Privacy Policy

What we collect

• Purchase data — your email address, which product you bought, the amount, and an order reference. We need this to deliver the product you paid for and to let you recover access later.
• Product requests — if you ask us to build something that is not in the store, we store the product name, the description you write, and your email address, so we can consider the request and tell you if we list it.
• Support messages — if you email us, we keep the message and your address so we can answer and refer back to it.
• Payment details — we never see or store your card. Payment is handled entirely by Link (a Stripe company) on their own systems.

What we don't do

We do not sell or rent your personal data. We do not run advertising trackers or third-party ad pixels on this store, and we do not build advertising profiles about you. We do not require an account, so we hold no passwords for this store.

Data you enter into a demo or a product

Our tools run in your own browser. Anything you type into a demo or into a product you have bought — client names, invoice line items, amounts — is stored locally on your device and is never sent to Cartlyt. We cannot see it, and clearing your browser storage deletes it. When you export or print a file, that file is generated on your device too.

Why we're allowed to hold it

We process purchase data to perform our contract with you (you paid for a product; we must deliver it and keep it available). We keep records of sales where we have a legal obligation to do so, such as tax and accounting rules. Where we rely on consent — for example, emailing you to say a product you asked for is now in the store — you can withdraw it at any time by replying to any of our emails or writing to support@cartlyt.com. We rely on our legitimate interest in running and securing the store to answer support messages and to prevent fraud and abuse.

Your access link

Each purchase gets a unique, unguessable access link so you can re-open what you bought without creating an account. Treat it like a receipt: anyone who has the link can view that product. If you believe a link has been shared or exposed, contact us and we will issue you a replacement and retire the old one.

Who we share it with

Only the providers required to run the store: Link/Stripe (payments, receipts and tax, as merchant of record), Resend (delivery and recovery emails), Vercel (hosting), and Neon (database). Each processes data on our instructions and under its own security obligations. We may also disclose data where we are legally required to.

How long we keep it

Purchase records are kept for as long as needed to provide access to what you bought and to satisfy tax and accounting requirements — expect several years, because we are required to keep them. Product requests that we do not act on are deleted once they are no longer under consideration. Support messages are kept while they are useful for context, then removed.

Your rights

Depending on where you live (including the UK/EU under GDPR and California under CCPA), you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to complain to your local data protection authority. To exercise any of these, email support@cartlyt.com from the address on your order. Note that deleting your purchase record also removes your ability to recover the product, so we'll confirm before acting. Records we are legally required to retain for tax purposes cannot be deleted on request.

Cookies

We use only what the site needs to function — for example, remembering your light/dark theme preference. We do not use advertising or cross-site tracking cookies on this store. Our payment provider sets its own cookies on its checkout pages, under its own policy.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Children

Cartlyt.net is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

Changes and contact

We may update this policy; the date above reflects the current version. Questions or requests: support@cartlyt.com. See also our Terms of Sale and Refund Policy.