Privacy policy
How cartsome.com handles personal data. Short, because this site collects very little.
Who we are
cartsome.com is run by Acticly OÜ, registry code 17410015, registered address Mäealuse tn 10, 12618 Tallinn, Harju maakond, Estonia ("we"). We are the controller of the personal data described here. Write to us at hello@cartsome.com.
This policy covers this website. A shop that runs on CartSome has its own privacy policy for its customers: for a shop's customer data, the shop is the controller and we process that data on its behalf, under our agreement with the shop.
What we collect
No cookies, no analytics, no trackers
This site sets no cookies, runs no analytics or advertising scripts, and loads nothing from other companies' servers. Its fonts and images are served from cartsome.com itself.
Access logs
Like any web server, the service that delivers this site (Amazon CloudFront) records each request: the IP address, the time, the address asked for, the browser's user agent and the page that linked to it. We use these logs only to keep the site running and secure.
Contact form
When you send us a message through the form on cartsome.com, we store your name, email address, store name (if given) and message in our platform database so our team can read and answer it in our console. We email our operators a short notice that new messages arrived; that notice contains no message content. Email delivery is handled by Resend. To stop abuse we keep a temporary count of submissions per network for up to two days, without storing your IP address. We delete each message 24 months after we've handled it, or 24 months after it arrived if it was never handled. We never send automated emails to the address you enter.
Why we may
- Access logs: our legitimate interest in running a secure website (GDPR Article 6(1)(f)).
- Contact form and emails: steps you ask us to take before a contract (Article 6(1)(b)), or our legitimate interest in answering you (Article 6(1)(f)).
- The submission count that stops abuse: our legitimate interest in keeping the form usable and safe (Article 6(1)(f)).
We do not sell personal data, and we do not use it for advertising or profiling.
Who helps us
- Amazon Web Services hosts the site and its access logs in its Stockholm region (eu-north-1). CloudFront serves the pages from the edge location nearest the visitor, which can be outside the European Economic Area, under the safeguards in AWS's data processing terms.
- Amazon Web Services also runs the platform database where contact-form messages are stored, in the same Stockholm region.
- Resend delivers the short notices our operators get when new messages arrive; those notices carry no message content.
- Hostinger provides our mailbox, hello@cartsome.com.
How long we keep it
- Access logs: deleted automatically after 90 days.
- Contact-form messages: deleted automatically 24 months after we handled them, or 24 months after they arrived if never handled.
- The submission count per network: gone within two days; it never holds your IP address.
- Emails: kept for 24 months, then deleted, unless you became a customer. Then we keep them for as long as we work together and as long as the law requires.
Your rights
Under the GDPR you can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, restrict how we use it, or hand it to you in a portable form. You can also object to processing based on our legitimate interest. Write to hello@cartsome.com; we answer within one month.
If you think we have handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority where you live.
Changes
When this policy changes, we publish the new version on this page with its date.