Privacy Policy

Who this app is for

CartPlus: Cart Drawer Upsell is a merchant app. Shoppers do not create accounts with us. The cart they see is Shopify’s cart, opened in a drawer on the merchant’s online store.

Permissions we request

When you install the app, Shopify shows these Admin API permissions: read_products,read_orders,read_themes. Those scopes are read_products, read_orders, and read_themes. We do not request the Files API (read_files).

• read_products — so you can pick upsell products from your catalog. Product images on upsell cards come from those catalog fields, not from the Files API.
• read_orders (protected customer data, Level 1) — so we can count orders against your plan cap and show shop-level revenue and product totals on Analytics. We store the Shopify order id, order total, currency, and catalog line-item fields (product id, title, type, quantity, line total). We do not store customer names, emails, addresses, IP addresses, or payment details, and we do not store raw order webhook bodies. This is data minimisation for merchant analytics and billing usage — not an “opt out” of protected customer data. Level 1 access is declared in the Partner Dashboard because order line resources are customer-related even when identity fields are unused.
• read_themes — so the app Home page can see whether CartPlus cart drawer is enabled on your published theme’s App embeds. We read theme settings only for that status, not to edit theme code.

We do not request shopper profiles or checkout payment details.

What we store

• Sessions — Shopify session storage for the embedded admin: shop domain, access token, and related auth fields. If Shopify provides the installing staff user’s name and email on the session, those fields are stored only for authentication, not for marketing.
• Shop billing fields — shop domain, install time, Shopify Billing subscription id and status, plan key, trial end, billing-period end, orders counted in the period, and development / Partner store flags from Shopify. These are merchant billing records, not shopper profiles.
• Drawer settings — labels, optional per-locale translations of those labels, colors, shipping-bar threshold, feature toggles, and optional custom CSS/HTML you save. Custom code stays stored if you downgrade. A plan change republishes the storefront config so paid-only fields are stripped until your plan allows them again.
• Upsell catalog ids — product and variant ids, titles, handles, image URLs, and prices you chose. Catalog fields only, not shopper records.
• Counted order ids — Shopify order ids so we count each order once against the plan cap, plus daily order counts.
• Analytics totals — shop-level daily counts for cart drawer opens, checkout clicks, and whether shipping bar, upsell, or related-product add-ons were shown; plus order totals, currency, and catalog product performance (product id, title, type, quantity, revenue). No shopper names or emails.
• Analytics token — a random shop token in the published drawer metafield so the storefront can send those event counts to our app origin without signing in. It is not a customer identifier.
• Compliance audit rows — shop domain, webhook id, topic, and status. We do not save the raw webhook body or shopper personal information.
• Shop metafield drawer_config — a copy of drawer options, upsell catalog fields, and (when analytics is enabled) the shop analytics token written to a shop metafield (app-owned namespace, key drawer_config) so the theme embed can read them.

What we do not store

We do not store shopper names, emails, addresses, payment details, or cart contents (shopper cart PII) on our servers. The drawer reads Shopify’s cart in the shopper’s browser only. Discount codes and cart notes entered in the drawer are applied on Shopify’s cart, not saved in our database. Storefront analytics beacons send event names only (for example impression or checkout click), not cart contents. Contact-form messages are emailed to support and are not saved in our database. Billing uses Shopify’s Billing API; we do not process cards ourselves.

Where data is hosted

Application servers run on Hostinger. The production database is PostgreSQL hosted by Supabase. Shopify session, shop, billing, drawer setting, upsell selection, and analytics records are kept while the app is installed and needed to provide the service.

Third-party services

We use Shopify for OAuth, Admin GraphQL, Theme App Extension delivery, and Billing API charges. Hosting is Hostinger; the database is Supabase. When the in-app Contact form is configured for outbound mail, messages are sent through Google’s Gmail SMTP to our support inbox. Otherwise Contact opens a mailto to sohilhunani11@gmail.com. We do not use a separate third-party monitoring, advertising, or analytics vendor; shop-level drawer and order analytics are stored in our own database.

GDPR and Shopify privacy webhooks

customers/data_request: we authenticate the webhook with HMAC, write an audit row with status no_customer_data, and return that we hold no shopper records to export. We do not persist the webhook body.

customers/redact: we hold no shopper rows for that customer, so there is nothing to delete. We audit the request the same way and do not persist the body.

shop/redact and app/uninstalled: we delete that shop’s sessions, drawer settings, upsell catalog rows, counted order ids, daily counts, analytics totals, product performance rows, and shop row. Shopify cancels the app subscription and revokes the access token on uninstall, so we do not call Admin billing from these webhooks. If a delete fails we return HTTP 5xx so Shopify can retry. Compliance audit rows are kept so we can show a request was handled. Shopify removes the app’s theme embed and shop metafields on uninstall.

How we access APIs

Admin product lookups and billing use Shopify’s HTTPS Admin GraphQL API from our servers. The storefront script calls same-origin Shopify cart URLs on your shop (for example /cart.js). Related-product suggestions on the storefront use Shopify’s Product Recommendations API in the shopper’s browser; we do not store those recommendation payloads. When analytics is on a paid plan, the drawer may send a GET from the shopper’s browser to our app origin with the shop domain, analytics token, and event names only. We do not put API secrets in the storefront script. This app does not include a third-party analytics or error-tracking SDK.

Retention

Shop and session data are kept while the app is installed. After uninstall or shop/redact they are deleted. Compliance log rows may be kept as long as needed to show that a request was handled.

Contact

Privacy questions: sohilhunani11@gmail.com. Merchants can also use Contact inside the app or the form on Support.