Privacy policy

This policy explains how Cartify24 (“Cartify24”, “we”, “us”) collects, uses, shares and protects personal data when you use our website cartify24.com, the merchant dashboard at app.cartify24.com, and the online stores built with Cartify24 (at addresses like yourstore.cartify24.com or a merchant’s own domain). Together these are the “service”.

1. Who this policy covers

• Merchants: business owners and their staff who create an account and run a store on Cartify24. For merchant data, we decide how it is used (we are the data fiduciary).
• Shoppers: people who browse or buy from a store built with Cartify24. Each store is run by its merchant, who decides how shopper data is used. We process shopper data on the merchant’s behalf so the store can work. Questions about a particular store’s use of your data should go to that store first; we will help where we can.
• Visitors: anyone who visits our website or contacts us.

2. Information we collect

Merchants

• Account details: your name, email address, mobile number and password. Passwords are stored only as a secure hash; we cannot read them.
• Google sign-in details: if you choose “Continue with Google”, see section 3.
• Store details: store name, address, the type of business, GSTIN, logo, products, prices, images, pages, delivery settings and other content you add.
• Team members: the name and email address of staff you invite.
• Billing: your plan, invoices and payment status. Subscription payments are processed by Razorpay; we never see or store your full card number, UPI PIN or bank login.
• Integration keys: keys you enter for services such as Razorpay, Shiprocket or an SMS provider. These are stored encrypted.

Shoppers (processed for the merchant)

• Name, mobile number, email address and delivery addresses.
• Orders, chosen delivery slots, payment status (not card details), reviews you write, wishlist and stock-alert requests.
• One-time sign-in codes sent to your mobile or email.

Everyone

• Messages you send us through the contact form or by email.
• Technical data: IP address, browser and device type, pages visited and the time of each request, kept in server logs to run and secure the service.

3. Google user data

Merchants can sign up and log in to the Cartify24 dashboard with their Google account. This section explains exactly what we receive from Google and what we do with it.

What we access

When you choose “Continue with Google”, Google asks for your permission to share your basic profile with Cartify24. We request only the standard openid, email and profile permissions, which give us:

• your name;
• your email address, and whether Google has verified it;
• your profile picture (if you have one);
• a unique Google account ID, used to recognise you when you sign in again.

We do not request or receive access to your Gmail messages, contacts, Google Drive files, calendar, location, payment details or any other Google data, and we cannot post or act on your behalf in any Google product. We never see your Google password.

How we use it

• To create your Cartify24 account and sign you in securely.
• To show your name and picture in your dashboard and to your team members.
• To send you service emails about your account, store and subscription (such as order alerts, invoices and security notices).

We do not use Google user data for advertising, to build marketing profiles, to judge creditworthiness, or to train artificial intelligence or machine learning models.

How we share it

We do not sell, rent or trade Google user data. We do not share it with anyone except: Supabase, which stores our account database and handles sign-in for us; when you ask us to (for example, your name appears to staff you invite); or when the law requires it. Our staff do not read your data unless you ask us for support, we need to investigate abuse or a security issue, or the law requires it.

How we store and protect it

Google user data is kept in our account database hosted by Supabase. It is encrypted in transit (HTTPS/TLS) and at rest, and access is limited to authorised systems and staff.

Keeping and deleting it

We keep your Google profile details for as long as your Cartify24 account exists. To delete them, email support@cartify24.com from your account email; we delete your account and the Google data we hold within 30 days, except records we must keep by law (such as tax invoices). You can also remove Cartify24’s access to your Google account at any time from myaccount.google.com/permissions. After that you can still log in with your email and a password reset.

Limited Use

Cartify24’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• To provide the service: run stores, take orders, process payments, arrange delivery and send order updates.
• To create and secure accounts, including one-time codes, fraud prevention and rate limits.
• To send service messages by email, SMS or WhatsApp, such as order confirmations, delivery updates, sign-in codes and invoices.
• To bill merchants for their plan and keep tax and accounting records.
• To answer support questions and messages.
• To fix problems and improve the service, using aggregated or technical data.
• To meet legal obligations and enforce our terms of service.

