Privacy policy

1. Who we are

Cartly is operated by Nerdstack Software Technologies Ltd, Abuloma, Port Harcourt, Rivers State, Nigeria (“Cartly”, “we”, “us”).

We follow the Nigeria Data Protection Act 2023 and, where it applies to you, the EU and UK General Data Protection Regulation.

Questions or requests about your data: services@nerdstackgrp.com.

2. Our two roles

For clients, team members and visitors to Cartly’s own website, Cartly decides how personal data is used: we are the data controller.

For shoppers on a business’s website, the business is the controller and Cartly processes their data on its behalf, following its instructions and this policy. Shoppers should also read the business’s own privacy information, and contact the business first about their data.

3. What we collect from clients and team members

Account details: name, email address, phone number, password (stored only as a secure hash) and sign-in method. If you sign in with Google or Apple we receive your name, email address and whether it is verified; we never receive your password there.

Business details: business name, description, category, country, currency, branding (logo, colours, fonts), domains and the website request you submit during onboarding.

Payment information: amount, currency, status and reference of fees you pay. Card and bank details are entered with our payment provider and never reach Cartly.

Usage and security data: sign-ins, devices and browser type, IP address, actions taken in the dashboard (audit logs) and error reports.

Communications: messages, support requests and feedback you send us.

Integrations you connect, such as Google Search Console or Bing Webmaster Tools: the access you grant (stored encrypted) and the search statistics they return for your website.

4. What businesses’ websites collect about shoppers

When shoppers use a website powered by Cartly, the business collects, and Cartly stores for it: contact and delivery details, orders and order history, cart contents, messages to the business, reviews, and shopper account details (name, email, hashed password, or Google/Apple sign-in identity).

Payments are made through the business’s payment provider; Cartly receives the payment status and reference, not card details.

5. Why we use it

To provide the service you signed up for: creating your account, onboarding and building your business’s website, hosting it, running your dashboard and processing orders. (Legal basis: performing our contract with you.)

To take payments and keep financial records. (Contract and legal obligation.)

To keep Cartly secure: detecting fraud, abuse and unauthorised access, and keeping audit trails. (Legitimate interests and legal obligation.)

To support you and send service messages, such as payment receipts, project updates, security alerts and changes to these policies. (Contract.)

To improve Cartly, using aggregated usage information. (Legitimate interests.)

To send product news or offers, only where you have agreed or the law allows; you can unsubscribe at any time. (Consent or legitimate interests.)

We do not sell personal data, and we do not use shoppers’ data for our own marketing.

6. Who we share it with

Service providers who help us run Cartly, under contracts that require them to protect the data: cloud hosting and databases, media storage and delivery, email delivery, payment providers (such as Paystack), domain registrars and push notification services.

Services you choose to connect, such as Google Search Console, Bing Webmaster Tools, Google or Apple sign-in, and search engines notified when your pages change.

The business you are dealing with: shoppers’ orders and messages go to the business whose website they used; team members see the data their role allows.

Authorities, when the law requires it or to protect the rights and safety of users and the public.

A buyer or successor, if Cartly’s business is sold or merged; this policy will continue to apply.

7. International transfers

Some of our providers store or process data outside Nigeria. When they do, we use safeguards the law recognises, such as contractual protections and providers with adequate security, as required by the Nigeria Data Protection Act.

8. Cookies and similar technology

Essential cookies keep you signed in and secure (an HttpOnly session cookie that page scripts cannot read) and remember a shopper’s cart and sign-in on a store. These are needed for the service to work.

Preference storage remembers choices such as display currency and theme.

Optional analytics or marketing cookies are used only with your consent, which you can change in the cookie settings.

9. How long we keep it

Account and business data: while your account is active, and up to 30 days after closure so you can request an export.

Financial records, invoices and payment references: as long as tax and accounting law requires (generally six years).

Security and audit logs: up to two years.

Shoppers’ data: as long as the business keeps its account and instructs us, then deleted with the business’s data.

Data in backups is overwritten on our backup cycle.

10. How we protect it

Encryption in transit (HTTPS) and of sensitive secrets at rest; hashed passwords; separation of each business’s data at the database level; role-based access for team members; audit logs; and limited, logged staff access.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the regulator as the law requires.

11. Your rights

You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to certain uses, and to withdraw consent at any time.

Clients can update most details themselves in the dashboard. For anything else, email us; we may need to confirm your identity, and we respond within 30 days.

Shoppers should contact the business whose website they used; we will help the business respond.

If you are not satisfied, you may complain to the Nigeria Data Protection Commission, or your local data protection authority.

12. Children

Cartly is for businesses and is not directed at children. Clients must be at least 18. We do not knowingly collect children’s data; if you think we have, contact us and we will delete it.

13. Changes and contact

We will update this policy as Cartly changes. The date at the top shows the latest version; for material changes we will notify clients by email or in the dashboard.

Nerdstack Software Technologies Ltd, Abuloma, Port Harcourt, Rivers State, Nigeria. Email: services@nerdstackgrp.com