This Privacy Policy explains how Funnelish Pte. Ltd. ("Funnelish", "we", "us") collects, uses, shares and protects personal data when you use the Cart X app for Shopify, visit cart-x.io, or contact us. It also explains the choices and rights you have. Capitalised terms not defined here have the meaning given in ourTerms of Service.
1. Who we are
Cart X is operated by Funnelish Pte. Ltd., a company incorporated in Singapore, registered office at 68 Circular Road, #02-01,Singapore 049422. For privacy matters, contact us athey@cart-x.io.
2. Who this policy covers
We process personal data about three groups of people:
- Visitors to cart-x.io.
- Merchants: Shopify store owners and staff who install and use Cart X.
- Customers: shoppers of merchants' stores whose order data reaches Cart X through Shopify.
For customer data, the merchant is the data controller and we act as the merchant's processor (or service provider). We process customer data only to provide the Service to the merchant. If you are a customer with questions about how a store uses your data, please contact that store first; we will assist them in responding.
3. Information we collect
3.1 Merchants
- Store and account information provided by Shopify when you install Cart X: store name and domain, owner name and email, store address, currency, timezone, Shopify plan, and the store's unique identifiers.
- Configuration data you create in the app: funnels, offers, designs, uploaded images, settings, and A/B tests.
- Catalogue data from your store: products, variants, collections, prices, inventory and images, needed to build and display offers.
- Billing data: your plan, subscription status, and monthly order counts used to determine your plan. Payments are processed by Shopify; we never see your payment card details.
- Support communications: messages you send us by chat or email, and related metadata.
- Usage data: how you use the app (pages viewed, features used, device and browser information), collected through analytics tools described in section 7.
3.2 Customers
- Order data delivered by Shopify webhooks and APIs: order number and value, line items, discounts, currency, shipping and billing names and addresses, email address and phone number where provided, and order status.
- Checkout and cart events needed to show offers: products added to cart, cart value, whether an offer was shown, accepted or declined, and the resulting order changes.
- Technical data on storefronts, checkout and thank you pages where Cart X renders: browser and device type, approximate location derived from IP address, and anonymised identifiers used to prevent duplicate offers.
We do not receive full payment card numbers, CVVs or bank details. Post-purchase charges are executed by Shopify and the merchant's payment gateway.
3.3 Website visitors
- Technical data such as IP address, browser, device, referring page and pages viewed, collected through the analytics tools described in section 7.
- Anything you send us when you email us.
4. How we use information
- To provide the Service: display and process offers, update orders, render thank you pages, calculate analytics and attributed revenue, and sync with Shopify.
- To bill: determine your plan and manage subscriptions through Shopify Billing.
- To support you: respond to questions, troubleshoot issues, and send service messages such as plan-limit notices and important changes.
- To improve and secure the Service: understand usage, fix bugs, prevent fraud and abuse, and develop new features.
- To market Cart X to merchants: send product updates and tips to merchants who have installed the app or asked to hear from us. You can opt out at any time. We do not market to customers of merchants.
- To comply with law and enforce our Terms.
We do not sell personal data, and we do not use customer data to build profiles for advertising.
5. Legal bases (EEA, UK and similar jurisdictions)
Where data protection law requires a legal basis, we rely on:
- Contract: to provide the Service to merchants under our Terms.
- Legitimate interests: to secure and improve the Service, provide support, and market to existing merchants, balanced against your rights.
- Consent: for non-essential cookies and analytics where required, and for marketing where consent is required. You may withdraw consent at any time.
- Legal obligation: to keep records and respond to lawful requests.
For customer data we process on behalf of merchants, the merchant determines the legal basis.
6. How we share information
We share personal data only as described here:
- Shopify: Cart X operates within Shopify and exchanges data with Shopify's APIs to function. Shopify's own privacy policy applies to its processing.
- Service providers who host and run our infrastructure, deliver email, provide analytics, error monitoring and customer support tooling, under contracts that restrict their use of data to providing services to us. Our website is served through Cloudflare. Product and website analytics are provided by PostHog (see section 7).
- Funnelish group companies that help us operate and support the Service, under the same protections.
- Legal and safety: where required by law, to respond to lawful requests, to protect our rights or the safety of others, or to enforce our Terms.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
7. Cookies and analytics
We use cookies and similar technologies on cart-x.io and in the Cart X admin app. Essential cookies keep the app working and secure (for example, Shopify session tokens). Analytics cookies help us understand how the website and app are used.
| Purpose | Provider | What it does | Duration |
|---|---|---|---|
| Essential | Cart X / Shopify | Authentication, security, remembering settings | Session to 1 year |
| Analytics | PostHog | Page views, feature usage, device and browser, approximate location. Uses a random identifier; we do not identify website visitors by name. | Up to 1 year |
You can control cookies through your browser settings. Blocking analytics cookies does not affect the Service. On storefronts, Cart X sets only the minimal technical storage needed to display offers correctly (for example, to avoid showing the same popup twice), and merchants remain responsible for their own cookie notices.
8. International transfers
We are based in Singapore and our service providers operate in several countries, including the United States and the European Union. Where we transfer personal data out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, and we require recipients to protect the data to the standards described here. Transfers out of Singapore comply with the Personal Data Protection Act 2012.
9. Retention and deletion
- Merchant data is kept while the app is installed. After uninstall, we delete or anonymise store data within 48 hours of receiving Shopify's shop redaction request, except for billing records we must keep for accounting and legal purposes.
- Customer data is kept as long as needed to provide the Service to the merchant and for the merchant's analytics. We honour Shopify's customer data erasure requests (customers/redact) and data access requests (customers/data_request), normally within 30 days.
- Analytics data is retained in aggregated or pseudonymised form for up to 24 months.
- Support communications are retained for up to 3 years to help with follow-up questions.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls and least-privilege access for staff, logging and monitoring, and verification of Shopify webhooks. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority (for example, Singapore's Personal Data Protection Commission, your EU data protection authority, or the UK Information Commissioner's Office).
Merchants can exercise these rights by contacting us athey@cart-x.io. Customers should contact the store they bought from; the merchant can submit the request through Shopify and we will act on it. We will verify your identity before responding and reply within the time required by law.
California residents: we do not sell or share personal information for cross-context behavioural advertising, and we do not knowingly collect sensitive personal information. You have the right to know, delete, correct and to non-discrimination under the CCPA/CPRA, exercisable as described above.
12. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16 through cart-x.io or the Cart X admin. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, notify merchants through the app or by email.
14. Contact
Funnelish Pte. Ltd.
68 Circular Road, #02-01
Singapore 049422
hey@cart-x.io