Privacy Policy

CartFlow (“CartFlow”, “we”, “us”, “our”) builds tools that help food trucks, market stallholders, makers and pop-up vendors run their business. This policy explains what information we collect when you use CartFlow, why we collect it, and the choices you have.

1. Who we are

CartFlow is operated by the CartFlow team. If you have any questions about this policy or your data, contact us at hello@cart-flow.app.

2. Information we collect

We collect only what we need to run your account and the service:

• Account details — name, email, profile photo and authentication identifiers (e.g. Google sign-in ID).
• Business details — business name, address, currency, timezone, tax/ABN/VAT number, country and region.
• Operational data you enter — events, venues, applications, contracts, products, recipes, stock, sales, expenses, staff profiles, shifts, customers and documents.
• Payment information — handled by our payment processor (Stripe). CartFlow never sees or stores full card numbers; we only receive the subscription status and a token.
• Technical data — IP address, browser type, device information and basic usage logs, used to keep CartFlow secure and reliable.

3. How we use your information

• To provide, maintain and improve CartFlow.
• To authenticate you and protect your account.
• To process subscription payments and send receipts.
• To send essential service messages (e.g. security alerts, billing, important changes).
• To diagnose problems, prevent abuse and comply with legal obligations.

We do not sell your personal information, and we do not use your business data to train third-party AI models.

4. Legal bases (UK / EU users)

We process your data under the following bases: performance of a contract (to deliver CartFlow), legitimate interests (to keep the service secure and improve it), consent (where required, e.g. optional marketing) and legal obligation (e.g. tax records).

5. Sharing your information

We share data only with trusted providers that help us run CartFlow:

• Hosting & database — Cloudflare and Supabase, who host the application and your encrypted data.
• Payments — Stripe, for subscription billing.
• Authentication — Google, if you choose to sign in with Google.
• Optional integrations you connect yourself — e.g. Xero for accounting sync. We only share the data needed for the integration to work, and only while it is connected.

We may also disclose information if required by law, to protect users, or as part of a corporate transaction (e.g. merger), in which case we will notify you.

6. Where your data is stored

CartFlow runs on globally-distributed infrastructure. Your data may be processed in countries outside your own (including the United States, EU and Australia). Where transfers leave the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. How long we keep your data

We keep your account data while your account is active. If you delete your account, we remove your personal data within 30 days, except where we are required to keep records for legal, tax or fraud-prevention reasons.

8. Security

We use industry-standard measures including TLS encryption in transit, encryption at rest, row-level security on the database, scoped API keys and least-privilege access. No system is perfectly secure, but we work hard to protect your information.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and personal data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time.

To exercise any of these rights, email hello@cart-flow.app. UK/EU users also have the right to complain to their local data protection authority.

10. Cookies & local storage

CartFlow uses essential cookies and browser storage to keep you signed in and remember preferences (such as whether you have seen the welcome tutorial). We do not use advertising or third-party tracking cookies.

11. Children

CartFlow is intended for people aged 16 and over. We do not knowingly collect personal data from children under 16.

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Last updated” date above and, for material changes, notify you by email or in the app.

13. Contact

Questions, requests, or concerns about your data? Email hello@cart-flow.app and we will get back to you.