Zypento helps ecommerce stores recover abandoned carts using AI agents. To do that, your store sends us cart data (items, customer email, etc.); we use that data only to compose recovery messages on your behalf. We don't sell personal information. Per-business AI feedback stays per-business.
The recovery agent composes messages by sending the AI provider (OpenAI, Anthropic, or Google, depending on your configuration) a tightly scoped prompt: the cart's line-item names, item prices, cart total, and your brand voice samples. The shopper's name and email address are not sent to the AI provider — they are substituted into placeholder tokens ({{{customer-name}}}, etc.) by Zypento after the model returns the draft, so the model never sees the recipient. Providers may briefly retain inputs they do receive for abuse-monitoring per their own policies.
The reaction/feedback loop is scoped to your business only. Comments you write in the dashboard feed into your business's next prompt; they are not shared across customers or used to train a global model.
We share data with a small set of subprocessors required to run the service. The list below identifies each one and the scope of personal data it can receive:
How recovery emails are actually sent. Zypento composes the recovery email body and the subject line, then hands the rendered content back to your store via a signed POST to your store's Zypento plugin endpoint. Your store delivers the email using its own infrastructure (typically WordPress's wp_mail() and whatever SMTP / transactional-email service you have configured on the store). Zypento does not transmit recovery emails to shoppers directly, and we do not act as a subprocessor of your own email-delivery vendor.
We don't sell personal data. We don't share it with advertisers. We will give reasonable advance notice (via in-product notice or to your account email) before adding any new subprocessor that receives shopper personal data.
We encrypt data in transit (TLS) and at rest. Access to production systems is logged and limited to engineers on call. We follow least-privilege principles for internal access. Suspected incidents: security@zypento.com.
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to processing. You can act on most of these directly from the dashboard, or email privacy@zypento.com and we'll respond within 30 days.
Zypento is built on cloud infrastructure that may process data outside your country. We rely on standard contractual clauses or equivalent transfer mechanisms where required.
Marketing pages set a small number of first-party cookies for session continuity and signed-in state. Dashboard pages additionally set a CSRF nonce. We do not use cross-site tracking cookies.
We may update this policy. Material changes will be announced at the email on your account at least 14 days before they take effect.
Privacy questions or data requests: privacy@zypento.com.