Privacy Policy

1. Overview

Cart Rocket is a Shopify app that allows merchants to create pre-loaded cart links with products, discounts, purchase limits, and campaign tracking.

We collect only the data necessary to operate and improve the Service.

We do not sell personal data.

2. Information We Collect

Cart Rocket collects information in the following categories:

2.1 Store Information (From Shopify)

When you install the app, we receive limited store data via Shopify’s secure API, including:

• Store name
• Store domain
• Store email
• Shopify store ID
• Plan type
• Timezone
• Email address of staff members who open the app in your Shopify admin

This data is required to operate the Service. We request only the Shopify permissions the app’s features need.

2.2 Preset & Campaign Configuration Data

We store data you create inside Cart Rocket, including:

• Cart presets
• Selected products
• Variant selections
• Quantities
• Discount configurations
• Purchase limits
• UTM parameters
• Scheduling data
• Options page text, order tags, and link options
• Creator names, codes, and order tags you add for creator links

This data is necessary to generate cart links and enforce rules.

2.3 Order & Attribution Data

To provide analytics, we may access:

• Order ID
• Order total
• Order date
• Order attributes (including UTM parameters)
• Preset usage markers

Link statistics (links opened, checkouts started, checkouts completed, and orders and revenue per cart link and per creator) are stored as aggregated counts. They do not identify individual shoppers.

Orders are tagged only when the cart really came from a Cart Rocket link.

We do not access full customer payment information. We do not store credit card data.

2.4 Limited Customer Information

Cart Rocket does not intentionally collect or store sensitive personal customer information.

Some features need limited customer information:

• Per-customer purchase limits — Shopify customer ID and purchase count
• Links limited to specific customers — the customers you select (ID, name, email)
• Links prefilled for one customer — the email and shipping address you enter

This information is kept in your own Shopify store, in app records that cannot be read from your storefront. Cart Rocket stores no customer data in storefront-readable records.

Personal links carry a shopper’s details (such as email, name, address, or phone) in the link itself, filled in by your email or SMS tool. Cart Rocket passes those details to checkout when the link is opened and does not store them.

Shared carts (created when a shopper uses the Share cart button) contain only products, quantities, and purchase options. They contain no customer data.

We do not sell or use customer data for marketing purposes.

2.5 App Usage Data

We may collect anonymous usage data about the Cart Rocket app such as:

• Feature usage
• Preset creation activity
• Error logs
• App performance metrics

This helps us improve reliability and features.

2.6 Website Chat (cartrocket.dev)

This website has a chat assistant provided by Agentmatica. It runs only on cartrocket.dev. It is not part of the Cart Rocket app and does not run on merchants’ stores.

The chat loads on every page shortly after the page finishes loading, before you open it. When it loads, it creates a random chat session ID and contacts Agentmatica to fetch its settings and any earlier conversation from the same session.

When you send a message, Agentmatica receives:

• Your message and any images you choose to upload
• The address and title of the page you are on, and text from that page so the assistant can answer about it
• The last few pages you visited on this site in the same browser tab
• Your email address and message, if you choose to leave them in the contact form
• Any thumbs-up or thumbs-down feedback you give

Agentmatica uses AI model providers to generate replies. Your IP address is used to prevent abuse (rate limiting). We can read chat conversations and messages you leave so we can answer you and improve our help content.

Please don’t share payment details, passwords or other sensitive information in the chat.

3. How We Use Information

We use collected data to:

• Generate cart presets
• Enforce purchase limits
• Apply discount logic
• Track campaign performance
• Provide analytics dashboards
• Improve app performance
• Provide support, including answering website chat messages

We do not use merchant or customer data for advertising or resale.

4. Data Sharing

We do not sell personal data.

We only share data with:

• Shopify (as required to operate the app)
• The service providers listed in Section 9 (hosting, backups, internal notifications, merchant emails, and website chat)
• Legal authorities if required by law

All service providers are required to maintain data confidentiality.

5. Data Storage & Security

We implement reasonable technical and organizational safeguards to protect data.

Security measures include:

• Encrypted API communication (HTTPS)
• Secure hosting environments
• Limited internal access
• Authentication controls

However, no system can guarantee absolute security.

