cart value, and when the cart last changed or the shopper left the store.
- Their Shopify customer ID if they are logged in to the store.
From orders, through Shopify webhooks
- When an order is placed: the order ID, order number, total, discount codes used and the customer's phone, email and customer ID. We use these only to match the order to a signup and mark the cart as recovered or converted, then keep the order ID, number and total on that cart.
From website visitors who ask for early access
- The email address and, if given, the store address entered in the “Get early access” form, used only to tell you when DeadCart launches.
What we never collect
Payment card details, passwords, or the content of WhatsApp conversations. Messages are sent by the store from its own WhatsApp app; DeadCart has no access to WhatsApp accounts or chats.
How we use it
- To run the app: show the popup, create discount codes, track carts, flag abandoned carts and prepare WhatsApp messages for the store.
- To report results: count signups, abandoned carts, recovered orders and recovered revenue for the store.
- To give the store its own copy of every signup: each person who signs up is added to the store's Shopify customer list (or matched to their existing customer record), tagged “DeadCart” and “WhatsApp opt-in”, with the consent wording and time saved on the record.
- To bill for paid plans, which is done entirely by Shopify. We only see which plan a store is on.
- To keep the service secure and reliable: verify Shopify signatures, limit request rates and investigate errors.
- To answer support requests.
Legal bases
For merchants we rely on our contract with them (providing the app) and our legitimate interest in running a secure service. For shoppers, the store relies on the consent the shopper gives in the popup to be contacted on WhatsApp; the consent wording and time are recorded with each signup so the store can show it.
Browser storage on stores
On the store's website the popup stores a few small values in the shopper's browser (local and session storage, keys starting with “wa:”): a random browser ID, whether they signed up, their discount code, when they dismissed the popup, and page counts for popup timing. These are needed for the popup to work, are only read by the store's own website, and are not used for advertising or tracking across sites.
This website (deadcart.gdigital.pk) does not use cookies or analytics.
Who we share it with
We do not sell data or share it for advertising. It is processed only by:
| Provider | Purpose | Location |
|---|---|---|
| Shopify Inc. | The platform the app runs on: authentication, discount codes, files, orders and billing | Global |
| Hetzner Online GmbH | Server and database hosting | Nuremberg, Germany (EU) |
We may disclose data if the law requires it, and will tell the affected store unless we are not allowed to.
How long we keep it
- While the app is installed, data is kept so the store can follow up and see accurate reports.
- When a store uninstalls, the app stops working for it straight away. Shopify then sends a deletion request (usually 48 hours later) and we permanently delete all of that store's data: settings, signups, carts and codes.
- When a store or shopper asks Shopify to delete a shopper's data, Shopify tells us and we delete that shopper's signup and carts.
- Early-access sign-ups are kept until we have sent the launch email, then deleted; you can ask us to remove yours at any time.
- Server logs record request paths with technical IDs (a random browser ID, Shopify IDs), never names, phone numbers or emails. They are kept for a short time for troubleshooting and then discarded.
How we protect it
- All traffic is encrypted with HTTPS. The database is on a private network and is not reachable from the internet.
- Every request from a store and every webhook is checked against Shopify's signature before it is processed.
- Access to production systems is limited to the developer, with key-only SSH and automatic blocking of repeated login attempts.
- Popup signups are rate-limited and a shopper's cart can only be updated from the browser that signed up.
- If a breach affecting personal data happens, we will inform affected stores without undue delay.
Your rights
Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict its use, and complain to a data protection authority.
- Shoppers: contact the store where you signed up. Stores can also process your request through Shopify, which forwards it to us automatically. You can always ask a store to stop messaging you.
- Merchants: email support@gdigital.pk. Uninstalling the app also deletes your data as described above.
International transfers
Our servers are in Germany. Shopify processes data globally under its own safeguards. When data moves outside your country, we rely on the protections the providers above offer for such transfers.
Children
The app is meant for businesses and their adult customers. We do not knowingly collect data from children under 16.
Changes and contact
We will update this page when our practices change and note the date below. Significant changes will be announced in the app.
Last updated: 15 October 2026. See also our terms of service.