Automating retention marketing is not hard because deciding what to send is hard. Given decent data, choosing an audience and a message is the tractable part.
It is hard because an automated system that gets it wrong gets it wrong at volume, quietly, at three in the morning, to your best customers. The engineering that matters is the layer that constrains it.
The failure mode nobody plans for
The obvious disaster — an automation mails your entire list — is loud and gets fixed within the hour.
The expensive failure is quieter. A small group of customers qualifies for several campaigns at once, because the same behavior that makes someone a win-back candidate also makes them a reactivation candidate and a lapsed-subscriber candidate. Each campaign is individually reasonable. Together, that customer receives five messages in nine days.
They do not complain. They unsubscribe, or they stop opening, which is worse because it degrades your sender reputation invisibly and drags down deliverability for everyone else on your list. By the time it shows up in your open rates, you have lost months.
Every control below exists to prevent a specific version of that.
The controls
Volume caps
A hard ceiling on total sends per day and per week. This is the blast-radius limiter: whatever goes wrong upstream, it cannot exceed this. Telltale defaults to 200 per day and 500 per week, which is deliberately conservative — the assumption is that you will raise it once you trust the system, and that a low ceiling on day one costs you far less than a high one.
Per-customer cooldown
A minimum number of days between any two messages to the same person, across every campaign. Seven days by default. This is the control that prevents the five-messages-in-nine-days scenario, and it has to be enforced globally rather than per campaign — a per-campaign cooldown does nothing when the problem is five different campaigns.
Fatigue limits
A maximum number of touchpoints per customer per week, independent of the cooldown. Belt and braces, and it catches edge cases where several campaign types stack at the boundaries of their cooldown windows.
Deduplication windows
The same customer cannot receive the same campaign type twice within a short window — three days is a sensible floor. Prevents a customer being re-selected the moment a batch recomputes.
Minimum segment size
Campaigns below a small floor do not send at all. Micro-segments are where automated systems look silly: a "campaign" to two customers is not a campaign, and the modelled targeting behind it is almost certainly noise. Telltale requires at least five.
Quiet hours
SMS only between 8am and 8pm in the recipient's local time. This is not a courtesy setting — US messaging rules and carrier guidelines expect it, and the enforcement has to happen against each recipient's timezone rather than your own. A national list sent at 8am Eastern is arriving at 5am on the west coast.
The correct behavior when a send would fall outside the window is to hold it until the window opens, not to drop it and not to send anyway.
Suppression sync
Unsubscribes and opt-outs must be pulled from your email and SMS platforms on a schedule and honoured before every send. If someone opts out in your ESP on Tuesday, an automated system that last synced on Monday will contact them on Wednesday. That is both a compliance problem and exactly the kind of error that erodes trust in automation permanently.
Circuit breakers
If a downstream platform starts returning errors, sending should stop automatically rather than retrying into a wall. A reasonable rule: several failures inside a short window opens the breaker, and it half-opens later to test whether the problem has cleared. Without this, an outage at your ESP becomes thousands of failed sends and an unclear picture of who actually received what.
Dead letter queue
Failed sends should be retried a small number of times with meaningful spacing, then parked somewhere visible. Transient failures are common and recoverable; permanent ones need a human to look. Silently dropping either is how you end up with a campaign that reports success and reached half its audience.
Pacing: the control nobody ships
All of the above are ceilings. They stop bad things. They do not, on their own, produce good distribution.
Left to itself, an automated system over-contacts a small group of highly-qualifying customers and never touches a much larger group that qualifies for nothing in particular. The caps are respected the whole time — nothing is technically wrong — but attention is badly distributed.
Pacing per customer fixes this: track how recently each person was contacted relative to everyone else, and let under-contacted customers move up the queue while over-contacted ones rest. It improves response rates and unsubscribe rates simultaneously, which is unusual — most levers trade one against the other.
Approve-first is the real safety feature
Every control above is a guardrail. The strongest one is simply not sending until a human says so.
Approve-first mode does all the analysis — audience, timing, channel, offer, copy — and then stops. You see who is in the campaign and why before anything leaves. Most brands should run this way for the first few cycles across every campaign type, then enable full automation one play at a time.
Start with payment recovery: time-critical, no discount attached, small audience, and the customer wants the outcome. If automation is going to earn trust anywhere, it is there.
Sane defaults
If you are configuring a retention automation from scratch:
- Daily cap: low enough that a full day of mistakes is survivable
- Per-customer cooldown: 7 days, globally across campaigns
- Max touchpoints: 3 per customer per week
- Minimum segment: 5 customers
- Dedup window: 3 days per campaign type
- SMS: 8am–8pm recipient-local, held not dropped
- Suppression sync: daily, before any send
- Mode: approve-first until you have watched three cycles
These are Telltale's defaults, and they are all adjustable. The reason they start conservative is that the cost of a cap set too low is a few delayed sends, and the cost of one set too high is a deliverability problem that takes months to repair.
Install Telltale from the Shopify App Store, or read more about what an AI autopilot should and shouldn't do.