Privacy Policy for CartShield

CartShield is primarily a business-to-business fraud prevention and order analysis service.

When a store owner connects their WooCommerce store to CartShield, the store may provide customer and order information to CartShield so that we can perform services such as fraud detection, order risk analysis, OTP verification, and order security.

In these circumstances:

We do not treat access to merchant customer data as permission to use that information for unrelated purposes.

The information processed by CartShield depends on the Services and features enabled by a merchant.

The exact information processed may vary depending on the merchant's configuration and the CartShield functionality being used.

CartShield is designed to process information that is reasonably necessary to provide its fraud prevention, order analysis, verification, and security functions.

CartShield may process customer and order information for purposes including:

The purpose of processing customer order information is to help merchants assess order-related risk and protect their stores from fraud, abuse, and related losses.

We do not use customer order information for unrelated purposes simply because it is available to us.

CartShield may analyze order information using automated rules, statistical analysis, risk indicators, and other technical methods to identify potentially risky orders.

The analysis may produce:

A CartShield risk score is an analytical assessment and does not by itself establish that a customer is fraudulent or has committed wrongdoing.

For example, a "high-risk" result may indicate that an order contains certain patterns or signals associated with increased risk. It does not necessarily mean that the order is fraudulent.

The merchant remains responsible for deciding whether to approve, review, hold, cancel, or otherwise process an order.

Some CartShield features may use automated processing to generate risk scores, alerts, classifications, or recommendations.

These features are designed to support merchants in making informed order-management decisions.

CartShield does not represent that an automated risk score is always accurate or that it guarantees that an order is legitimate or fraudulent.

Where applicable law provides rights concerning automated processing or decision-making, those rights may be exercised through the relevant data controller or through CartShield where CartShield is responsible for the relevant processing.

CartShield does not sell personal data.

We do not sell customer names, phone numbers, email addresses, addresses, order histories, or other personal information to third parties for advertising, lead generation, marketing databases, or unrelated commercial purposes.

We also do not use merchant customer information to directly market CartShield or other products to those customers.

Merchant and customer information is treated as confidential.

Customer information submitted by one merchant is not intentionally provided to another merchant.

We do not provide one merchant with identifiable customer information belonging to another merchant.

We may use aggregated or appropriately de-identified information for purposes such as understanding overall service performance, improving system reliability, detecting general fraud patterns, and generating internal statistics, provided that such use does not unnecessarily identify an individual customer or merchant.

We may use information generated through the Services to maintain, secure, test, troubleshoot, and improve CartShield's fraud prevention and security capabilities.

Where information is used for broader analytical or statistical purposes, we aim to minimize the use of directly identifying personal information and use aggregated, anonymized, or appropriately protected information where reasonably possible.

We do not use merchant customer information to create advertising profiles or sell customer profiles to third parties.

Where a business or merchant uses CartShield, we may use the business or merchant's name and logo for CartShield's portfolio, customer showcase, case study, marketing, or promotional presentation purposes.

For example, we may display a customer's logo on:

Such use is intended only to identify the business as a CartShield customer or user and to demonstrate businesses that use CartShield.

We do not sell, license, transfer, or otherwise provide customer logos to unrelated third parties for their own commercial use.

We do not use customer logos to imply an endorsement, partnership, sponsorship, certification, or other relationship beyond the customer's use of CartShield unless such relationship has been separately agreed with the customer.

Customers may contact us at shield@cart.care to request removal of their logo from our portfolio or promotional materials. Upon receiving such a request, we will take reasonable steps to remove the logo from actively controlled digital materials within a reasonable period.

Logo removal from previously distributed materials, cached pages, archived materials, or third-party platforms may not always be immediately possible.

CartShield currently does not use external AI providers or third-party AI models to process customer order data.

This means that CartShield does not currently send customer order information to external AI services such as OpenAI, Anthropic, Google Gemini, or similar third-party AI platforms for fraud analysis.

If this changes in the future, we will review the applicable legal, security, contractual, and privacy requirements and update this Privacy Policy or provide other appropriate notice where required.

CartShield may use cookies, session storage, local storage, and similar technical technologies for purposes including:

CartShield currently does not use customer order data for behavioral advertising.

We may use necessary technical logs and security-related information to detect abuse, protect our infrastructure, and maintain service security.

CartShield currently operates infrastructure and/or uses service providers that may process or store information in:

Depending on the Service, technical architecture, and service provider involved, personal data may therefore be processed outside Bangladesh.

Where personal data is transferred or processed internationally, CartShield will take reasonable measures to comply with applicable Bangladesh data protection requirements and to apply appropriate technical, contractual, and organizational safeguards.

Where applicable law requires consent, notification, authorization, or another legal basis for an international transfer, we will comply with the applicable requirement.

We do not consider use of an overseas infrastructure provider to be permission to use personal data for unrelated purposes.

CartShield aims to collect and process only the information reasonably necessary for the relevant Service.

Merchants are encouraged not to send unnecessary personal information through the CartShield integration.

CartShield does not require merchants to provide information that is unrelated to the enabled fraud prevention, order analysis, verification, security, or account-management functionality.

Merchants should not intentionally send sensitive personal information that is not required by a CartShield feature.

CartShield is not designed to collect unnecessary sensitive personal information.

Merchants should not send information such as:

unless a specific CartShield feature expressly requires such information and the processing is permitted by applicable law.

If sensitive personal information is inadvertently submitted where it is not required, CartShield may take reasonable steps to restrict, delete, or otherwise appropriately handle that information.

We take reasonable technical and organizational measures designed to protect information against unauthorized access, disclosure, loss, destruction, alteration, misuse, or accidental exposure.

Our security measures may include:

Access to protected systems and customer information is restricted to authorized personnel and service providers who require access for legitimate operational, security, support, or service-delivery purposes.

No internet-connected system can be guaranteed to be completely secure. However, we continuously work to maintain and improve our security controls.

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, maintain accounts, prevent fraud and abuse, maintain security, improve the accuracy of fraud analysis, resolve disputes, comply with legal obligations, and protect our legitimate business interests where permitted by law.

The appropriate retention period may depend on:

We do not retain personal data indefinitely merely because it was previously collected.

When information is no longer reasonably required and there is no legal or legitimate reason to retain it, we will take reasonable steps to delete, anonymize, or otherwise appropriately dispose of it.

Information contained in secure backups may remain for a limited period until those backups are securely overwritten or deleted according to our backup procedures.

Personal data processed through CartShield is accessible only to authorized personnel and service providers who require access for legitimate purposes such as:

We do not provide unrestricted internal access to merchant customer information.

A merchant using CartShield remains responsible for its own collection and use of customer information.

Merchants are responsible for:

CartShield provides technical fraud prevention and order-security services. It does not replace the merchant's own legal or privacy obligations.

Subject to applicable law and any lawful limitations or exceptions, individuals may have rights relating to their personal data, including rights to:

We may need to verify the identity of a person making a privacy request before providing information or taking action.

Certain information may need to be retained where required or permitted by law.

If you placed an order with an online store that uses CartShield, your information may have been provided to CartShield by that merchant.

In this situation, the merchant generally determines:

If you have questions about why your information was collected or why your particular order was processed, we recommend contacting the relevant merchant first.

If your request concerns information processed by CartShield on behalf of that merchant, we may work with the merchant to respond to the request where appropriate.

You may contact us regarding privacy questions or requests at:

Email: shield@cart.care

If you are a customer of a store using CartShield, please include the relevant store or merchant name and sufficient information to help us identify the relevant processing activity.

We may ask for reasonable information to verify your identity and protect against unauthorized disclosure.

Where CartShield is acting as a processor on behalf of a merchant, we may refer the request to the relevant merchant or assist the merchant in responding to it.

Store owners may request deletion of their CartShield account and relevant data by contacting us at:

shield@cart.care

Upon receiving a valid request, we will take reasonable steps to process the deletion request in accordance with applicable law, contractual obligations, security requirements, fraud-prevention requirements, and legitimate retention requirements.

Deletion may not immediately remove information that must be retained by law or that remains temporarily in secure backups, logs, fraud-prevention records, accounting records, or dispute-related records.

CartShield may send:

Transactional, security, account, billing, and legally required communications are considered essential to the Services and may not be disabled.

Promotional communications may be unsubscribed from where applicable.

Opting out of promotional communications does not prevent us from sending essential service, security, billing, or legal communications.

CartShield is primarily a business-to-business service and is not designed to knowingly collect personal information directly from children for independent use of the Services.

However, a merchant's customers may include individuals of different ages.

Where CartShield processes personal data relating to a child on behalf of a merchant, the relevant processing must be carried out in accordance with applicable law and the merchant's responsibilities as the relevant data controller.

If you believe that personal data relating to a child has been improperly submitted to CartShield, please contact us at:

shield@cart.care

We may take appropriate steps to investigate and, where legally required, delete or restrict the relevant information.

We maintain procedures designed to identify, investigate, contain, and respond to personal data security incidents.

If a personal data breach occurs, we will take appropriate steps in accordance with applicable law and our contractual obligations, which may include notifying relevant merchants, individuals, regulators, or other parties where notification is legally required.

We may update this Privacy Policy from time to time to reflect:

When we make material changes, we may provide appropriate notice through our website, dashboard, email, or other reasonable means where required or appropriate.

The "Effective Date" at the beginning of this Privacy Policy indicates when the current version became effective.

This Privacy Policy is intended to operate consistently with the laws and regulations applicable to CartShield and its processing activities, including applicable data protection and cybersecurity requirements of Bangladesh.

Where mandatory applicable law provides a greater or different protection or requirement than this Privacy Policy, the applicable law will prevail.

If you have questions about this Privacy Policy, CartShield's data practices, or a privacy request, please contact: