CART ME · MERCHANT RESOURCES

Privacy, considered.

How Cart Me handles information while helping merchants create their cart experience.

Effective date: 4 November 2026. This policy covers the Cart Me Shopify app and its website, operated by BM Global.

Information we use

When a merchant installs Cart Me, Shopify provides the shop domain, authorized access scopes, authentication tokens, and session information. Depending on the session, this can include the staff user’s name, email address, Shopify user ID, language, and account role.

We store the merchant’s cart design, uploaded logo, custom content, reward tiers, selected product references for upsells, and the Shopify discount identifier needed to provide the service. Information sent to support is used to respond to that request.

When subscription billing is enabled, Cart Me reads an aggregate count of live and test store orders to display plan usage. Cancelled orders are excluded. Individual order records and customer identities are not stored for this purpose. Cart Me reads product and published-theme information through Shopify’s APIs to show previews and determine whether its embed is enabled. The drawer processes cart items, quantities, and totals in the shopper’s browser using Shopify’s cart services. Cart Me does not persist shopper names, addresses, payment details, or order histories in its application database.

For the merchant’s revenue dashboard, Cart Me reads order creation dates, its private checkout attribution attribute, and net payment totals from Shopify for the last 30 days or current subscription cycle. Only aggregate counts and currency totals are cached temporarily in server memory; individual order records are not written to the application database. Paid, non-cancelled orders are counted. Order reporting combines live and test orders in one view. Test transactions are included in the displayed order counts, revenue and AOV, and remain excluded from subscription usage. Revenue is payments received minus refunds, including tax and shipping.

Where Shopify’s Customer Privacy API permits analytics processing, clicking Cart Me’s checkout button adds a private, signed timestamp and random identifier to the Shopify cart. The marker identifies a Cart Me checkout for up to seven days; it contains no shopper name, email or address. Checkout continues if tracking is unavailable. The marker can remain with the order in Shopify and is subject to the store’s retention policy. Cart Me does not backfill attribution for earlier orders. Merchants must ensure their store’s consent and privacy disclosures reflect their use of this reporting.

Why we use it

• Authenticate the app and maintain the authorized Shopify connection.
• Save and display the merchant’s chosen drawer design and content.
• Configure reward discounts and synchronize them with the published Cart Me embed.
• Provide support, investigate faults, and protect the service from misuse.

Service providers and sharing

Shopify handles store authorization, cart services, discounts, and checkout. Cart Me’s application and database are hosted on a Netcup VPS. The website loads the Inter font from Shopify’s CDN. These services receive the information needed to deliver their respective functions. We do not sell personal information or use it for advertising profiles.

Merchant-added HTML or CSS can reference external resources. Any providers the merchant adds through custom content are subject to the merchant’s own privacy disclosures. Data may be processed outside your country; the relevant providers’ terms and privacy policies also apply.

Retention and deletion

Saved settings are retained while the service is in use. When Cart Me receives Shopify’s authenticated uninstall webhook, it deletes that shop’s saved configuration, uploaded logo and custom content, reward tiers, upsell selections, sessions, and tokens from the application database and deployment database backups. Shopify’s later shop deletion webhook repeats this cleanup. Failed cleanup is retried through Shopify’s webhook delivery system. Reinstalling starts with default settings. Shopify collects uninstall feedback in its own interface; Cart Me does not keep a separate copy.

Operational server logs may include connection and error information and are governed by server log rotation. Please do not put personal or payment information into custom drawer content or support messages. Customer data requests and deletion requests received through Shopify are acknowledged; Cart Me does not keep a separate database of shopper identities or orders to export or erase.

Your choices and rights

Merchants can edit their saved content, disable the theme embed, or uninstall Cart Me. You can request access, correction, or deletion of information held by Cart Me, subject to applicable requirements. Shoppers should contact the store they purchased from about their Shopify customer and order records.

Security

Cart Me uses HTTPS, verifies Shopify webhook signatures, and restricts access to application credentials and stored sessions. No method of storage or transmission is completely secure.

Contact and updates

For privacy questions or requests, contact BM Global at optimization95@gmail.com. Include your shop domain and request details; do not send passwords or access tokens.

We may update this policy to reflect changes to the service. The effective date above identifies the current version.