Privacy Policy

1. The short version

2. Who we are

Cartland is run by Cartland Technologies Ltd, a company registered in England and Wales (company number 17239433). Our registered office is 12 Stonor Road, London, England, W14 8RZ.

For the personal data described in this policy, Cartland Technologies Ltd is the controller. That means we decide how and why it's used, and we're responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact us about anything in this policy at info@cartland.io or by post at our registered office. We're a small team and haven't appointed a data protection officer, so privacy questions come straight to the people who build Cartland.

3. What this policy covers

This policy covers:

• the Cartland apps for iPhone and Android, and the service behind them at app.cartland.io;
• our website at cartland.io, including the waitlist;
• emails we send you, and messages you send us.

It doesn't cover the websites or apps of the stores you shop at, Apple, Google, or anyone else whose service you reach through a link in Cartland. They have their own privacy policies, and you should read those too.

4. What we collect

Information you give us

• Account details: your email address and password. Your password goes straight to our sign-in provider, Supabase, which stores only a secure hash of it. We never see it.
• Profile: the username you choose and, if you add one, a profile photo.
• Referral code: a friend's referral code, if you enter one when you sign up.
• Things you save: product links you paste or share into Cartland, and the product details we look up for them (name, price, photos, store, size and colour). Also your Saved items, Cart, Wishlists, tags, and items you've deleted but can still restore.
• Orders you record: items in Order History, order numbers, tracking numbers and carriers, delivery and return dates, notes on status, and any photos you add.
• AI Checkout details: the delivery name, address and phone number you enter, and the delivery options and discount codes you choose. We save your delivery address so you don't have to type it again.
• Preferences: for example your display currency, and how you like your lists sorted and laid out.
• Rewards: prizes you win and claim, your Cartland balance, and the details we need to pay or deliver them: for a withdrawal, the name on your bank account, sort code and account number; for some prizes, your county or delivery address.
• Waitlist: your email address and, optionally, your name.
• Messages: anything you send us, for example by email.

Information we collect automatically

• Technical and security information: your IP address and basic device and browser details (such as the operating system and user agent). We use these when you sign up, sign in, reset your password or use our servers, to keep Cartland secure and to stop abuse.
• Error reports: technical details when something goes wrong, such as the request or page involved, the time, and your device or browser type.
• Usage counts we need to run the service: how many Credits you've used this month, and your referral counts.

We don't collect your precise location, contacts, photos library (apart from photos you choose to upload), or any advertising identifier. The app doesn't use push notifications.

Information from other people

• Apple and Google: confirmation of the plans and Credit packs you buy, renew, cancel or get refunded, including transaction identifiers. We don't receive your card details.
• Stores: when you use AI Checkout, the stores in your cart send back delivery options, prices, order status and, for completed orders, tracking information.
• Parcel tracking services and carriers: delivery updates for tracked parcels.
• Security providers: a risk assessment of the IP address used to sign up (see section 6).
• Friends who refer you or whom you refer: if someone signs up with your referral code, your referral count goes up. We don't tell you who they are.

You don't have to give us any information, but we can't create an account without an email address and password, and AI Checkout can't work without a delivery address and phone number, because stores need them.

5. How we use it and our lawful bases

Data protection law says we must have a lawful basis for each way we use personal data. Here's ours.

Where we rely on legitimate interests, we've weighed our interests against yours and think your rights aren't overridden. You can ask us about that balancing, and you have the right to object (see section 14).

We don't use your data to make decisions about you by automated means alone that have legal or similarly significant effects, except for the sign-up checks described next.

6. Automatic sign-up checks

To stop bots and repeat abusers creating accounts, when you sign up we check the IP address you're signing up from with IPQualityScore, a fraud-prevention service. It gives us a risk score and flags such as whether the address is linked to bots or recent abuse.

• If the risk is high, we may ask you to complete a quick security challenge (from Cloudflare Turnstile).
• If the address is flagged for bot activity or recent abuse, or the risk is very high and the challenge fails, sign-up is refused automatically.

We keep a record of each check (your email address, IP address, the scores and the outcome) so we can spot repeat abuse.

If you think you've been stopped by mistake, email info@cartland.io with any reference number you were shown. A person will review it. You can tell us why you think the decision is wrong and ask us to reconsider it.

7. Who we share it with

We don't sell your personal data. We share it only as described here.

Service providers who work for us

These companies process data on our behalf, under contracts that require them to protect it to the same standard as this policy and use it only to provide their service to us.

Organisations that use your data for their own purposes

• Stores in your cart, when you use AI Checkout. After you enter your delivery details, we send your name, email address, phone number and delivery address, with your basket, to each participating store in your cart. They use them to quote delivery, create your checkout, and fulfil any order you place. The link that opens a store's checkout also carries those details so the form is filled in for you. Once a store has your details, its own privacy policy applies.
• Apple and Google. They process your in-app purchases under their own terms and privacy policies. With each purchase we send them your Cartland account ID (a random code, not your name or email) so we can match the purchase to your account.
• Google. Our app pages load fonts from Google Fonts and a Google Firebase software library. That means Google receives your IP address and basic browser information when those files load. We don't currently use Firebase to process any of your account data.
• Stripe. Plans and Credits bought in the app don't go through Stripe. If you paid Cartland through Stripe (see the table above), Stripe keeps its own records of that payment as a regulated payment provider.
• Carriers. If you tap a tracking link, the carrier's website opens with your tracking number.

