Privacy policy
This covers Cartkept™ apps that work with Shopify and this website. It names each app and says what it stores. When we add an app, we add it here by name. Our Data Processing Agreement is part of our terms: /terms/.
Who we are
Cartkept™ is run by Benjo LLC, United States of America. Contact: hello@cartkept.com. Postal address available on request.
Two roles. For merchant account data (your shop details, your email address, your settings and your feedback) we are the controller: we decide why and how it is used. For your customers' data that an app handles for your store (for example the shoppers who use the Quote Form, the files shoppers upload through File Upload, or the customer names in an order export) we are your processor: we handle it only to run the app for you, on your instructions, and you are the controller. Our data processing agreement is part of our terms.
Why we use data (legal basis)
- To run the app you installed (shop details, settings, run logs, emails, the data an app handles for your store): needed to perform our contract with you.
- Keeping the service safe and working (the spam-protection hash in Quote Form, error logs, webhook records, answering your messages): our legitimate interest in running a secure, reliable service. It uses the least data we can, and you can object.
- Legal duties: keeping what the law requires and answering lawful requests.
- Site analytics and the design test on this website: for visitors in the EU, EEA, UK and Switzerland, only with your consent. Elsewhere, we count visits on the basis of legitimate interest and you can opt out (see "This website").
Apps covered
None of these is in the Shopify App Store yet. Each is coming soon.
- Cartkept Order Export: scheduled order exports by email.
- Cartkept Quote Form: a request-a-quote form on your storefront.
- Cartkept Delayed Ship Alerts: a daily check for shipments that have gone quiet.
- Cartkept Store Monitor: lost pages, dead links and new scripts in your store.
- Cartkept Consent: cookie consent, age gate and notice banners.
- Cartkept File Upload: an upload box on your product page, with the file attached to the order line.
Cartkept is not affiliated with Shopify.
What every app stores about your shop
- Your shop's domain, plan name, whether it is a development store, its time zone, the permissions you granted, and the app version.
- When the app was installed and uninstalled.
- The access token Shopify gives the app so it can act for your shop.
- A log of what the app did: when each export, check or run happened, the counts, whether it worked, and any error. Run errors are fixed messages we wrote, sometimes with a count or file size (for example "more than 5,000 orders in one period"). They hold no order contents and no customer details.
- Feedback you send us, with the optional reply address you type, and which "notify me" buttons you click.
- A record that Shopify's required webhooks arrived (topic and time).
We use none of this for advertising, and we do not sell it.
Cartkept Order Export
- Your settings: the email address you type, how often, the hour, the period, the filters and the columns you chose.
- The export file: to build it, the app reads your orders from Shopify. By default the file has order details and the customer's name. Customer email, phone and shipping address are off until you switch them on. Shopify controls access to customer details, so these columns can be unavailable.
- The file is kept for 7 days. It is stored on Cloudflare, behind a private download link that we send you. Anyone who has the link can download the file until it is deleted, so do not forward the email. After 7 days the file is deleted. We store only a one-way hash of the link, not the link itself.
- The email holds no order data. It has the counts for the run and the download link.
- The run log keeps when it ran, how many orders Shopify counted, how many were written, whether it was delivered, and any error. No orders.
The app runs only inside the Shopify admin. It adds nothing to your storefront.
Cartkept Quote Form
This app stores personal data on purpose, because storing every request is its job.
- What a shopper types: name and email always. Phone, company and message only if you switched those fields on.
- What they asked about: the product, variant and quantity, or nothing for a general question.
- Shopify customer id: only if the shopper was logged in.
- Delivery bookkeeping: when each request arrived, whether the email to you was sent, how many tries, an error code, and the draft order if you made one.
- Copied into a draft order: when you click to turn a request into a draft order, the shopper's email goes on the draft order, and their name, company, phone, message and requested items are written into its note, in your Shopify admin. The app does this only when you click.
- Your settings: the email address you type, which fields are on, and how long to keep requests.
- Not stored: the shopper's IP address, browser details, referrer, page address or cookies. To limit spam, the app keeps a one-way keyed hash of the network address for a short window, and deletes it within hours. The address itself is never written down. Requests caught by the hidden spam trap are stored empty for 7 days so you can see the count.
The email we send you contains the shopper's details. It passes through our email provider on its way to you.
How long: you choose 3, 6, 12 or 24 months. The default is 12. Older requests are deleted every day.
Cartkept Delayed Ship Alerts
- Your settings: the email address you type, how many quiet days count as stuck, the hour, and the time zone.
- Flagged shipments: for each shipment that looks stuck, its Shopify order id, order number (for example 1001), carrier, tracking number, status, the time of its last scan, and the first day it was flagged. A row is removed at the next check once the shipment is delivered, moving again, or older than 60 days.
