Privacy Policy.
Last updated: October 14, 2026. Plain-English transparency about the information we collect, why we need it, and how your rights are protected.
Legal Disclaimer: This privacy policy is an operational template outlining CartVerge's genuine data collection and analytics handling practices. Because data protection legislation varies across jurisdictions, this document should be reviewed by qualified legal counsel to ensure full compliance with your specific regional laws.
1. Who We Are
CartVerge operates as a specialized Shopify conversion rate optimization, development, and growth engineering agency serving direct-to-consumer merchants globally. For questions regarding this policy or your personal information, reach us directly at hello@cartverge.co.
2. Information We Collect
We deliberately minimize data intake and only process information that is necessary to evaluate your e-commerce storefront and conduct commercial business:
- Inquiry and Audit Request Data: When you complete our contact form or request a free CRO audit, we collect your full name, work email address, Shopify store URL, selected project scope, and any store context you provide.
- Interactive Tool Data: Progress on our interactive CRO checklist is stored locally on your device via browser
localStorage. It is never transmitted to our servers unless you explicitly submit the optional checklist email dispatch form. - Aggregated Telemetry (GA4): If—and only if—you consent through our cookie settings banner, Google Analytics 4 collects anonymized pageviews, interaction depth, and device characteristics with IP anonymization enabled.
3. Lawful Basis for Processing (GDPR)
Under the General Data Protection Regulation (GDPR), we process your data on the following bases:
- Legitimate Interests: To review your public Shopify storefront, prepare customized conversion audit findings, and respond to your direct request for a quote.
- Consent: For running analytical measurement scripts (Google Analytics 4), which can be accepted, rejected, or revoked at any time via our cookie settings.
- Contractual Necessity: To fulfill project agreements, deliver sprint roadmaps, and deploy approved Liquid code to your store repository.
4. Data Sharing and Zero Resale Policy
We do not sell, rent, monetize, or broker personal information to data aggregators or third-party advertisers. Information is only accessed by CartVerge team members and trusted operational service providers (such as transactional email transport and secure server hosting) under confidentiality agreements.
5. International Data Transfers & Security
Because we work with Shopify brands worldwide, inquiries may be processed in secure cloud infrastructure compliant with modern transport layer security (TLS 1.3 encryption). We implement strict server security headers, Content Security Policies, and access controls to safeguard data integrity.
6. Data Retention
We retain commercial inquiry records only as long as necessary to fulfill project requirements, answer follow-up communications, and satisfy statutory tax and bookkeeping standards. If a business relationship does not materialize, inquiry records are deleted after 24 months.
7. Your Legal Rights (GDPR & CCPA/CPRA)
Regardless of your physical location, CartVerge extends modern privacy protections to all visitors:
- Right of Access & Portability: You may request a copy of the personal data we hold about you.
- Right of Rectification: You may correct inaccurate or outdated information.
- Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your inquiry data.
- Right to Opt-Out: You may revoke cookie consent at any moment via the "Cookie settings" button in our footer.
To exercise any privacy right, email hello@cartverge.co with the subject line "Data Privacy Request". We reply within 5 business days without discriminatory impact on our service.