Kartel ("the app", "we") is a Shopify app that runs discounts for Shopify stores: offers by cart value, bundles, quantity breaks, free gifts and similar. It is provided by Shreyas Labs. This policy explains what information Kartel collects when a merchant installs it, why, and what we do with it.
Who this covers
- Merchants: the store owners and staff who install and use Kartel.
- Shoppers: customers of a store that uses Kartel. We process shoppers' information only on behalf of the merchant, to apply the merchant's discounts.
What Kartel collects and why
From the merchant's store, through Shopify's APIs:
| What | Why | Kept |
|---|---|---|
| The store's domain, plan with Kartel, and app login session | To run the app and know which features the store's plan includes | While installed, then deleted |
| The offers the merchant creates (names, rules, dates, messages) | To apply them | While installed |
| Products, collections, tags and prices, read when needed | To decide which items an offer counts | Not stored; cached for at most a minute |
| Discount records Kartel creates in Shopify | To keep Shopify's discounts in step with the offers | While installed |
| Order IDs and dates of orders that got a Kartel discount | To count usage against the store's plan and bill it through Shopify | While installed, then deleted |
| Keys the merchant creates to connect a mobile app or headless store (name and dates; the secret isn't stored) | To let that storefront show the same offers | Until the merchant turns them off or uninstalls |
About shoppers, only to apply discounts:
| What | Why | Kept |
|---|---|---|
| Customer tags and number of past orders, read from Shopify when a signed-in shopper's cart is checked | Offers limited to some customers, such as "first order only" or "customers tagged VIP" | Not stored; cached for at most a minute |
| Per-customer use counts, when an offer limits how often a customer can use it | To enforce the limit | Stored in the merchant's Shopify store (customer metafields), deleted on request |
| The cart's contents and Kartel's own cart notes (which offer applied, a free gift choice) | To show progress and add free gifts | Not stored by Kartel; they stay in the cart and become notes on the order in Shopify |
Kartel does not collect or store shoppers' names, email addresses, phone numbers, addresses or payment details, and never uses customer data for marketing, profiling, export or anything other than applying the merchant's discounts.
Where data is processed
On servers in the United States. Shopify processes store and order data under its own privacy policy.
Sharing
We don't sell or rent personal information. We share it only with:
- Shopify, which hosts the store, runs the discounts at checkout and bills the merchant for Kartel. Usage reports to Shopify contain the store and an order count, never shopper details.
- Our hosting and infrastructure providers, under contracts that keep the data confidential.
- Authorities, when the law requires it.
Shoppers' rights and requests
Shoppers make privacy requests to the merchant. When a merchant passes on a request through Shopify:
- Access (Shopify's customer data request): we prepare a report of what Kartel holds about that customer and give it to the merchant.
- Deletion (Shopify's customer redaction): we delete Kartel's records about that customer, including use counts and order records.
We complete requests within 30 days.
When a merchant uninstalls Kartel
Kartel stops running the store's offers at once. 48 hours after uninstall, Shopify asks us to erase the store's data, and we delete everything Kartel holds for that store. A merchant can ask for deletion sooner at support@shreyaslabs.com.
Security
Data travels encrypted (HTTPS). Access to the database is limited to the people who run Kartel. Connection keys for apps are derived from a server secret and never stored.
Changes
We'll update this page when Kartel's handling of data changes and note the date above.
Contact
Shreyas Labs, support@shreyaslabs.com.