Privacy policy — Cartura

This Privacy Policy explains how Cartura Technologies LLC (“Cartura”, “we”, “us”) collects, uses, shares and protects personal information when you use the Cartura website, platform and related services (together, the “Services”). It should be read together with our Terms of Service.

For the personal information described in this policy, Cartura is the data controller. If you have any questions, contact us at [email protected].

1. Information we collect

Information you give us

Account information. Your email address, which you use to create your account and sign in. We do not use passwords; we email you one-time sign-in links instead.
Your activity in the Services. The products you submit for analysis (“scans”), such as product links, the results we generate for them, and the products you save.
Billing information. If you subscribe to a paid plan, your payment is handled by Stripe. We receive and keep your Stripe customer and subscription identifiers, your plan, billing interval and subscription status. We do not receive or store your full card details.
Communications. The content of any emails or messages you send us, for example support requests.

Information collected automatically

Usage information. Counts and timestamps of your scans and other actions, which we use to apply your plan’s usage limits and rate limits.
Technical information. Information your browser sends when you use the Services, such as IP address, browser type and device information, and the date and time of requests, recorded in server logs.
Cookies. See section 6 below.

2. How we use your information

We use personal information to:

create and manage your account and sign you in;
provide the Services, including running your scans and storing your saved products;
process payments and manage your subscription;
apply plan limits and protect the Services against fraud, abuse and security threats;
send you service emails, such as sign-in links, email-change confirmations, billing and account notices;
respond to your requests and provide support;
maintain, troubleshoot and improve the Services;
comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for third-party advertising.

3. Legal bases

Where data-protection laws such as the EU or UK General Data Protection Regulation apply, we rely on the following legal bases:

Contract — to provide the Services you sign up for, including your account, scans, saved products and subscription.
Legitimate interests — to keep the Services secure, prevent abuse, apply usage limits and improve the Services, where those interests are not overridden by your rights.
Legal obligation — to keep billing records and respond to lawful requests.
Consent — where we ask for it. You can withdraw consent at any time.

4. Platform data about sellers

The Services show information about products and sellers on TikTok Shop and other marketplaces, collected from publicly available sources. Some of it, such as a seller’s shop name, may relate to an identifiable person. We process this information on the basis of our legitimate interest in providing market research to our users, and limit it to business information that sellers have published on those marketplaces. If you are a seller and want to ask about or object to this processing, contact us at [email protected].

5. How we share information

We share personal information only as follows:

Service providers who process data on our behalf and under our instructions, including Stripe (payments), Resend (email delivery), and our hosting and infrastructure providers.
Legal reasons — when required by law, or to protect the rights, property or safety of Cartura, our users or others.
Business transfers — in connection with a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

6. Cookies and similar technologies

We use a small number of cookies, all needed for the Services to work:

Authentication cookies that keep you signed in and protect sign-in requests against forgery.
Preference and state cookies that remember interface choices, such as your avatar colour, and whether a scan is in progress.
Payment cookies set by Stripe when you check out, used for fraud prevention.

We do not use advertising or third-party analytics cookies. You can block or delete cookies in your browser settings, but you will not be able to sign in without them.

7. Data retention

We keep your account information, saved products and scan history for as long as your account is open. Temporary scan data is kept only as long as needed to complete and show a scan. When you delete your account, we delete or anonymise your personal information within 30 days, except where we must keep it — for example billing records required for tax and accounting purposes, or information needed to resolve disputes or enforce our agreements. Server logs are kept for up to 90 days for security and troubleshooting.

8. Security

We use administrative, technical and physical measures to protect your information, including encrypted connections, access controls and short-lived sign-in links. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping access to your email account secure, since it is used to sign in to Cartura.

9. International transfers

Cartura is operated from the United States and our servers are hosted there, so your information is processed in the United States. Our service providers may also process your information in other countries. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses or an adequacy decision.

10. Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy of it;
correct inaccurate information — you can change your email address in your account settings;
have your information deleted;
restrict or object to certain processing, including processing based on legitimate interests;
receive your information in a portable format;
withdraw consent where we rely on it.

To exercise any of these rights, email [email protected] from the address on your account. We may need to verify your identity before acting on a request, and we will respond within the time required by law. If you believe we have not handled your information properly, you can also complain to your local data-protection authority.

California residents: we do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your privacy rights.

11. Children

The Services are not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice in the Services, and update the “Last updated” date above.

13. Contact

Questions about this policy or your personal information? Email [email protected].