Privacy Policy

1. Who We Are

CartAutomate is operated by CartAutomate. Our platform enables Shopify and WooCommerce merchants to automate customer communication, cart recovery, order updates, and marketing through the WhatsApp Business Platform (Meta). Our registered contact for privacy matters is privacy@cartautomate.com.

Under India's Digital Personal Data Protection Act, 2023 (DPDPA), CartAutomate acts as a Data Fiduciary for account and billing data of merchant users, and as a Data Processor for end-customer data processed on behalf of merchants.

2. Data We Collect

2.1 Account & Profile Data

• Name, email address, and account password (via Firebase Auth)
• Profile photo (if connected via Google Sign-In)
• Account creation date and login history
• Team member roles and permissions within your workspace

2.2 WhatsApp Business & Store Integration Data

• WhatsApp Business Account ID (WABA ID) and Phone Number ID
• Meta access tokens — stored encrypted at rest using AES-256 symmetric encryption; never logged in plaintext
• Shopify and WooCommerce store URLs, access tokens, and webhook secrets
• Product catalog data synced from your store

2.3 End-Customer Data (Processed on Your Behalf)

When you use CartAutomate to communicate with your customers, we process:

• Customer name, phone number, and email (imported from your store)
• Order details: order ID, items purchased, value, status, shipping address
• Abandoned checkout data
• Message delivery and read receipts from WhatsApp
• Conversation history between your business and your customers
• Custom contact tags and segmentation data you create

You are the Data Fiduciary for your end-customers' data. You remain solely responsible for obtaining valid consent from your customers for WhatsApp communications under applicable law, including the DPDPA and TRAI regulations.

2.4 Payment & Billing Data

• Subscription plan details, wallet balance, and transaction history
• Razorpay order ID and payment ID (for verification); we do not store card numbers, UPI handles, or bank account details — these are handled entirely by Razorpay
• Invoice and billing records required for GST compliance

2.5 Usage & Analytics Data

• Broadcast campaign statistics: sent, delivered, read, and failed counts
• Link tracking: clicks, timestamps, device type, browser, and OS
• Automation trigger and execution logs
• AI chatbot query logs (for improving response quality)
• Feature usage patterns to improve the platform

2.6 Technical & Device Data

• IP address (used for rate limiting and fraud detection)
• Browser type, operating system, and device type
• Session cookies and authentication tokens (HttpOnly, Secure)
• Server-side error and performance logs (retained for 30 days)

3. How We Use Your Data

• Service delivery: Processing orders, sending WhatsApp messages, running automations, and providing the dashboard
• Authentication & security: Verifying identity, detecting fraud, rate limiting, and preventing unauthorised access
• Billing: Processing wallet top-ups, subscriptions, and maintaining transaction records
• Platform improvement: Understanding feature usage and resolving bugs (no individual-level profiling for advertising)
• Support: Responding to queries, resolving issues, and investigating complaints
• Legal compliance: Meeting obligations under the DPDPA, IT Act, GST, and other applicable Indian laws
• Communications: Sending service-related notifications (downtime alerts, billing receipts, policy updates). Marketing emails require opt-in consent and can be unsubscribed at any time.

4. Legal Basis for Processing

We rely on the following legal bases under the DPDPA 2023 and, where applicable, equivalent provisions under the GDPR for users in the EEA:

5. Data Sharing with Third Parties

We do not sell personal data. We share data only as necessary to operate the platform:

6. Data Retention

After the retention period, data is permanently deleted or anonymised. Wallet transaction records and billing invoices are retained for the full 7-year period required by Indian tax law regardless of account closure.

7. Your Rights as a Data Principal

Under the DPDPA 2023 and applicable data protection laws, you have the following rights. To exercise any of these, email privacy@cartautomate.com with the subject line matching your request. We respond within 30 days.

8. Security Measures

We implement technical and organisational measures appropriate to the risk level of the data we process:

• All data in transit is encrypted using TLS 1.2+ (enforced at the infrastructure level)
• All data at rest in our database is encrypted using AES-256
• WhatsApp access tokens are stored with AES-256 symmetric encryption; the encryption key is stored separately in environment secrets
• Session cookies are HttpOnly, Secure, and SameSite=Lax — inaccessible to JavaScript and not transmitted over plain HTTP
• Payments are handled entirely by Razorpay (PCI-DSS Level 1 certified); we verify payment authenticity using HMAC-SHA256 signatures
• All API endpoints are protected by session authentication and IP-based rate limiting
• Webhook events from WooCommerce and WhatsApp are verified by HMAC signature before processing
• Audit logs are append-only and cannot be modified or deleted, even by admins
• Platform access is protected against brute-force attacks via rate limits and Firebase's built-in account protection

In the event of a data breach that is likely to result in high risk to your rights and freedoms, we will notify affected users and the relevant authority within the timeframe required by applicable law.

9. Cookies and Tracking

We use the following cookies:

We do not use third-party advertising cookies. We do not share browsing data with ad networks. Link tracking analytics (device type, browser, click timestamps) are collected server-side only when a user clicks a tracked link you have created.

10. Cross-Border Data Transfers

CartAutomate uses cloud services whose servers may be located outside India, including the United States and European Union. These transfers are necessary to deliver our services. We rely on the following safeguards:

• Firebase / Google:Google's Standard Contractual Clauses (SCCs) and adequacy decisions apply
• Supabase:Data processed under Supabase's DPA; we configure the ap-south-1 (Mumbai) region where available
• Meta:Meta's GDPR Data Transfer Mechanism and their Data Processing Terms for the WhatsApp Business API apply

As India's DPDPA cross-border transfer framework develops, we will update our practices to remain compliant.

11. Children's Privacy

CartAutomate is a business tool intended solely for merchants and their teams. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided data to us, contact privacy@cartautomate.com and we will delete it promptly.

12. Changes to This Policy

We may update this policy as our services evolve or as legal requirements change. Material changes will be communicated to registered users by email at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy. The latest version is always available at cartautomate.com/privacy.

13. Grievance Officer & Contact

In accordance with the Information Technology Act, 2000 and the DPDPA 2023, you may contact our Grievance Officer for data-related concerns:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India (once constituted under the DPDPA 2023) or the relevant data protection authority in your jurisdiction.