Privacy Policy

This Privacy Policy explains how Cartunde ("Cartunde," "we," "us," or "our") collects, uses, shares, and protects information when you use our platform at cartunde.com, including our seller dashboard, storefront pages hosted on our domain, and related services (collectively, the "Service").

Cartunde is a platform that allows business owners ("Merchants" or "Sellers") to create and operate their own online stores. If you are a customer purchasing from one of these stores ("Customers"), see the section "If You Are a Customer of a Cartunde Store" below for how your information is handled.

This policy is written to reflect current data protection expectations, including Nigeria's Data Protection Act (NDPA) and the Nigeria Data Protection Regulation (NDPR). It is a general-purpose document and not a substitute for legal advice.

1. Information We Collect

1.1 Information Merchants Provide Directly

When you create a Cartunde account and store, we collect:

• Name, email address, and password (or Google account information, if you sign up with Google)
• Store details: store name, description, logo, cover image, brand colors, contact phone/email/address, social media handles
• Payment configuration: Paystack subaccount code (if provided)
• Product, category, inventory, and order data you enter or that is generated through your use of the Service
• Any content you generate using our AI writing tools (e.g., product descriptions, store page content), including any prompts or details you provide to generate that content

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Log data (IP address, browser type, device information, pages visited, timestamps)
• Cookies and similar tracking technologies used to keep you signed in and remember preferences
• Usage data related to how you interact with the dashboard and storefront pages

1.3 Information From Third-Party Sign-In

If you sign up or log in using Google, we receive your name, email address, and profile image from Google, consistent with the permissions you grant during that sign-in process.

1.4 Customer Data (Collected on Behalf of Merchants)

When a Customer places an order on a Merchant's store, we collect and store information necessary to process that order, including the Customer's name, phone number, delivery address, city, and order details. Merchants act as the data controller for their own Customer data; Cartunde acts as a data processor providing the infrastructure that stores and processes this information on the Merchant's behalf.

2. How We Use Information

We use the information we collect to:

• Create and maintain Merchant accounts and stores
• Process and fulfill orders, including facilitating payments through Paystack
• Send transactional communications (e.g., email verification codes, order confirmations, password resets)
• Provide customer support
• Generate AI-assisted content (product descriptions, store page content) when requested
• Monitor, maintain, and improve the security, performance, and functionality of the Service
• Detect and prevent fraud, abuse, or violations of our Terms of Service
• Comply with legal obligations

We do not sell personal information to third parties.

3. How We Share Information

We share information only in the following circumstances:

• Payment Processors: Order and payment information is shared with Paystack (and other supported payment gateways) to process transactions.
• AI Service Providers: When you use AI-generation features, the text you input is sent to our AI provider to generate a response. We do not send full customer databases or order data to AI providers.
• Email Delivery Providers: We use a transactional email service to send verification codes, order confirmations, and account-related emails.
• Hosting and Infrastructure: Our application and database are hosted with third-party infrastructure providers who process data on our behalf under their own security and privacy commitments.
• Legal Requirements: We may disclose information if required to do so by law, or in a good-faith belief that such action is necessary to comply with legal process, protect our rights, or protect the safety of our users or the public.
• Business Transfers: If Cartunde is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. If You Are a Customer of a Cartunde Store

If you make a purchase from a store built on Cartunde, the information you provide is collected on behalf of, and controlled by, that individual Merchant. Cartunde provides the technical infrastructure to store and process this data securely, but the Merchant is responsible for how they use your information for their own business purposes.

If you have questions about how a specific store handles your data, we encourage you to contact that store directly.

5. Data Retention

We retain Merchant account data for as long as the account remains active. Customer order data is retained for as long as necessary to support the Merchant's business operations and legal recordkeeping obligations, or until the Merchant requests its deletion, subject to any legal retention requirements.

6. Your Rights

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to legal retention obligations
• Object to or restrict certain processing of your data
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at the email below.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including password hashing, encrypted connections (HTTPS/SSL), and access controls on our database and infrastructure. No method of transmission or storage is 100% secure.

8. Cookies

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. International Data Transfers

Our infrastructure providers may process and store data outside Nigeria. Where this occurs, we take steps to ensure appropriate safeguards are in place consistent with applicable data protection law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page.

12. Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us at:

Email: support@cartunde.com