Privacy notice

CartCraft is operated by Shawean LLC, the controller responsible for the personal information described here. This notice covers our public website, waitlist, email communications and the authorized social account reporting described below. Contact support@cartcraft.build or write to Shawean LLC, 3206 NE 2nd Ave Suite 3207, Miami, FL 33137, United States.

Your email choices

Joining the waitlist requests a confirmation and CartCraft early access and launch emails. The separate, optional checkbox lets you request CartCraft tips, product updates and offers for dropshipping tools, including partner promotions. You can join without checking that box. Your choice does not affect your place on the waitlist or access eligibility.

Partner recommendations are sent by CartCraft. Checking the box does not give a partner permission to email you, and we do not give partners our waitlist for their own marketing. We may earn a commission if you use a recommended service. We disclose that relationship with the relevant recommendation. A partner website has its own privacy notice and terms.

Use the unsubscribe link in our emails to stop marketing and launch updates, or contact us for help. Withdrawing consent does not affect processing that was lawful before withdrawal. Updating this notice does not expand an existing subscriber’s permission.

Information we collect and why

• Your email address, signup and latest visit times, subscription status, email choices, consent times and disclosure versions. We use these to manage your place, send the messages you requested, record permission and respect unsubscribe requests.
• Campaign and referral details, landing paths, referring hostname, random visitor and session identifiers, and waitlist page, form and signup events. We use these to understand visits and which launch links lead to signups.
• Email delivery, bounce, unsubscribe and complaint records. Our email service can also record opens and link clicks to help measure message engagement and troubleshoot delivery.
• Messages you send to support and technical or security records needed to answer you, operate the site and prevent abuse. Hosting providers may process network addresses, browser information and request logs.

We receive information from you, your browser, referral links and the providers used to operate these services. The waitlist does not request payment details, a phone number or SMS permission. Without an email address, we cannot reserve a place or send an invitation.

Browser storage and security

The waitlist uses localStorage and sessionStorage for random visitor and session identifiers and campaign history. These identifiers are not used for fingerprinting. Browser attribution has a maximum 90 day application window; browsers may clear it sooner. Signup history stored in our database is separate. You can clear or restrict site storage in your browser, which can affect saved preferences and attribution.

For signup rate limiting, CartCraft processes a network address and stores a hash protected with a server secret instead of using the raw address as a marketing identifier. Access to waitlist records is restricted to authorized administrators and necessary providers. No online service can guarantee absolute security.

Legal bases

Where UK or European data protection law applies, we rely on your consent for the email updates you request and the optional marketing emails you choose. We rely on legitimate interests in operating and securing CartCraft, preventing abuse, responding to enquiries, maintaining preference records and understanding service performance, subject to your rights and any separate permission required for storage or tracking. We may also process records to meet legal obligations or establish, exercise or defend legal claims.

Providers and international processing

We use Supabase for database and server processing, Lovable for application hosting and publication, Loops for subscriber management and email delivery, and Resend for operational email and founder notifications. Necessary contact, preference, technical and delivery information is processed by these providers for those services. We do not sell waitlist contact data. We may disclose records when required by law or necessary to protect legal rights and service security.

CartCraft operates in the United States. Providers may process information in the United States and other countries with different data protection laws. Supabase’s applicable data processing termsinclude EU standard contractual clauses and a UK addendum. Loops’ data processing agreement requires appropriate safeguards for international transfers. Contact us for information about the locations and safeguards applicable to your information, or to request a copy of relevant safeguards.

How long we keep information

We keep active waitlist records while offering early access and handling launch invitations. Optional email subscription records are kept while that subscription remains active. Retention also depends on unresolved support requests, security investigations and applicable legal obligations. After you unsubscribe, we keep the minimum suppression and consent records needed to respect that choice and demonstrate how permission was obtained. Unsubscribing stops emails; it does not automatically erase every record. You can request deletion using the contact details above. Provider logs and backups follow their applicable retention schedules.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of your information, restrict processing, object to processing based on legitimate interests, and withdraw consent. You can object to direct marketing at any time. Contact us to exercise these rights. We may need to verify your identity using information reasonably necessary for the request. We do not penalize you for exercising applicable rights.

You may complain to your local data protection authority. In the UK, contact the Information Commissioner’s Office. In the EEA, contact the authority in your country of residence or work. This waitlist does not make automated decisions with legal or similarly significant effects.

Authorized social-account statistics

When an authorized operator connects a social account, CartCraft uses the provider’s official APIs, including YouTube API Services, to read owned account identity, post metadata and aggregate performance counts. Access and refresh tokens are encrypted server-side. These records are used for private Content and Creator Operations reporting, not posting or messaging. Access is limited to authorized operators and necessary service providers.

Provider observations and imported metadata are refreshed or removed within 30 days. You can disconnect and delete stored API data in Video Tracking; this does not delete content on the provider. Waitlist history and independently entered manual records are separate. App-owned publication keys and campaign correction history prevent duplicate records after reconnect; they do not identify viewers. Public YouTube statistics can use a server-held developer API key without access to private videos. You may also revoke Google access through Google account permissions. See the Google Privacy Policy and YouTube Terms of Service. Contact support@cartcraft.build to request deletion or ask about these data practices.

Children and other CartCraft features

The waitlist is not directed to children under 13, and we do not knowingly collect their information. Contact us if you believe a child submitted information so we can review and delete it. CartCraft accounts, store generation, payments, Shopify and other connected services involve additional data flows and terms beyond this waitlist notice.

Changes to this notice

The effective date identifies the current version. Material changes will be brought to your attention as required by applicable law. We obtain additional permission where required before using information for a new purpose.

Return to the waitlist