Privacy Policy

Effective date: July 13, 2026

Cart Uplift ("we", "us") is a Shopify app that adds AI product recommendations, bundles, and spend based incentives to your store's cart. This policy explains what data we process, why, and the choices you have. For data about your customers, you (the merchant) remain the data controller and we act as your processor.

Data we process

  • Store data: shop domain, store name, app settings, and theme extension configuration.
  • Catalog and orders: product, collection, and order line item metadata, used to learn which products are bought together and to power analytics.
  • Cart interactions: recommendation impressions, clicks, adds to cart, and purchases, recorded against pseudonymous session identifiers and Shopify customer IDs. We do not use shopper names or email addresses for these features.
  • Merchant contact: the shop owner email from your store profile, used for transactional emails such as a welcome note, setup help, usage notices, and results summaries.
  • Support: messages you send to our support email.

We never collect or store payment card data, and we never sell personal information.

How we use data

  • Generate product recommendations learned from your store's own orders. Each store's data stays scoped to that store and is never used to power another store's recommendations.
  • Run free shipping and gift thresholds, and bundle discounts.
  • Provide analytics: impressions, clicks, and revenue attributed to recommendations.
  • Send the merchant transactional service emails.
  • Maintain, secure, and improve the service.

Your privacy controls

The app admin includes privacy settings that control how much shopper behavior is collected. At the strictest level, behavioral profiles are not built at all. Recommendation and analytics features degrade gracefully to match whatever level you choose.

GDPR requests

We implement Shopify's mandatory privacy webhooks. Customer data requests and erasure requests sent through Shopify are honored automatically regardless of your app settings, and shop data is erased when Shopify issues a shop redaction request. You can also email us to request a full export or deletion of your shop's data.

Retention

We retain store and usage data while the app is installed. On uninstall, sessions and settings are deleted immediately and remaining event data is removed by scheduled cleanup within 30 days, unless a longer period is required by law.

Sub-processors

We rely on a small set of infrastructure providers: Shopify (app platform), Vercel (application hosting), Neon (database), and Resend (transactional email to merchants). Each processes data only as needed to run the service.

Legal basis

We process data to perform our contract with the merchant and under our legitimate interest in securing and improving the service.

Security

Data is encrypted in transit, access follows least privilege, and administrative access is restricted and logged.

Regional rights

If you are subject to GDPR, UK GDPR, or CCPA, you may have rights to access, correct, or delete personal data. Contact us to exercise them. We aim to respond within 48 hours.

Contact

Cart Uplift Support: support@cartuplift.com