6. Data Retention

We retain data:

• While the app is installed
• As necessary to provide analytics
• As required for legal obligations

• Shared carts expire and are deleted after 30 days.
• Link statistics are kept as aggregated counts.
• Website chat conversations are kept by Agentmatica for the retention period of our Agentmatica plan, then deleted. You can ask us to delete a conversation at any time.

When Shopify sends us a customer redact request, we delete that customer’s data. When Shopify sends us a shop redact request after you uninstall, we delete your store’s data.

If you uninstall Cart Rocket, your preset data may be deleted within a reasonable period unless required for compliance.

To request data deletion, contact: hello@cartrocket.dev

7. GDPR & Data Protection (For EU Users)

If you are located in the European Economic Area (EEA), you have rights including:

• Right to access your data
• Right to correction
• Right to deletion
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact: hello@cartrocket.dev

Cart Rocket acts as a data processor for Shopify merchants. Merchants remain the data controller for their customer data.

8. California Privacy Rights (CCPA)

If you are a California resident, you may have rights under the CCPA, including:

• Right to know what data is collected
• Right to request deletion
• Right to opt out of data sale

Cart Rocket does not sell personal information.

9. Third-Party Services

Cart Rocket uses the following service providers (subprocessors):

• Shopify — Shopify APIs, used to operate the app
• Fly.io — app hosting and database. Backups may be stored in Tigris object storage, provided through Fly.io.
• Slack — internal notifications to our team about installs and plan changes. These contain store-level information only.
• Loops — lifecycle emails about the app, sent to your store email and to staff members who have opened the app
• Agentmatica — the chat assistant on cartrocket.dev (see Section 2.6). Agentmatica processes chat data on our behalf and uses AI model providers to generate replies. See Agentmatica’s Privacy Policy and Data Processing Addendum.

We are not responsible for the privacy practices of Shopify or other third-party services. You should review Shopify’s Privacy Policy separately.

10. Cookies & Tracking

The Cart Rocket app itself does not place cookies on end customers’ browsers.

This website (cartrocket.dev) uses cookies grouped into the following categories. When you first visit, a consent banner lets you accept all, reject all, or choose per category via “Save preferences”. Non-essential cookies are only set after you opt in.

• Strictly necessary — required for the site to function, including storing your cookie consent choice. These cannot be disabled.
• Analytics & performance — Google Analytics cookies that help us understand how visitors use the site. IP addresses are anonymized. Only set if you opt in.
• Cookieless counts — if you haven’t opted in to analytics, we still count page views and clicks on links to other sites (such as the Shopify App Store) without cookies. Your browser sends the page address and title, the referring site (domain only), any utm_source in the address, and the link you clicked to our server, which passes them to Google Analytics with no cookies, no IP address and one shared ID for every such visitor, so you can’t be told apart from anyone else. Nothing is stored on your device.
• Functional — enable enhanced features and personalization. Only set if you opt in.
• Marketing & advertising — used to deliver relevant ads and measure marketing campaigns. Only set if you opt in.

Website chat. The Agentmatica chat assistant does not set cookies. It loads whatever you choose in the cookie banner and uses your browser’s local storage and session storage to keep the chat working:

• A random chat session ID, treated as expired after 30 minutes without activity
• A short list of your recent chats with a preview of each, so you can reopen them
• A list of the last 10 pages you visited on this site, cleared when you close the tab
• A copy of page text used by the assistant, kept for 5 minutes

You can remove this data by clearing this site’s data in your browser.

You can change your preferences at any time via the Cookie preferences link in the site footer, or by clearing this site’s data in your browser, which resets your consent choice. For details on how Google processes data, see Google’s Privacy Policy.

Merchants may separately use UTM parameters, Shopify analytics, and third-party ad tracking tools. Cart Rocket does not control those systems.

11. Children’s Privacy

Cart Rocket is not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised “Last updated” date. Continued use of the Service constitutes acceptance of updates.

13. Contact Information

If you have questions regarding this Privacy Policy, please contact:

Cart Rocket
Email: hello@cartrocket.dev