Privacy Policy

This policy explains how Ecarter Technologies Private Limited ("CartWhizz", "we", "us") handles personal data. It follows India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

1. Two roles

• Merchants and visitors to cartwhizz.com: for your data, we decide how it is used. We are the data fiduciary.
• Shoppers on a CartWhizz store: the store owner decides how your data is used, and we process it for them. For questions about your data on a store, contact that store first. We will help them answer you.

2. What we collect

From merchants:

• name, email, phone, password (stored only as a secure hash), business name, GSTIN and billing address;
• store settings, products and content you add;
• invoices and payment status, and messages you send us;
• sign-in and security records (IP address, device and browser, time).

For stores, about their shoppers (processed for the merchant):

• name, email, phone, delivery and billing addresses;
• orders, carts, wishlists, reviews and messages to the store;
• sign-in records.

From visitors to cartwhizz.com:

• pages visited and how you arrived, through our own privacy-friendly analytics;
• details you type into the signup and contact forms.

We never see or store full card numbers. Card and UPI details go directly to the payment provider.

3. Why we use it

• to create and run your account and store;
• to bill you, issue GST invoices and keep tax records;
• to keep the platform secure and prevent fraud and abuse;
• to provide support and send service messages (invoices, security alerts, important changes);
• to improve CartWhizz, using usage data that is aggregated where possible;
• to send product news, but only if you agreed. You can unsubscribe at any time.

4. Cookies and tracking

• cartwhizz.com uses essential cookies, for example to keep you signed in, and our own first-party analytics. We do not run advertising trackers on cartwhizz.com.
• Stores may add Google Tag Manager, Google Analytics, the Meta Pixel, Meta Conversions API or similar tools. The store owner controls these and is responsible for telling shoppers about them.
• If you choose Sign in with Google, Google shares your name, email and profile picture with us, as Google's consent screen shows.

5. Who we share it with

We share data only as needed to run the service, with these providers:

Also shared:

• AI: CartWhizz AI runs on our own servers. Your questions and store data are not sent to outside AI companies.
• Store services: payment gateways, couriers, SMS/OTP providers and marketing tools that a store owner connects receive the data they need, under the store owner's control.
• The law: we disclose data to authorities when the law requires it.
• Sale of data: we do not sell personal data.

Some providers process data outside India. We transfer data only as Indian law allows.

6. How long we keep it

• We keep account and store data while the account is active.
• After a store closes, we delete or anonymise its data within 90 days, unless the law requires us to keep it.
• GST invoices and tax records are kept for the period the law requires (currently 8 years).
• Backups roll over and expire on their own schedule.

7. Your rights

You can ask us to:

• give you a summary of the personal data we hold about you;
• correct or update it;
• delete it;
• withdraw consent you gave, for example to marketing emails.

You can also name someone to exercise these rights for you. Email [email protected]. We reply within 30 days. If you are a shopper, we may pass your request to the store that holds your data.

8. Security

• Data is encrypted in transit (HTTPS). Passwords are hashed, and secret keys are stored encrypted.
• Access to systems is limited to people who need it.
• If a breach affects you, we will tell you and the Data Protection Board of India as the law requires.

9. Children

CartWhizz is for businesses and adults. We do not knowingly collect children's data. Stores that sell to children must get parental consent where the law requires it.

10. Grievance Officer

• Name: [Grievance Officer name to be added]
• Email: [email protected]
• Phone: +91 88260 92598
• Address: Ecarter Technologies Private Limited, 2nd, Apna Nagar, Near Mandi Samiti, Transport Nagar, Mathura, Uttar Pradesh 281001, India

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India.

11. Changes

We may update this policy. We will post the new version here with a new "Last updated" date, and email merchants about important changes.