If we send merchants news about Cartify24, every such email has an unsubscribe link. We never use shopper data for our own marketing.

5. Why we are allowed to use it

We process personal data under India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. We rely on the consent you give when you sign up, place an order or contact us, and on legitimate uses the law allows, such as fulfilling a request you made, meeting legal obligations and preventing fraud. You can withdraw consent at any time (see section 10); this does not affect processing that already happened.

6. Who we share it with

We do not sell personal data. We share it only with the following, and only as much as each needs:

• The merchant whose store you buy from, who receives your order and delivery details.
• Service providers that run parts of Cartify24 for us under contracts that protect your data:
  • Vercel: website hosting;
  • Supabase: database, file storage and sign-in;
  • Google: sign-in with Google (if you choose it);
  • Razorpay: subscription payments and, for merchants who connect it, store payments;
  • Resend: email delivery;
  • MSG91, Fast2SMS or Twilio: SMS and one-time codes;
  • Meta (WhatsApp Business): WhatsApp order messages, when enabled;
  • Shiprocket: shipping, when a merchant enables it.
• Analytics a merchant chooses: a merchant can add Google Analytics or a Meta Pixel to their own store. Those tools then collect browsing data on that store under the merchant’s control and the provider’s own policy. We do not add advertising trackers to our own website or dashboard.
• Authorities, when the law, a court order or a government request requires it, or to protect the rights and safety of users and the public.
• A buyer of our business, if Cartify24 is merged or sold, under the same protections as this policy.

7. Cookies and browser storage

• Essential cookies keep you signed in. A short-lived cookie remembers which store design a merchant is previewing. The service does not work without these.
• Browser storage remembers your cart, wishlist, recently viewed products and delivery pincode on your own device. You can clear it from your browser settings at any time.
• Analytics cookies are set on a store only if its merchant has enabled Google Analytics or a Meta Pixel.

8. How we protect data

All traffic is encrypted with HTTPS. Data is stored with providers that encrypt it at rest. Each store’s data is separated by database access rules, so one merchant cannot see another’s data. Passwords are hashed, integration keys are encrypted, sign-in attempts and forms are rate-limited and staff access is limited to those who need it. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

9. How long we keep data

• Merchant account and store data: while the account is active, and up to 90 days after it closes so it can be restored or exported.
• Orders and invoices: as long as tax and accounting law requires, usually 8 years.
• Server logs: up to 90 days.
• Contact messages: up to 2 years.

After that, we delete the data or make it anonymous.

10. Your rights and choices

You can ask us to:

• give you a summary or copy of the personal data we hold about you;
• correct or update data that is wrong or incomplete;
• delete your data and account;
• withdraw consent you gave earlier;
• name someone to act for you if you die or cannot act yourself.

Merchants can edit most details directly in the dashboard. For anything else, email support@cartify24.com from the email address on your account. We reply within 30 days. Shoppers should contact the store first; if the store does not respond, write to us and we will help. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Children

Merchant accounts are only for people aged 18 or over. Stores are not meant for children, and we do not knowingly collect children’s data without verifiable parental consent. If you think a child has given us data, email support@cartify24.com and we will delete it.

12. Where data is stored

Our service providers may store and process data in India and other countries. Where data leaves India, we use providers that protect it to the standard described in this policy and that Indian law permits.

13. Changes to this policy

We may update this policy as the service changes. The date at the top shows the latest version. If a change is significant, especially to how we use Google user data, we will tell merchants by email or in the dashboard before it takes effect and ask for consent again where required.

14. Contact and grievance officer

For privacy questions, requests or complaints, contact our grievance officer:

Cartify24 Email: support@cartify24.com

We acknowledge complaints within 48 hours and resolve them within 30 days.