Legal

Privacy Policy

Issued by
Elastic Brain Pty Ltd (ABN 91 605 096 526), operator of Paykeel
Effective
27 June 2026
Last updated
9 July 2026
Version
1.3
Contact
privacy@paykeel.com

1. About this policy

Paykeel helps Shopify merchants recover lost sales — failed and declined payments and abandoned carts. When a payment fails or a cart is abandoned, Paykeel’s AI decides whether and when to reach the customer, and drafts a message in the merchant’s voice — on SMS and email — with a link to complete the order. This policy explains what personal information we handle to do that, how we use and protect it, and your rights under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We never store card numbers and we never charge cards. Recovery is always a link the customer completes themselves through Shopify’s checkout.

2. Who we are

Paykeel is operated by Elastic Brain Pty Ltd (ABN 91 605 096 526), an Australian company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and our messaging is subject to the Spam Act 2003 (Cth). For any privacy question, you can contact us at privacy@paykeel.com.

3. Who this policy covers

  • Merchants — Shopify store owners who install and use Paykeel.
  • Customers — people who had a failed payment or abandoned a cart with a merchant and whom we message on the merchant’s behalf.
  • Website visitors — anyone who browses paykeel.com.

For customer personal information, the merchant is the entity that decides why the data is used; Paykeel handles it on the merchant’s behalf to run the recovery loop. We do not use customer data for our own purposes.

4. Information we collect

  • From merchants: your store name and domain, contact details, and a Shopify authorisation token. We read orders, payment events, and checkouts; we do not change your storefront, products, or orders, and we never charge cards.
  • From customers (via Shopify): name, email, and phone number; order and checkout references; the payment’s decline reason; and payment-method metadata (such as card brand or type). We do not collect or store card numbers, CVV, or any cardholder data.
  • Abandoned-checkout data (via Shopify): for checkouts that weren’t completed, the items in the cart, the checkout reference and value, and the customer’s contact details.
  • Conversation and consent records: two-way SMS replies (including STOP requests) and the suppression records needed to honour opt-outs.
  • From website visitors: a first-party cookie (pk_vst) and basic analytics described in section 11.

We collect only the fields the recovery loop needs (APP 3 — data minimisation). We do not intentionally collect sensitive information; if we receive it inadvertently we destroy or de-identify it unless law requires us to keep it.

5. How we use your information

We use personal information to:

  • detect failed and declined payments and abandoned checkouts;
  • decide which lost sales are worth recovering and the right time and channel to reach out (see section 6);
  • draft and send a recovery message in the merchant’s voice, with a completion link;
  • honour opt-outs, quiet hours, and sending limits; and
  • report to the merchant on what was recovered.

We send factual, non-promotional messages about the customer’s own incomplete order — messages of this kind do not require marketing consent under the Spam Act 2003 (Cth). They go only to customers who haven’t opted out, within quiet hours and sending limits. Customers can opt out of SMS at any time by replying STOP, and we suppress further contact immediately. Where a message would carry marketing content, we first check the SMS or email marketing-consent status recorded in your Shopify store and send only with that consent. We never re-bill a customer’s card.

6. Automated decision-making and AI

Paykeel uses AI in a deliberately narrow way. Recovery messages use approved templates in the merchant’s voice, and their timing and channel follow fixed rules. When a customer replies, an AI assistant answers factual questions within strict limits — it cannot offer discounts, write links, or state an order status the system has not verified, and anything it cannot answer factually is handed to a human. To do this, limited personal information (contact details, order or checkout references, a decline reason, and the conversation) is processed by our AI infrastructure in Australia (see section 7 and section 8).

These decisions operate within limits the merchant sets — quiet hours, maximum contacts, and suppression of anyone who has opted out — and do not produce a legal or similarly significant effect on you. You can opt out of messages at any time, and you can contact us at privacy@paykeel.com with any question about how a decision was made.

7. When we disclose your information

We share the minimum personal information necessary with the service providers that run the recovery loop:

  • Shopify — the platform we read order, payment, and checkout events from.
  • AI infrastructure (AWS Bedrock, Australia) — to run the AI assistant that answers customer replies.
  • Twilio — to deliver SMS and receive STOP replies.
  • Resend — to deliver email.
  • Cloud hosting / infrastructure — to operate the service.

