This policy explains how Clever Little Cart ("we", "us") collects and uses personal data as a controller: about visitors to this website, people who contact us, and the people at the businesses that sign up for and use Clever Little Cart.
When we process the personal data of your Shop's customers, we do so on your behalf, as your processor. That is covered by our Data processing agreement, and your Shop's own privacy notice explains it to your customers.
1. Who we are
Clever Little Cart, the company’s postal address, in Settings, VAT the VAT number, in Settings. For anything about your personal data, write to support@cleverlittlecart.com.
2. What we collect, why, and our legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Website visits: the page, the referring site and campaign tags in the link, counted as daily totals | Knowing which pages and campaigns work | Legitimate interests: running and improving our website. No data about you is kept. |
| Contact messages: name, email, business, message | Answering you | Legitimate interests; steps at your request before a contract |
| Sign-up and account: name, business name, email, country, how you heard about us, referral code | Creating and running your account and Shop | Contract |
| Billing: billing name and address, VAT number, subscription and invoices. Card details are collected by Stripe, never by us. | Charging you, keeping accounts, tax | Contract; legal obligation |
| Security and usage: sign-ins, IP addresses, devices, actions in the dashboard (audit log) | Protecting your account and the Service; showing you an audit log | Legitimate interests: security; contract |
| Support: tickets, messages and our replies | Helping you | Contract; legitimate interests |
| Service emails: whether emails were delivered | Making sure important emails reach you | Legitimate interests |
| Product news (only if you agree) | Telling you about new features and offers | Consent, which you can withdraw at any time |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Counting visits without cookies
Our website counts visits without cookies or anything else stored on your device. Each page view adds one to a daily total for that page and its source. We do not keep your IP address, a device identifier or any profile with it. If your browser sends Global Privacy Control or Do Not Track, your visit is not counted at all. See our Cookie policy.
To protect our forms from abuse, we count requests using a one-way hash of your IP address, held briefly in memory and never stored.
4. Who we share it with
We share personal data only as needed to run Clever Little Cart:
- Service providers acting for us under contract: hosting (Hetzner Online GmbH, EU), payments and billing (Stripe), and domain registration (Enom, only if you buy a domain through us). See our Sub-processors page.
- Professional advisers such as accountants, auditors and lawyers, under confidentiality.
- Authorities, where the law requires us to, or to protect our rights, our customers or the public.
- A buyer of our business, if it is sold, who would continue to protect your data under this policy.
We never sell personal data, and never share it for others' advertising.
5. International transfers
Our data is stored in the European Union. Where a provider processes data outside the EEA (such as Stripe or Enom in the United States), it is protected by an adequacy decision, such as the EU–US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account and Shop records | While you are a customer, then 60 days, unless you return |
| Invoices and accounting records | 7 years, as Cyprus tax law requires |
| Contact messages and support tickets | 2 years after the last message |
| Security logs and sign-in history | 12 months |
| Website visit counts | Kept as totals, which contain no personal data |
7. Security
We protect personal data with appropriate measures: encryption in transit, encrypted secrets, two-factor sign-in, access on a need-to-know basis, separate databases per shop, monitoring and audit logs. No system is perfectly secure; if a breach affects you, we tell you as the law requires.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- have it corrected if it is wrong;
- have it erased, where there is no good reason for us to keep it;
- restrict how we use it;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- data portability: receive data you gave us in a machine-readable format;
- withdraw consent where we rely on it, without affecting what was done before.
Write to support@cleverlittlecart.com. We reply within one month, and may need to confirm your identity first.
You may also complain to a supervisory authority. In Cyprus this is the Commissioner for Personal Data Protection (dataprotection.gov.cy). You may also complain where you live or work.
9. Children
Clever Little Cart is for businesses, and our website is not directed at children under 16. We do not knowingly collect their data.
10. Changes
We may update this policy. We change the date at the top, and tell you by email if a change affects you significantly.