Privacy Policy

CartPulse is operated by Andreas Christopoulos, a sole trader based in Greece, Ortansias 21, 19003 Porto Rafti, Greece. For anything about privacy, write to team@cartpulsehq.com.

We are the "controller" of the personal data described here, as defined by the EU General Data Protection Regulation (GDPR).

Your account

• Your name and email address, and a password (stored as a secure hash, never in plain text). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your plan, and whether monitoring is active or paused.

Your stores

• Store name, store web address, the alert email you choose, and optionally a storefront password (only for stores that are still password protected, used only to get past the password page).
• An optional Slack webhook address, if you turn on Slack alerts.
• The product links you choose as “key products”.

When you install our Shopify app

• Your shop's domain, name, contact email and main web address, as provided by Shopify.
• An access token that lets the app read your products (permissions: read products and read inventory). The token is encrypted before it is stored.
• Your subscription status for CartPulse, which Shopify tells us. Payments are handled by Shopify. We never see or store card details.

Check results

For each check: the time, whether each step passed, response times, error messages, and the product pages and variants that were tested (titles, SKUs, availability).

When a checkout check fails, we save one screenshot of the store page our checker was on (one per incident). It shows what an anonymous shopper would see on your store, contains no customer data, and is sent to you in the alert email.

Technical information

Like most websites, our hosting providers keep short-lived server logs that can include IP addresses and browser type, used for security and fixing problems.

What we do not collect

CartPulse checks your store the way an anonymous shopper would. It does not place orders, does not log in as your customers, and does not access your customers' personal data, orders or payment information.

• To provide the service (contract): run checks, show results, send alerts and reports, and connect the Shopify app to your account.
• To bill you (contract): through Shopify's billing system.
• To keep the service secure and working (legitimate interest): logs, fixing errors and preventing abuse.
• To answer you (contract or legitimate interest): when you contact support.
• Legal obligations: keeping records required by Greek tax and accounting law.

We do not sell your data, use it for advertising, or share it with data brokers.

We use trusted service providers that process data only on our instructions:

• Base44: website, user accounts and database.
• Railway: servers that run the checks and the Shopify app.
• Resend: sending alert and report emails.
• Google Workspace: our support mailbox. Google also provides “Sign in with Google” if you choose it.
• Shopify: app installation and billing.
• Slack: only if you connect a Slack webhook; alerts are sent to the channel you choose.

Some of these providers are located in, or process data in, the United States. Where that happens, transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We may also disclose information if required by law, or to protect our rights or users' safety.

• Account and store data: while your account is active. When you delete your account or ask us to, we delete it within 30 days, except records we must keep by law.
• Deleting a store: when you delete a store in CartPulse, its check history, product test results and failure screenshots are deleted immediately and are no longer used or shown anywhere. You can download them first (history as CSV, screenshots as ZIP). Screenshot images are erased; other deleted records can remain for a while in our database provider's internal recovery storage until it is emptied.
• Check history: your plan shows the last 7, 30 or 90 days. We keep it while your account is active and delete it with your account.
• Failure screenshots: deleted automatically after your plan's history period (7 days on Spark, 30 on Pro, 90 on Enterprise), and with your account. Copies already sent to you by email stay in your mailbox.
• Shopify app data: uninstalling pauses monitoring straight away. About 48 hours later, when Shopify asks us to, we delete the shop's connection and, if you used CartPulse only through the Shopify app, your whole account with its stores, check history and screenshots. If you also have a cartpulsehq.com login, your account stays until you delete it or ask us to.
• Server logs: kept by our providers for a limited period, normally no more than 30 days.

If you are in the EU/EEA or the UK, you have the right to access, correct, delete or export your data, to object to or restrict certain uses, and to withdraw consent where we rely on it. To use any of these rights, email team@cartpulsehq.com. We reply within one month.

You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the data protection authority in your own country.

We do not use advertising or tracking cookies. The website stores a sign-in token and your light or dark mode choice in your browser so the site works. Shopify and Google may set their own cookies when you use their sign-in or the Shopify admin.

We use HTTPS everywhere, encrypt Shopify access tokens, limit who can access the database, and keep each account's data separate from other accounts. No system is perfectly secure, so please use a strong password.

CartPulse is a business service and is not meant for anyone under 16.

If we change this policy, we will update the date at the top. For important changes we will also email account owners.

Andreas Christopoulos (CartPulse)
Ortansias 21, 19003 Porto Rafti, Greece
team@cartpulsehq.com