Privacy Policy

About this policy

PONERIAN LLC provides CartThread, a Shopify app that keeps a logged-in customer's cart connected across devices. This policy explains the personal data CartThread processes and how it is handled.

Data we process

CartThread processes a Shopify store domain, Shopify customer ID, Shopify cart ID, cart name, and an encrypted snapshot of the cart contents needed to sync and switch carts. A snapshot can include merchandise and selling plan IDs, quantities, line and cart attributes, notes, discount codes, country code, and a Shopify company location ID.

CartThread does not request customer names, email addresses, phone numbers, or mailing addresses from Shopify's customer profile fields. Cart names, notes, and attributes may contain personal information that shoppers or merchants enter. Shopify's required privacy webhooks may also include customer contact details, which CartThread does not save. CartThread does not collect payment details. It stores Shopify access credentials for the merchant's store in encrypted form.

How we use data

We use this data only to install and operate CartThread, authenticate requests, save a customer's active cart ID, restore carts, merge carts, prevent abuse, and support the service. We do not sell personal data, use it for advertising, or make automated decisions with legal or similarly significant effects.

Cookies and storefront storage

CartThread uses Shopify's cart cookie to select the customer's saved cart. It uses browser local storage to remember the selected cart and temporary session storage to prevent repeated restore attempts and keep cart adjustment messages available after switching carts. CartThread does not add advertising or analytics cookies.

Where data is processed

The primary customer cart ID is stored in an app-owned Shopify customer metafield. Named cart IDs and snapshots are stored encrypted by CartThread. CartThread's application and encrypted store credentials are hosted with Amazon Web Services in the United States. Shopify and Amazon Web Services process data as service providers needed to operate CartThread.

Security

CartThread uses HTTPS for data in transit. Shopify access credentials, saved cart IDs, cart snapshots, and customer data exports are encrypted at rest. Access is limited to what is needed to operate and maintain the service.

Retention and deletion

CartThread keeps saved cart data while the app is installed and the related customer and store records exist. Saved data for customer requests is encrypted. Completed export files are automatically removed 30 days after they are ready. Unfinished requests remain available until completed or removed by a privacy deletion request. CartThread removes customer cart data, exports, and pending request data after a valid customer-redaction request and removes the store record after Shopify sends the required store-redaction request.

Merchant and customer choices

Merchants can stop CartThread processing by disabling its theme embed or uninstalling the app. Requests to access or delete customer data can be made through the Shopify merchant that controls the store. PONERIAN LLC will respond to valid requests received through Shopify's required privacy process.

Changes and contact

We may update this policy when CartThread or applicable requirements change. The effective date above will show the latest revision.

Questions about this policy or CartThread's data practices can be sent to support@ponerian.com or mailed to: