Privacy Policy

1. Who we are

Cartly is a commerce platform for direct-to-consumer brands, available at joincartly.com. Cartly is a product of Hypebrand Private Limited (“Hypebrand”, “we”, “us”), a company incorporated in India with its registered office at Unit 302, Paragon Plaza, Phoenix Marketcity, Kurla, Mumbai 400070, Maharashtra, India. You can reach us at support@joincartly.com.

This policy explains what personal data we collect, why, where it lives, who else touches it, and what you can do about it. It covers two groups of people: merchants who create a Cartly account, and merchants’ customers whose details a merchant uploads or connects so Cartly can work on the merchant’s behalf.

2. What we collect

Merchant account

When you sign in with Google or with a magic link, we store your email address and, if Google provides it, your name. We do not receive or store your Google password. We store the workspace you create, the settings you choose and the time of your sign-ins.

Business data you upload

Cartly works from Shopify CSV exports you choose to upload, and from integrations you connect. Depending on what you bring over, this includes:

• Products — titles, descriptions, variants, prices, inventory and images.
• Customers — names, email addresses, phone numbers, tags and order history.
• Orders — line items, amounts, shipping and billing addresses, and fulfilment status.
• Where a store’s orders came from — for orders placed on a store built on Cartly, the source of the visit (for example an ad or a search), its campaign and the first page the shopper opened. If the merchant connects ad tracking, also the shopper’s IP address and browser type at checkout, kept only until the order has been sent to the ad platforms the merchant chose.

Billing details

If you subscribe to a paid plan, we keep your billing name, email address, billing address and GSTIN (if you give it), your plan, and a record of each payment: amount, date, status, invoice number and the Razorpay payment reference. Card, UPI and bank details are entered with Razorpay, not with Cartly (see section 4).

Integration credentials

To send WhatsApp messages through Waplify and to book shipments through Shiprocket, you give Cartly the API credentials for your own accounts with those services. We store these encrypted at rest and use them only to act on your instructions.

Usage logs

We keep operational logs of what Cartly did for you: which messages were queued and delivered, which shipments were created, which imports ran, and any errors. Our infrastructure also records standard request logs such as IP address, browser type and timestamps, which we use for security and debugging.

3. How we use it

• To run your workspace: importing your store data, showing your products, customers and orders, and keeping them in sync.
• To act on your behalf: sending WhatsApp messages to your customers, creating shipments and labels, and generating product copy or images when you ask for them.
• If you connect ad tracking, to tell the ad platforms you chose (Meta, Google) about the orders your store receives, so they can measure your ads. Email addresses and phone numbers are sent to them as hashes, never in plain text.
• To keep the service secure: authenticating sign-ins, detecting abuse and diagnosing faults.
• To talk to you about your account, including service notices and changes to these documents.
• To tell you about Cartly features, only if you have opted in, and you can opt out at any time.

We do not sell personal data, and we do not use your customers’ data to advertise to them or to build profiles for anyone other than you.

4. Payments

Cartly subscriptions. Payments for Cartly plans are processed by Razorpay. Your card, UPI, net banking or wallet details are collected and processed by Razorpay under its own privacy policy and the Payment Card Industry Data Security Standard (PCI-DSS). Cartly never receives or stores your full card number, CVV, UPI PIN or bank credentials; we receive only the payment status, amount, method type and reference needed to activate your plan, issue invoices and handle refunds.

Purchases from stores built on Cartly. When a shopper pays at a store that runs on Cartly, the payment is processed by the merchant’s own payment provider account (for example Razorpay, Cashfree, PhonePe or Stripe), under the merchant’s agreement with that provider. Cartly passes the order to the provider and records the payment status and reference on the merchant’s order; it does not store shoppers’ card or UPI credentials and does not hold shoppers’ money.

5. Legal bases

Where a legal basis is required, we rely on:

• Performance of a contract — providing the service you signed up for, including processing the customer and order data you upload and billing you for a paid plan.
• Legal obligation — keeping invoices and payment records for as long as tax and accounting laws require.
• Legitimate interest — keeping the service secure, preventing abuse, fixing bugs and understanding how Cartly is used, in ways that do not override your interests.
• Consent — sending you marketing about Cartly. You can withdraw consent at any time and it will not affect your use of the service.

6. Your customers’ data

For the customer, product and order data a merchant uploads, the merchant is the data controller and Cartly is the data processor. We process that data only to provide the service and only on the merchant’s instructions. The merchant is responsible for having a lawful basis to collect it and, in particular, for having the consent needed to message customers on WhatsApp.

The terms of that processing are set out in our Data Processing Addendum, which forms part of the agreement with every merchant.

If you are a customer of a Cartly merchant and want to know what a store holds about you, contact the store directly. If you write to us instead, we will pass your request to the merchant and help them respond.

7. Sub-processors

We use a small number of service providers to run Cartly. Each one receives only the data needed for its job.

