Privacy Policy

What we collect

• Purchase data — your email address, which product you bought, the amount, and an order reference. We need this to deliver the product you paid for and to let you recover access later.
• Build requests — if you ask us to build a product, we store the description you submit and your email so we can notify you when it's ready.
• Payment details — we never see or store your card. Payments are handled entirely by our merchant-of-record checkout provider on their own systems.

What we don't do

We do not sell or rent your personal data. We do not run advertising trackers or third-party ad pixels on this store, and we do not build advertising profiles about you.

Why we're allowed to hold it

We process purchase data to perform our contract with you (you paid for a product; we must deliver it and keep it available). We keep records of sales where we have a legal obligation to do so, such as tax and accounting rules. Where we rely on consent — for example, emailing you about a build request — you can withdraw it at any time.

Your access link

Each purchase gets a unique, unguessable access link so you can re-open what you bought without creating an account. Treat it like a receipt: anyone who has the link can view that product. If you believe a link has been shared or exposed, contact us and we will issue you a replacement and retire the old one.

Who we share it with

Only the processors required to run the store: our checkout/merchant-of-record provider (payments, invoices, tax), our email provider (delivery and recovery emails), our hosting provider, and our database provider. Each processes data on our instructions. We may also disclose data where legally required.

How long we keep it

Purchase records are retained for as long as needed to provide access to what you bought and to satisfy tax/accounting requirements. Build requests that don't result in a product are deleted once they're no longer being worked on.

Your rights

Depending on where you live (including the UK/EU under GDPR and California under CCPA), you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to complain to your local data protection authority. To exercise any of these, email support@cartlyt.com from the address on your order. Note that deleting your purchase record also removes your ability to recover the product, so we'll confirm before acting.

Cookies

We use only what the site needs to function — for example, remembering your light/dark theme preference. We do not use advertising or cross-site tracking cookies on this store.

International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Children

Cartlyt.net is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will delete it.

Changes and contact

We may update this policy; the date above reflects the current version. Questions or requests: support@cartlyt.com. See also our Terms and Refund Policy.