- Check history: counts only (how many shipments were checked and how many were stuck). Kept 90 days.
- Never read or stored: customer name, email, phone, address or items. The app only asks Shopify for order numbers, carrier, tracking number and shipment status. It writes nothing back to Shopify.
The daily email lists order numbers, carriers and tracking numbers only.
Cartkept Store Monitor
- Your settings: the email address you type, the hour, and how often to scan links.
- Your store's addresses: a list of your products, collections, pages and blog posts (type, handle, address, title, and the dates it was seen or went missing).
- Links found in your content: each link's address, the result of checking it, and up to five places it appears (type, title, address). We keep the links, not the text of your pages.
- Script check: about once a day, our servers load your store's public home page, one product page, one collection page and the cart page (empty; nothing is added to it) from outside, the way a visitor's browser would, and record which script files they load (address, host, size in KB, and which app or company it appears to belong to). Public pages only: no login, no theme files, no customer data, and nothing about your visitors. The text of your pages is not kept. If your store is password-protected, the check stops.
- Scan and check counts. No customer data.
To check a link to another website, our servers request that address. We send nothing about you or your shoppers. The app's one write to your store is a redirect, and only when you click to create it.
How long: history is kept 90 days. Your current list of addresses is kept while the app is installed. For the script check, the list from the latest run is kept while the app is installed, a measured file size is reused for up to 14 days, a script that disappears is remembered for 14 days, and the records of a page getting heavier are deleted after 90 days.
Cartkept Consent
- Your settings, one row per shop: your banner rules and style, whether the re-open button is on, your plan, and the result of the last check that the banner is switched on in your theme.
- Nothing about your visitors. No consent choices, no IP addresses, no counts. A visitor's choice is held in Shopify's own consent record and in their browser. The banner makes no request to our servers. The age gate stores no date of birth.
The banner saves its settings to your store as an app setting that your theme reads. The "check my storefront" button loads your shop's home page from our servers to confirm the banner is there.
Cartkept File Upload
This app stores files that shoppers choose to upload, on purpose, because keeping them for the order is its job. It asks Shopify for no permissions and reads no customer or order data from Shopify.
- The file: JPG, PNG, WEBP, HEIC or PDF, up to 25 MB, kept in private file storage on Cloudflare. The file may contain anything the shopper uploaded, including personal data such as a photo of a person. We do not look inside it.
- About the file: a cleaned-up copy of its name, its size and type, when it was uploaded and the date it will be deleted. The file name is also added to the order line as the line item property "Upload", with a hidden link to the file, in your Shopify admin.
- Shopify customer id: only if the shopper was logged in to your store when they uploaded. Shopify signs it and passes it to the app.
- Who can open a file: each file has a long random link. Anyone who has the link can download the file until it is deleted, so do not forward it. Files are served only as downloads.
- Your settings and our logs: the alert email address you type, the file types you allow, how long to keep files, the daily test upload result, alert records (a short sentence, never a file name), and hourly counts of uploads, refusals and errors for the last 35 days.
- Not stored: the shopper's name, email address, IP address, browser details or cookies. To limit abuse, the app keeps a one-way keyed hash of the network address for about 10 minutes, and deletes it within about two hours. The address itself is never written down.
The emails we send you (alerts, the new-uploads count and the weekly summary) hold counts, short status sentences and a link to the app, never a file name or a file. The daily test upload writes a 16-byte test file to storage and deletes it at once.
How long: you choose 30, 90 or 180 days. The default is 90. Files past their date are deleted automatically, and you can delete any file sooner in the app. When you change the setting, it applies to files already stored too.
Who processes it for us
- Cloudflare: hosts the apps and keeps their database, the short-lived Order Export files and the files shoppers upload through File Upload, and serves this website.
- Resend: delivers the emails the apps send you. Resend keeps a copy of email content for up to 30 days. Order Export emails hold no order data. Quote Form emails hold the shopper's details. File Upload emails hold counts and no file names.
- askbowtie: website analytics for cartkept.com only (see "This website"); it is not used inside the apps. Its data is stored on Cloudflare's infrastructure. For visitors who have not consented (EU, EEA, UK and Switzerland) it runs in a cookieless mode that uses no browser storage and counts visits with a salted hash that rotates daily; the daily salts are deleted after two days, so a stored hash cannot be traced back to an IP address. Analytics data is kept to power historical comparisons, and operational logs are pruned automatically. See askbowtie's privacy policy.
We use them only to run the apps and the site. We do not sell data, and we do not share it for advertising.