Meta, Google Analytics and Google Ads work through accounts the merchant holds with them, under the merchant’s own terms with those companies.

We will update this list when a provider changes and, where the change materially affects your customers’ data, we will tell merchants by email before it takes effect.

8. Where data is stored

Your account and business data are stored in Supabase’s Mumbai (India) region. The Cartly application runs on Cloudflare’s global edge network, which means requests may be served from a data centre near you; the data itself remains in the Mumbai region unless you connect a service located elsewhere.

Data sent to Razorpay, Waplify, Shiprocket, Google, Meta or OpenAI is transferred to wherever those services operate, as described above. For merchants in the European Economic Area or United Kingdom, those transfers are covered by the providers’ standard contractual terms.

9. How long we keep it

• Raw CSV rows — the uploaded files and their unprocessed rows are deleted 90 days after import. The imported records (products, customers, orders) remain in your workspace.
• Account and workspace data — kept until you delete your account, or until we delete a workspace that has been inactive for a long period after giving notice.
• Invoices and payment records — kept for as long as Indian tax and accounting laws require (currently up to eight years), even after you delete your account.
• Integration credentials — deleted immediately when you disconnect an integration or delete your account.
• A shopper’s IP address and browser type — kept on the checkout only until its order has been sent to the ad platforms the merchant connected, and deleted straight away when none is connected. A checkout that never becomes an order is deleted with them within about a week.
• Usage and request logs — kept for up to 90 days for security and debugging, then deleted or anonymised.
• Backups — our database provider keeps short-rotation backups; deleted data drops out of them as they rotate.

10. Your rights

Whatever your location, you can:

• Access and export your data — from Settings in your workspace, or by emailing us.
• Correct anything that is wrong.
• Delete your account and everything in it — from Settings, or by emailing us. We complete deletion within 30 days.
• Object to processing based on legitimate interest, and withdraw consent for marketing at any time.
• Complain to your local data protection authority if you think we have got something wrong. We would rather you told us first so we can fix it.

Requests go to support@joincartly.com. We will answer within 30 days and may ask you to confirm you own the account.

11. India DPDP Act and GDPR

India

Hypebrand is based in India and follows the Digital Personal Data Protection Act, 2023. For merchant account data, Hypebrand Private Limited is the Data Fiduciary; for customer data uploaded by merchants, the merchant is the Data Fiduciary and Hypebrand is a Data Processor. You may exercise your rights under the Act, including access, correction, erasure, nomination and grievance redressal, by writing to support@joincartly.com or to our Grievance Officer (section 15). If you are not satisfied with our response you may approach the Data Protection Board of India.

European Economic Area and United Kingdom

If you are in the EEA or UK, the GDPR or UK GDPR applies. The legal bases we rely on are listed in section 5. We do not currently have a representative in the EU or UK; contact us directly. Transfers outside the EEA and UK rely on standard contractual clauses or the equivalent measures offered by each provider.

12. Cookies

Cartly uses only the cookies needed to keep you signed in: session cookies set by our authentication provider. We do not use advertising cookies, analytics cookies or third-party trackers on the marketing site or in the application. Because these cookies are strictly necessary, there is no cookie banner.

Stores built on Cartly. A store keeps its cart in a cookie. A merchant may also add Meta’s pixel, Google Analytics or Google Ads to their store; those scripts then set their own cookies for the store’s visitors. The merchant decides whether visitors are asked first, told, or neither, and is responsible for that choice where the law requires consent. A store also remembers in the visitor’s browser, for 30 days, where the visit came from, and counts visits without a cookie or an identifier of Cartly’s own.

13. Security

All traffic to Cartly is encrypted in transit. Integration credentials are encrypted at rest. Access to production systems is limited to the people who operate Cartly. We keep our dependencies up to date and review changes before they ship.

Cartly is a small, early-stage service. We have not yet undergone a third-party security audit or certification, and we do not claim one. If you find a security problem, please tell us at support@joincartly.com.

14. Children

Cartly is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If a merchant uploads customer records that include a child’s data, the merchant is responsible for having the required consent.

15. Grievance Officer

Under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you can raise a complaint about how we handle personal data, or about content on Cartly, with our Grievance Officer:

Sambhaji, Grievance Officer
Hypebrand Private Limited
Unit 302, Paragon Plaza, Phoenix Marketcity, Kurla, Mumbai 400070, Maharashtra, India
Email: support@joincartly.com (subject “Grievance”)

We acknowledge grievances within 24 hours and resolve them within 15 days of receipt.

16. Changes to this policy

We will update this policy as Cartly grows. Small changes will simply be published here with a new effective date. If a change affects what we collect or how we use it in a way you would care about, we will email account holders before it takes effect.

17. Contact

Hypebrand Private Limited (Cartly)
Registered office: Unit 302, Paragon Plaza, Phoenix Marketcity, Kurla, Mumbai 400070, Maharashtra, India
Email: support@joincartly.com
Web: joincartly.com