1. Who we are
CartYatra is a Shopify app operated by [COMPANY LEGAL NAME], [REGISTERED BUSINESS ADDRESS] (“CartYatra”, “we”, “us”). Contact: privacy@cartyatra.com.
2. Our two roles
Merchant data: for information about merchants who install CartYatra (store domain, staff access via Shopify, billing plan, support emails), we act as a controller.
Store visitor data: for analytics data about visitors to a merchant's store, the merchant is the controller and CartYatra acts as a processor (service provider), processing data only on the merchant's instructions under our Data Processing Agreement.
3. Data we collect about store visitors
- A random browser identifier provided by Shopify (not a name or account)
- Pages viewed (path only, with personal parameters removed), page titles
- Products, variants, quantities and prices viewed or added to cart
- Search terms, filtered to remove anything that looks like personal data
- Cart and checkout progress (which steps were completed, never what was typed)
- Order ID and order value for matched purchases
- Device type, campaign (UTM) tags and referring website domain
- Approximate location: country, state/region and city, derived from the IP address, which is not stored
We do not collect names, email addresses, phone numbers, postal addresses, IP addresses, form contents, passwords or payment details.
4. Consent
CartYatra's tracking uses Shopify's Web Pixel with the Analytics purpose only and follows Shopify's Customer Privacy API. Where a visitor has not given, or has withdrawn, consent for analytics, no data is collected. Sale of data is disabled.
5. How we use data
- To provide CartYatra's reports to the merchant (journeys, drop-off, product and location reports)
- To confirm purchases against Shopify order records
- To operate, secure and improve the service, including bot and abuse protection
- For merchants: to manage accounts, billing and support
We do not sell or share personal information, use it for advertising, or build profiles of individuals.
6. Legal bases (GDPR / UK GDPR)
As a processor, we rely on the merchant's legal basis, normally consent for analytics cookies. For merchant data, we rely on contract performance and legitimate interests (security, service improvement).
7. Retention
Visitor journeys are kept according to the merchant's plan: 14 days (Free), 60 days (Starter), 6 months (Growth) or 12 months (Pro). Non-identifying daily totals are kept for up to 12 months. When a merchant uninstalls, tracking stops immediately and data is deleted after Shopify's shop deletion request (48 hours after uninstall). Backups expire within [30] days.
8. Sharing and sub-processors
We use a small number of service providers to host and run CartYatra, listed on our sub-processors page. They process data only on our instructions.
9. International transfers
Where data is transferred from the EEA, UK or Switzerland to other countries, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where applicable. EU hosting is available for EU merchants.
10. Security
Encryption in transit (TLS) and at rest, Shopify-signed authentication, verified webhooks, strict per-store data isolation, least-privilege access, audit logging and regular dependency updates.
11. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, and to data portability. California residents have rights under the CCPA/CPRA, including to know, delete and opt out of sale or sharing (we do not sell or share). Store visitors should contact the store they visited, which is the controller; we will assist. Merchants can email privacy@cartyatra.com. You may also complain to your local data protection authority.
12. Children
CartYatra is a business tool and is not directed at children. We do not knowingly collect children's personal data.
13. Suggested wording for merchants
Merchants may add to their store privacy notice: “We use CartYatra, an analytics app, to understand how visitors use our store. With your consent, it records anonymous browsing and checkout steps and approximate location (country, region, city). It does not collect your name, contact details, IP address or payment information.”
14. Changes
We will post updates on this page and change the “last updated” date. Material changes will be notified to merchants in the app or by email.
15. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| [Hosting provider, e.g. AWS / Google Cloud / Fly.io] | Application hosting and database | [Region, e.g. US and EU] |
| [Email provider, e.g. Postmark / Resend] | Weekly summary and support emails (merchant data only) | [Region] |
| [Error monitoring, e.g. Sentry] | Error tracking (no visitor personal data) | [Region] |
| Shopify Inc. | App platform, authentication and billing | Canada / global |
Approximate location is looked up with a database hosted on our own servers; IP addresses are not sent to a third party.
We update this page at least 30 days before adding a sub-processor. To get notified, email privacy@cartyatra.com.
16. Cookies
This website
cartyatra.com uses only cookies that are strictly necessary for the site to work. If we add website analytics, we will ask for your consent first and update this page.
The CartYatra app on Shopify stores
On merchants' stores, CartYatra uses Shopify's Web Pixel, which relies on Shopify's own browser identifier. It runs only when the visitor's choices in the store's consent banner allow analytics. Merchants manage consent through Shopify's customer privacy settings.
Managing cookies
You can control cookies through your browser settings and, on Shopify stores, through the store's cookie banner.