Privacy Policy

1 Introduction

CartBoost (“CartBoost”, “we”, “us”, or “our”) provides a Shopify application that adds a smart cart drawer, in-cart upsells, a free-shipping progress bar, urgency timers, and real-time cart analytics to Shopify stores. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the choices and rights you have.

CartBoost is operated by Zach Solution, located at Agadir, Morocco. This app is a SaaSHub product.

This policy applies to two groups of people: merchants who install and use CartBoost on their Shopify store, and shoppers (the merchant’s end customers) who interact with a storefront where CartBoost is installed. By installing or using CartBoost, you agree to the practices described here.

2 Information we collect

We collect information in the following categories:

a. Merchant & account data

• Your store’s myshopify domain, shop name, and store ID
• Contact details such as store owner name and email address
• Plan, billing status, and app configuration/settings you choose
• Store locale, currency settings, and timezone

b. Store data accessed through Shopify APIs

With the permissions you approve at install, we access store data needed to power the app’s features, which may include products and pricing (to recommend and display upsells), cart and checkout events, and order totals used for revenue attribution.

c. Shopper (end-customer) data

When a shopper interacts with a storefront running CartBoost, we process cart-interaction telemetry so the merchant can see how their cart performs. This includes:

• Cart events drawer opens, items added or removed, upsells viewed/added, free-shipping unlocks, and checkout starts/completions
• Attributed revenue and per-currency checkout totals for completed orders
• Device and surface type (e.g. mobile vs. desktop storefront) and browser locale
• Aggregate, store-level geographic distribution

d. Usage & technical data

• Log data such as IP address, request timestamps, and error diagnostics
• App performance metrics used to keep the storefront script fast and reliable

e. Cookies & similar technologies

CartBoost may use cookies, local storage, or similar technologies on the storefront to remember cart state, associate events within a single session, and respect a shopper’s consent choices. Cookie behavior on your storefront is also governed by Shopify’s consent tooling and your own store cookie/consent settings.

3 How we use information

• Provide the service render the cart drawer, upsells, shipping bar, and timers on your storefront
• Analytics & reporting produce the live telemetry stream, conversion funnel, top-upsell rankings, and revenue-by-currency views in your dashboard
• Revenue attribution connect cart interactions to completed checkouts so merchants can measure impact
• Support & communication respond to your requests and send essential service notices
• Billing manage plans and charges (processed by Shopify Billing)
• Security & improvement detect abuse, debug issues, and improve performance and features
• Legal compliance meet our legal obligations and enforce our terms

We do not sell personal information, and we do not use shopper data for cross-context behavioral advertising.

4 Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract to provide the app and features the merchant has requested
• Legitimate interests to secure, maintain, analyze, and improve the service, balanced against individuals’ rights
• Consent where required for certain cookies or customer-privacy-gated data, obtained through Shopify’s consent framework
• Legal obligation where processing is necessary to comply with law

For shopper personal data, the merchant is generally the data controller and CartBoost acts as a data processor acting on the merchant’s instructions.

5 How we share information & sub-processors

We share information only as needed to run CartBoost:

We may also disclose information to comply with the law, respond to lawful requests, protect our rights and users, or in connection with a merger, acquisition, or asset sale (with notice as required). We do not sell personal data to third parties.

6 Data retention

We keep information only as long as necessary for the purposes above:

• Account & configuration data for as long as the app remains installed
• Cart telemetry & analytics retained to power your dashboard history, and deleted or anonymized within 90 days of app uninstall unless a longer period is required by law
• Logs retained for a limited period for security and debugging, then deleted

When you uninstall CartBoost, we stop collecting new data and delete or anonymize associated store and shopper data in line with the periods above and Shopify’s mandatory data-removal webhooks (see Section 10).

7 Security

We use technical and organizational measures designed to protect information, including encryption in transit (HTTPS/TLS), restricted access controls, and reputable infrastructure providers. No method of transmission or storage is 100% secure, but we work to protect your data and to respond promptly to any incident in accordance with applicable law.

8 International data transfers

We and our sub-processors may process information in countries other than where you or your shoppers are located, including the United States and the European Union. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses to protect data transferred across borders.

9 Your privacy rights

Depending on your location, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent. Residents of the EEA/UK (GDPR) and of U.S. states such as California (CCPA/CPRA) have specific rights, including the right not to be discriminated against for exercising them.

Because CartBoost usually processes shopper data on a merchant’s behalf, shoppers should contact the store they shopped with to exercise their rights; we will assist that merchant as their processor. Merchants and anyone else can contact us directly using the details in Section 13.

You also have the right to lodge a complaint with your local data protection authority.

10 Shopify mandatory data requests

As a Shopify app, CartBoost supports Shopify’s mandatory GDPR/privacy webhooks:

• customers/data_request when a shopper requests their data, we provide the store-related data we hold to the merchant
• customers/redact when a shopper redaction is requested, we delete or anonymize that shopper’s associated data
• shop/redact 48 hours after a store uninstalls the app, we delete or anonymize the store’s associated data

11 Children’s privacy

CartBoost is a business tool for merchants and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided us personal data, please contact us and we will take appropriate steps to delete it.

12 Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify merchants through the app or by email. Your continued use of CartBoost after changes take effect constitutes acceptance of the updated policy.

13 Contact us

If you have questions, requests, or concerns about this Privacy Policy or your data, contact us:

• Email: support@cartboost.space
• Entity: Zach Solution
• Address: Agadir, Morocco

We aim to respond to all legitimate requests within the timeframe required by applicable law.