Other situations

• The law: we'll share data if we're legally required to, for example with the police or a regulator. We'll push back on requests that aren't lawful or are too broad.
• Protecting people: we may share data to prevent fraud, protect someone's safety, or enforce our terms.
• If our business changes hands: if Cartland is sold, merged or restructured, your data may pass to the new owner. It would stay protected by this policy until you're told otherwise.
• Paying you or delivering a prize: when we pay a withdrawal, Stripe and the banks involved receive the name and account details needed to make the payment, and your bank tells Stripe whether the name matches the account. If we pay you another way we agree, that payment service receives what it needs. If a prize is sent to you, the company delivering it receives your name and delivery address.
• Professional advisers: such as lawyers and accountants, under a duty of confidentiality.

8. What other Cartland users can see

Your lists, orders and account details are private to you. These things can be seen by other people:

• The Referral Race leaderboard. Once at least one other person's account is linked to your referral code, your username (or "User" if you haven't set one) and your referral counts can appear on a leaderboard of up to 100 top referrers, which other signed-in Cartland users can see. If you'd rather not appear, email us and we'll show you as "User".
• If you win a prize. We may publish your first name and the first letter of your surname, or your username, and give a winner's surname and county to anyone who asks, as the Rewards Rules explain. You can ask us not to publish your details.

9. International transfers

Some of our providers are based in, or access data from, countries outside the UK, mainly the United States and the European Economic Area. Our database provider stores data in the region we chose for our project, but its staff and sub-processors may access it from other countries.

When personal data leaves the UK, we make sure it's protected by one of the safeguards UK law allows:

• the destination has UK "adequacy" status (for example the EEA, or US companies certified under the UK Extension to the EU–US Data Privacy Framework); or
• we use the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses.

Email us if you'd like more detail about the safeguard used for a particular provider.

10. How long we keep it

When you delete your account in the app, we delete it and the data linked to it straight away (subject to the exceptions above). Data already passed to stores, Apple or Google is kept by them under their own policies. See cartland.io/delete-account for the full details.

11. Cookies and storage on your device

Our website (cartland.io) doesn't use cookies, analytics or any other storage on your device.

The Cartland app stores some things on your phone so it works properly and quickly. We don't need your consent for these, because they're strictly necessary for the service you've asked for, or they remember choices you've made:

• your sign-in session, so you stay signed in;
• offline copies of your lists and any changes waiting to sync;
• your preferences, such as display currency, layout and sort order;
• your progress through a checkout, so you don't lose it;
• for invited testers using a web browser, a cookie called cartland_gate that lets them past our "coming soon" page for 7 days.

Some parts of the app come from other companies and may store or read information on your device:

• Cloudflare Turnstile, for security checks;
• Google Firebase, a software library the app loads.

Uninstalling the app removes everything it stored on your phone.

12. Emails

We send emails you need for your account and service, such as confirming your email address, resetting your password, a welcome email, and messages about your plan or a payment problem. You can't opt out of essential account emails while you have an account.

We don't currently send marketing emails to account holders. If we start, we'll only do it where the law allows, and every one will include an easy way to unsubscribe.

If you join the waitlist, we'll email you about Cartland's launch. Every waitlist email has an unsubscribe link, or you can email us to be removed.

13. Security

We use appropriate technical and organisational measures to protect your data, including:

• encryption in transit (HTTPS) for everything between the app, our servers and our providers;
• database rules that stop one account reading another account's data;
• passwords handled only by our sign-in provider, in hashed form;
• payment card details handled only by Apple, Google or the store you buy from;
• access to production systems limited to people who need it.

No system is perfectly secure. If we become aware of a breach that's likely to put you at high risk, we'll tell you without undue delay, and we'll report breaches to the regulator where the law requires. If you think your account has been compromised, email us straight away.

14. Your rights

Under UK data protection law you have the right to:

• access your personal data and get a copy of it;
• correct data that's wrong or incomplete;
• erase your data (you can delete your account in the app yourself, or ask us);
• restrict how we use your data in some circumstances;
• data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation where that's technically feasible;
• object to our use of your data where we rely on legitimate interests;
• withdraw consent at any time, where we rely on consent (for example, waitlist emails). This doesn't affect anything we did before you withdrew it;
• not be subject to a significant decision based solely on automated processing without safeguards, and to ask for a person to review such a decision, make your case, and challenge it (see section 6).

To use any of these rights, email info@cartland.io from the email address on your account if you can. We may need to confirm your identity first. It's usually free.

We'll reply without undue delay and within one month. If a request is complex, or you've made several, we can extend that by up to two further months, and we'll tell you if we do. The time limit is paused while we wait for any information we need to confirm who you are or clarify your request.

15. Children

Cartland is for adults. You must be 18 or over to create an account, and we don't knowingly collect data from anyone under 18. If you think a child has given us personal data, email us and we'll delete it.

16. Changes to this policy

We'll update this policy when our services or the law change. The date at the top shows when it last changed. If a change affects you significantly, for example a new use of your data, we'll tell you in the app or by email before it takes effect.

17. Contact and complaints

Email info@cartland.io, or write to Cartland Technologies Ltd, 12 Stonor Road, London, England, W14 8RZ.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. We'll acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), which is becoming the Information Commission. Visit ico.org.uk/make-a-complaint, call 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.