Privacy Policy

From merchants

• Account & profile — name and email from Google sign-in, phone number, store name, bio, category, logo/cover image and delivery details.
• Content you upload — product videos (reels), photos, product titles, descriptions, attributes and prices.
• Payment & payout details — UPI ID, and, if you enable online payments, KYC/settlement details you provide to our payments partner (e.g. PAN, business and bank/VPA details). Card and bank data is handled by the payment provider, not stored by us.
• Instagram data (only if you connect Instagram) — your Instagram username and account ID, your reels and their media (video, thumbnail, caption, permalink, timestamp), and an access token that lets us fetch them on your behalf. See “Instagram data” below.

From shoppers

• Order & contact details — name, phone number, delivery address and the items, quantities and order status for purchases you make from a store.
• Payment status — whether an order is paid/pending; card and bank details are processed by the payment provider, not stored by us.

Automatically

• Device & usage — IP address, browser/device type, pages viewed and actions taken, for security, analytics and improving the service.
• Cookies & similar — a session cookie to keep you signed in, a cart identifier, and minimal analytics. See “Cookies”.

• Provide, operate and maintain the platform and your store or shopping session.
• Generate your catalogue, product images and videos using AI (see “AI processing”).
• Sync and display your Instagram reels on your storefront, if you connect Instagram.
• Process and fulfil orders, payments and merchant payouts.
• Communicate with you — service notices, order updates and, where applicable, WhatsApp messages you or your buyers have opted into.
• Keep the platform secure, prevent fraud and abuse, and debug issues.
• Understand usage and improve features.
• Comply with law and enforce our Terms.

To build your catalogue, media you upload (and, where relevant, connected content) is processed by third-party AI models — including Google Vertex AI / Gemini — to detect products, extract attributes and generate product images and videos. These outputs are AI-generated representations intended to showcase your products; you remain responsible for reviewing them for accuracy before publishing. We do not use your content to train third-party foundation models beyond generating your own outputs.

We do not sell your personal information. We share it only with service providers that help us run Cartrix, and only as needed:

• Google Cloud — AI (Vertex AI / Gemini), file storage and authentication (Firebase).
• Meta Platforms — the Instagram Graph API (to fetch your reels) and the WhatsApp Business API (for opted-in messaging).
• Payment provider (Cashfree) — to process payments and merchant settlements.
• Hosting & infrastructure — our application hosting, compute and database providers.
• We may also disclose information to comply with law, enforce our Terms, or protect the rights, safety and security of users and the public. If Cartrix is involved in a merger, acquisition or asset sale, information may transfer as part of that transaction.

Connecting Instagram is optional and merchant-initiated. When you connect, you authorise Cartrix, via the Instagram API with Instagram Login, to access your professional account using the instagram_business_basic permission only. We use this to read your profile and your reels so we can display them on your own storefront.

• What we access — your Instagram username/ID and your media (reels): video, thumbnail, caption, permalink and timestamp. We request read-only access; we do not post, message or manage your account.
• How it’s used — solely to show your reels on your storefront. We never sell it or share it with other merchants or advertisers.
• Storage & security — your access token is encrypted at rest; reel details are cached so your store loads quickly and refreshed periodically.
• Your control & deletion — you can disconnect Instagram at any time in Settings, which deletes the token and cached reels. Removing Cartrix from your Instagram “Apps and websites” settings triggers the same deletion via our deauthorize and data-deletion endpoints.

Our use and transfer of information received from the Instagram/Meta APIs adheres to the Meta Platform Terms and Developer Policies, including any limited-use requirements.

We use strictly necessary cookies (to keep you signed in and to hold your cart) and minimal analytics. We do not use third-party advertising cookies. You can block cookies in your browser, but parts of the service may not work.

We keep information for as long as your account is active and as needed to provide the service, then for a reasonable period to meet legal, tax, accounting and dispute-resolution obligations. Instagram tokens and cached reels are deleted when you disconnect Instagram or close your account. You can ask us to delete your data sooner (see “Your rights”).

We protect information with encryption in transit, encryption of sensitive credentials (such as Instagram access tokens) at rest, access controls and least-privilege practices. No system is perfectly secure, but we work to safeguard your data and to notify you of material incidents as required by law.

• Access or correct your account and store details in Settings.
• Disconnect Instagram, WhatsApp or payment integrations at any time.
• Request a copy or deletion of your personal data, or ask us to restrict certain processing, by contacting us.
• Close your account, after which we delete or de-identify your data subject to the retention above.

To request deletion of your data, disconnect the relevant integration in Settings, close your account, or email cartrix.store@gmail.com. For Instagram specifically, disconnecting (or removing Cartrix from your Instagram apps) deletes your token and cached reels automatically.

Cartrix is intended for businesses and adults. It is not directed to children under 18, and we do not knowingly collect their personal information.

We operate primarily in India and use service providers that may process data in other countries. Where data is transferred across borders, we take steps to ensure it remains protected consistent with this Policy and applicable law.

We may update this Policy from time to time. We will change the “Last updated” date above and, for material changes, provide additional notice. Continued use of Cartrix after an update means you accept the revised Policy.

Questions or requests about this Policy or your data? Email cartrix.store@gmail.com.