Privacy Policy

1. Important Notice: Roles & Data Architecture

To understand how your data is handled, it is essential to distinguish between the distinct user groups on Microcart:

2. Information We Collect

A. Information Provided by Merchants

When you register, create a store, or manage settings on Microcart, we collect:

• Account Credentials: Email address, hashed password, or third-party authentication tokens (e.g., when signing up via Google OAuth).
• Store Profile Information: Store name, store slug/subdomain, store bio, logo image, cover image, country, currency, business phone number, email address, and social profile links (such as Instagram, TikTok, Facebook, or custom website URLs).
• WhatsApp Contact Number: The phone number designated by you to receive incoming customer orders and chat inquiries via WhatsApp.
• Product & Catalog Data: Product titles, descriptions, pricing, categories, photos, inventory/stock statuses, variant details (e.g. sizes, colors), bundles/packages, and time-limited promotional "Drops".
• Billing & Subscription Information: When subscribing to paid tiers (such as Microcart Pro), payments are processed by our PCI-DSS compliant third-party payment gateway. We do not store complete debit/credit card numbers or CVV codes on our servers. We only receive and retain tokenized transaction references, subscription identifiers, plan status, renewal dates, and payment metadata (e.g. card brand, last 4 digits, expiry) for account administration and invoicing.
• Referral Information: Referral codes used or shared, attribution records, and referral reward eligibility.

B. Information Collected from Buyers / Customers

When a customer visits a Merchant's storefront and submits an order:

• Order Details: Selected products, quantities, variant configurations, and subtotal amounts.
• Buyer Information: Name, phone number, delivery address, and any customer notes provided during checkout.
• Dispatch to WhatsApp: This information is packaged into an order summary and sent via an automated deep-link to the Merchant's registered WhatsApp number. A tokenized copy is stored in our database so that the Merchant can review order history in their dashboard.

C. Automatically Collected Technical Data

When you visit our marketing pages, dashboard, or storefronts, our infrastructure automatically collects:

• Device and Connection Details: IP address, browser type and version, operating system, language preferences, screen resolution, and referring URLs.
• Usage and Activity Logs: Date and time stamps of visits, pages viewed, and basic interface interactions.
• Storage and Cookies: Session tokens, security cookies, and local browser storage strictly necessary to keep you authenticated, protect against CSRF attacks, and remember UI preferences (such as dark/light mode).

3. How We Use Your Information

We process personal information for the following specific purposes:

• Platform Operation: To create and maintain your account, authenticate login sessions, generate your storefront subdomain, and host product listings.
• Order Routing via WhatsApp: To format order details and generate direct wa.me links connecting Buyers directly with Merchants on WhatsApp.
• Billing & Subscriptions: To administer subscription plans, issue receipts, prevent payment fraud, and process recurring renewals.
• Platform Security & Reliability: To monitor performance, detect and mitigate malicious activity, prevent unauthorized access, and protect against distributed attacks.
• Customer Support: To assist you with technical inquiries, investigate bug reports, and resolve account issues.
• Legal Compliance: To comply with applicable tax, accounting, consumer protection, and privacy laws or valid government requests.

4. Legal Bases for Processing (EEA, UK, and Swiss Users)

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases pursuant to the General Data Protection Regulation (GDPR):

• Performance of a Contract (Article 6(1)(b) GDPR): Processing required to deliver the Services you requested under our Terms of Service.
• Legitimate Interests (Article 6(1)(f) GDPR): Necessary for our legitimate business interests, provided those interests do not override your rights (e.g. securing our infrastructure, preventing fraud).
• Legal Obligations (Article 6(1)(c) GDPR): Necessary to fulfill statutory accounting, tax, or legal requirements.
• Consent (Article 6(1)(a) GDPR): Where you specifically grant permission for particular processing. You may revoke consent at any time.

5. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal information. We disclose information only under the following limited circumstances:

1. Between Merchants and Buyers: When a buyer initiates an order, their order contents, buyer name, and delivery details are transmitted to the Merchant via WhatsApp to enable order fulfillment.
2. Third-Party Service Providers (Subprocessors): We engage trusted vendors who process data strictly according to our instructions and data protection obligations:
   • Payment Processing: PCI-compliant payment gateways (e.g., Flutterwave) for secure subscription billing.
   • Transactional Email: Providers used for password resets and system notifications.
3. Legal Requirements & Protection: If required by law, subpoena, court order, or where reasonably necessary to protect the rights, property, or safety of Microcart, users, or the public.
4. Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition, subject to the recipient honoring this Privacy Policy.

6. WhatsApp and Third-Party Messaging

Microcart facilitates frictionless commerce by connecting Customers directly to Merchants via WhatsApp (wa.me links).

7. Data Retention & Account Deletion

• Active Accounts: We retain Merchant account data, catalog contents, and store profiles for as long as your account remains active.
• Account Cancellation & Deletion: Merchants may request full deletion of their store and account at any time through their dashboard settings or by emailing support@microcart.app. Upon deletion, your store, products, images, and personal credentials will be permanently erased or anonymized from active databases, except for data required to be kept for statutory tax/legal compliance.
• Order Records: Lead and order records generated on storefronts are retained for the Merchant's administrative reference until the Merchant deletes them or deletes their store account.

8. Data Security

We implement rigorous technical and organizational measures to safeguard your information:

• Encryption: All data in transit is encrypted using modern TLS (TLS 1.2 / TLS 1.3). Database storage is encrypted at rest.
• Access Controls: Production databases are restricted to authorized personnel under least-privilege principles.
• Secure Credentials: Passwords are never stored in plaintext; they are salted and hashed using industry-standard cryptographic functions.

Please note: No transmission method over the internet or electronic storage solution is 100% secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee absolute security.

9. International Data Transfers

Microcart operates globally utilizing distributed cloud infrastructure. Consequently, your information may be transferred to, stored, and processed in countries other than your country of residence, where data protection laws may differ. When transferring personal data internationally, we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable.

10. Your Privacy Rights

Depending on your jurisdiction, you may hold rights to:

• Access / Know: Request confirmation of processing and obtain a copy of your personal data.
• Rectification: Request correction of inaccurate, incomplete, or outdated data.
• Erasure ("Right to be Forgotten"): Request deletion of your personal data.
• Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Restrict or Object: Restrict or object to certain forms of data processing.
• Non-Discrimination: We will never discriminate against you for exercising your legal privacy rights.

11. Cookies and Tracking Technologies

Microcart uses minimal, functional cookies and local browser storage necessary for platform operation:

• Strictly Necessary Cookies: Required for authentication, security tokens (CSRF protection), and session continuity.
• Preference Storage: Local storage used to remember UI preferences, such as your chosen theme (dark/light mode).
• No Ad Trackers: We do not deploy third-party advertising cookies or participate in cross-site tracking ad networks.

12. Children's Privacy & Policy Updates

The Platform is not directed to individuals under the age of 18 (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information, please contact us immediately.

We may update this Privacy Policy periodically. When changes occur, we update the "Last Updated" date at the top. For material modifications, we provide notice via the dashboard or email.