Transfers outside your country
Resend processes data in the United States. Cloudflare runs a global network, so data may be processed in many countries. When personal data goes from the EEA, the UK or Switzerland to the United States, it is protected by the EU standard contractual clauses (with the UK addendum and Swiss changes), and by the EU-US Data Privacy Framework where the provider is certified. Cloudflare states that it is certified under the EU-US Data Privacy Framework, the UK extension and the Swiss-US framework, with the standard contractual clauses as a fallback (Cloudflare's GDPR page). Resend's data processing addendum incorporates the standard contractual clauses for transfers from the EEA, the UK and Switzerland. Ask us if you want the details.
Security
Your data is held on Cloudflare, and one person (the founder) has access to that account. Shopify webhooks are signature-checked before we act on them, export download links are stored only as a hash, and files are deleted after 7 days; we do not add our own encryption on top of Cloudflare's storage, including for the access token Shopify gives each app.
If we learn of a breach affecting your data we will tell you without undue delay and within 24 hours of becoming aware, the same period our Shopify partner agreement requires us to notify Shopify.
Uninstall and deletion
- When you uninstall, scheduled work stops at once and the access token is removed. Order Export, Delayed Ship Alerts, Store Monitor and Consent also delete their own data for your shop at that moment (Order Export includes any export files). Quote Form and File Upload keep your stored requests, files and settings until the step below, so you can still reach them if you reinstall within 48 hours. File Upload files are also deleted on their own deletion date if that comes first.
- 48 hours after uninstall, Shopify sends us a shop redact request, and we delete everything left for your shop: the run log, feedback, settings, for Quote Form its requests, and for File Upload every stored file and every record about it. The limit is 30 days. Our target is the same day.
- Customer requests: when Shopify forwards a customer data request, Quote Form emails you what it holds about that person, and Delayed Ship Alerts emails you the flagged shipments for the orders named. A customer redact request deletes the same records. For File Upload, a customer data request tells you to open the app, where the files uploaded by that customer are listed, and a customer redact request deletes the files that customer uploaded while logged in. A file uploaded by a guest carries no customer id, so a request about a customer cannot match it: you can delete it in the app, or it is deleted on its deletion date. Order Export, Store Monitor and Consent hold nothing about individual customers. Order Export files expire within 7 days. Requests are completed within 30 days.
How long we keep it
- Run logs: 90 days, then only daily totals with no shop name.
- Feedback: 24 months.
- Webhook records: 30 days.
- Export files: 7 days.
- Quote requests: the 3, 6, 12 or 24 months you choose.
- Uploaded files (File Upload): the 30, 90 or 180 days you choose.
- The sections above give the rest.
Your rights
You can ask us to show, correct, delete or export the data we hold about you or your shop, to restrict how we use it, or to stop using it where we rely on legitimate interest, and you can withdraw consent at any time. Email us and we will answer within 30 days (one month under the GDPR). Customers of a store should contact that store first. The store owner is responsible for that data and we process it on the store's behalf, and we will help the store answer.
Complaints. If you think we have handled your data wrongly, please tell us first. You can also complain to your data protection authority (in the EU, the authority in your country; in the UK, the ICO; in Switzerland, the FDPIC; in Australia, the OAIC).
US states. We do not sell personal information or share it for cross-context advertising, and we do not use it for targeted advertising or profiling. Residents of California and other US states with privacy laws can ask us to access, correct or delete their data, and we will not treat anyone differently for asking.
Australia. We handle personal information in line with the Australian Privacy Principles where they apply to us. Data sent overseas goes to the providers named above.
Children. Our apps are services for merchants. The Quote Form is used by a store's shoppers, and we do not knowingly collect personal data from children under 16 (the store decides who may use its form). If you think a child has sent us data, email us and we will delete it.
This website
cartkept.com uses an analytics script from askbowtie to count visits. It records the pages viewed, the referring site and any campaign tags in the link you arrived by. It is not used in the apps' admin pages, not used for advertising, and the data is not sold.
- In the EU, EEA, UK and Switzerland we ask first. Until you press Accept, the analytics runs in a mode that stores nothing on your device and gives no visitor id. Press Accept and we also keep a session id in your browser's local storage so one visit is counted once.
- Elsewhere the analytics runs with the session id in local storage, with a notice. Use "Opt out" in the notice, or the "Privacy choices" link in the footer, to stop it: nothing is sent to analytics and the stored session id is removed.
- Your choice is remembered in one small cookie,
ck_consent, which holds only "granted" or "denied". Change it any time with "Privacy choices" in the footer.
If you email us, we keep the email to answer you.
Contact
Questions or requests: hello@cartkept.com. For help with an app, see Support.
Changes
If we change this policy in a way that matters, we will update the date at the top and tell installed merchants by email.