A recent post walked through who's actually liable if a shopper complains about a text, the split between a store, Shopify, and an SMS vendor, all governed by TCPA and carrier content policy. That's the legal floor, what's required. This is the other half of the question nobody asks until something's already gone wrong: what happens to a shopper's data beyond what the law demands, and what we've decided not to do with it regardless of what would technically be allowed.
Not to advertisers, not to data brokers, not to anyone. A conversation between a shopper and a brand exists to resolve that shopper's hesitation about that cart, nothing else. Selling the data behind it would mean turning a moment of genuine back-and-forth into a product traded to a third party the shopper never agreed to be visible to. That's not a service upgrade sitting on a future roadmap. It's not the business.
A shopper who tells CART she's deciding between two sizes, or asks whether a product runs true to size, is answering a question about a purchase, not opting into a profile that follows her across the internet afterward. That information gets used to answer her, and to help the brand understand what its own shoppers are asking. It doesn't get repackaged into a targeting segment sold or shared for advertising anywhere else, on or off the brand's own site.
Concretely, that means a shopper who mentions she's shopping for a gift, or that she's pregnant, or that she's between sizes because of a recent change, isn't handing that detail to an ad network that starts showing her related products across every other site she visits for the next month. The conversation stays scoped to the conversation. What she tells CART to get help with a cart doesn't become an input into an unrelated advertising system somewhere else.
None of this means the data goes nowhere. It answers the shopper in the moment, it feeds the pattern-recognition that catches a repeated sizing question or a shipping-cost objection worth fixing on the product page, and it produces the resolution-rate and recovered-revenue numbers a store sees in its own reporting. All of that stays inside the relationship between the shopper, the brand, and CART's own tuning process. The line isn't "we don't use the data." It's "we don't use it for anything beyond what the shopper was actually engaging with us to get."
An agency running CART across a dozen client brands doesn't get a shared pool of shopper data spanning all of them. Each brand's conversations stay that brand's. What one brand's shoppers say doesn't inform how CART talks to a different brand's shoppers, even under the same agency, even in the same category. A sizing pattern one brand surfaces doesn't quietly show up shaping responses somewhere else without that second brand's own data ever having said so.
Conversation data gets retained for as long as it's actually useful, resolving the cart it came from, tuning responses for that store, surfacing patterns back to the brand, not indefinitely, on the chance it might be useful for something undefined later. Retention tied to a real, ongoing purpose is different from retention because deleting things is more work than not deleting them. We chose the former.
None of the four things above are things TCPA or carrier policy specifically forces us to avoid. They're a decision about what kind of company this is, made separately from what compliance alone would technically permit. A shopper answering a real question in a text conversation is trusting that the exchange stays what it looks like: a conversation meant to help her decide, not raw material for something else. Break that trust once, even in a way that's technically compliant, and the whole premise of running a real conversation instead of a blast collapses. The value of a conversational system depends on shoppers actually believing it's a conversation.
Run your next 250 abandoned carts through CART, $0 charged, and see what it recovers before you commit to anything.
Book a Revenue Proof Call →