These providers act under data-processing terms and only handle data to perform their service. We do not sell personal information or “share” it in the sense used by privacy laws such as the CCPA, we do not share it for advertising, and we honour any request to opt out of the sale or sharing of personal information. We may disclose personal information to regulators, courts, or law enforcement where required by law; where permitted, we will notify the affected party.

8. Overseas disclosure (APP 8)

Your recovery data — the customer contact details, order and checkout references, and decline reasons we use to run the recovery loop — is stored in Australia.

AI processing runs on AWS Bedrock in Australia (Sydney region) — conversation content used for AI replies does not leave Australia.

Some providers necessarily process data overseas:

  • SMS (Twilio) and email (Resend) process message contents overseas, primarily in the United States, under data-processing agreements. SMS is sent from an Australian sender number.
  • Shopify processes your store and order data globally under its own terms; it is the source of the data and your existing platform.

Where personal information is disclosed overseas, we take reasonable steps under APP 8 to ensure it is handled consistently with the Australian Privacy Principles.

9. How we protect your information

  • Sensitive fields — contact details, message content, credentials, and opt-out records — are encrypted at the application level; all traffic is encrypted in transit.
  • Suppression records encrypted so opt-out checks work without exposing contacts.
  • Access to customer data limited to authorised personnel.
  • Test and production data kept separate.
  • No card data is ever stored.
  • Customer data is destroyed when a merchant uninstalls Paykeel.

We maintain a documented security incident-response process. If an eligible data breach occurs, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals under the Notifiable Data Breaches scheme.

10. How long we keep your information

We keep personal information only as long as needed to run the recovery loop and to meet our legal obligations, then delete or de-identify it. Our retention periods are:

  • Recovery records (customer contact, order/checkout reference, decline reason, payment-method metadata, abandoned-cart contents) — kept for up to 12 months, then deleted or de-identified.
  • Two-way SMS conversation logs — 12 months, then purged.
  • Opt-out / suppression records (for example, STOP requests) — kept while the sending number remains in service so we can continue to honour the opt-out; we store only the minimum needed to do so.
  • Raw Shopify webhook payloads — kept for up to 12 months, then scrubbed.
  • Website attribution cookie (pk_vst) — 90 days; server access logs are kept no longer than 90 days.
  • Aggregated, de-identified analytics — retained indefinitely, as it identifies no individual.

When a merchant uninstalls Paykeel, we destroy the customer personal information associated with that store. Opt-out (STOP) records are kept while any store uses the sending number, so an opt-out keeps being honoured even if an individual store leaves and returns; when a number leaves service entirely, its records are deleted with the last store’s data.

11. Cookies and tracking

We use a first-party cookie (pk_vst) on paykeel.com to understand which channels and pages produced an enquiry. It holds an opaque session identifier, is not shared with third parties, and you can clear it any time via your browser’s cookie controls. We do not use advertising cookies.

12. Your privacy rights

Under the Privacy Act and the APPs, you have the right to:

  • Access the personal information we hold about you (APP 12);
  • Correct information that is inaccurate, out of date, or incomplete (APP 13); and
  • Complain if you believe we have interfered with your privacy. If you are not satisfied with our response you can escalate to the OAIC on 1300 363 992 or oaic.gov.au.

Customers can opt out of SMS at any time by replying STOP — we suppress further contact immediately. Where a store uses a shared sending number, a STOP applies to every store using that number. To opt out of email, or for any other request, email privacy@paykeel.com and we will suppress contact. Because the merchant decides how customer data is used, we may direct some requests to the relevant merchant and assist them in responding.

Paykeel helps merchants message customers lawfully, but it does not discharge a merchant’s own obligations under the Privacy Act or the Spam Act for their customer relationships.

13. Children’s privacy

Paykeel is a business tool not directed to individuals under 18, and we do not knowingly collect personal information from minors.

14. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal obligations. When we make material changes we update the version number and the “last updated” date at the top of this page.

15. Contact us and complaints

For privacy enquiries, access or correction requests, or complaints, contact us:

If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC) on 1300 363 992 or at oaic.gov.au.

Effective 27 June 2026 · Version 1.3. This policy will be reviewed with legal sign-off before general availability.