Terms of service
These terms cover your use of Cartkept™ apps for Shopify. The data processing agreement (DPA) is part of them and starts at "Our role with your data" below. Not affiliated with Shopify.
Who we are
Cartkept is a product of Benjo LLC, a company in the United States of America. In these terms, "we" and "us" mean Benjo LLC. Contact: hello@cartkept.com. "You" means the business that installs a Cartkept app on its Shopify store.
The service
The apps are listed on our apps page. They are free to start. We provide them as they are, with no promise that they will run without interruption or be free of errors. We may change an app, add paid plans or stop an app. If we add a paid plan, we will say so before you are charged, and billing goes through Shopify.
Acceptable use
- Use the apps only for your own store and only as the law allows.
- Do not try to break, overload or get around the apps or their limits.
- Do not use an app to send spam or to collect data from people who have not been told about it.
- You are responsible for what you tell your own customers, including any notice or consent your law requires.
We may suspend an app for your store if you break these rules or put the service at risk.
Ending the service
You can stop at any time by uninstalling the app. We delete your data as set out in "Deletion" below. We may end the service with notice by email.
Liability
To the extent the law allows, we are not liable for lost profits, lost sales or indirect loss, and our total liability for any claim is limited to the amount you paid us for the app in the 12 months before the claim (nothing, for a free app). Nothing here limits liability that the law does not allow us to limit.
Governing law
These terms are governed by the laws of the United States and of the state in which Benjo LLC is registered, unless the law where you are says otherwise.
Changes
If we change these terms in a way that matters, we will update the date and email installed merchants before the change applies.
Data processing agreement
The sections below apply when we handle personal data for you. They are part of the terms.
Our role with your data
For the shop and customer data your store gives our apps, you decide why and how it is used, and we process it on your behalf and on your instructions. These terms and your use of the apps are your instructions. We use this data only to run the apps for you. We do not sell it, share it for advertising, or use it to train machine learning or AI models. We do not contact your customers, except where an app's job is to answer a request a shopper sent through your Quote Form, and then only by sending you the request. If we think an instruction breaks the law, we will tell you.
What we process and why
Each app stores only what its job needs. The privacy policy lists, app by app, what is stored, for how long, and what is never stored. That list is part of this agreement. In short: Order Export handles order and customer details to build your file, Quote Form stores the requests shoppers send, File Upload stores the files shoppers upload, Delayed Ship Alerts handles order numbers, carriers and tracking numbers, and Store Monitor and Consent hold no customer data.
Subprocessors
You allow us to use these:
- Cloudflare: hosts the apps, their database and short-lived files.
- Resend: delivers the emails the apps send you. It keeps email content for up to 30 days.
- Shopify: the platform your store runs on. The apps receive your store data from Shopify, and Shopify sends us the lifecycle and privacy requests below.
We are responsible for these providers' work for us. If we add or replace a subprocessor, we will update this list and email installed merchants first. You may object by uninstalling the app.
Security
These are measures in place today:
- All traffic to the apps and this website uses HTTPS.
- Shopify's webhooks are checked against their signature before we act on them.
- Each shop's data is kept separate by shop domain.
- Export file links are random, and we store only a one-way hash of each link. Files are deleted after 7 days.
- Only the founder has access to the systems that hold the data. Nobody looks through merchant or customer data without a reason such as a support request from you.
- Secrets and keys are kept out of our code repositories.
- We keep written policies on access, data retention and security incidents.
No system is perfectly secure, and we do not promise that. Our systems log requests but do not yet have automatic intrusion alerts.
Security incidents
If we find out that your data was accessed, lost or exposed without permission, or we suspect it, we will tell the affected merchants without undue delay and aim to do so within 24 hours of finding out, by email to the address on file for your shop. We will say what happened, what data, what we did, and what you may need to do. We report to Shopify within 24 hours as Shopify requires. We fix the cause at our own cost.
Deletion
When you uninstall, scheduled work stops and the access token is removed. Four of the apps delete their own data for your shop at that moment. Quote Form and File Upload keep your requests and files for 48 hours in case you reinstall. When Shopify sends the shop erasure request, 48 hours after uninstall, we delete everything left for your shop. When Shopify forwards a customer data request or customer erasure request, we handle it as the privacy policy describes, and we finish within 30 days. Retention periods are on the privacy page. We keep nothing longer than we say there, except what the law requires us to keep.
Helping you
If a customer or an authority asks you about data we process for you, email us and we will help within 30 days. You may ask us for the information we hold about your shop. Email us if you want to see or check what we do to meet these terms.
International transfers
Resend processes data in the United States, and Cloudflare runs a global network, so data may be processed outside your country. For transfers of personal data from the EEA, the UK or Switzerland, we rely on the transfer mechanisms our providers state they use: Cloudflare states that it is certified under the EU-US Data Privacy Framework (with the UK extension and the Swiss-US framework) and offers standard contractual clauses, and Resend's data processing addendum incorporates the standard contractual clauses.
Contact
hello@cartkept.com. For help with an app, see Support.