Cart Station ("we", "us") runs cartstation.io, where sellers run online stores for digital products: product pages, a cart
they add to their own websites, checkout, and delivery of the files buyers purchase. This policy explains what information we
collect, how we use it, who we share it with, and the choices you have.
The short version: we collect only what we need to run stores, take payments and deliver purchases. We do not
sell your information, and we do not share it with anyone except the companies that help us run the service (such as Stripe for
payments and Google Analytics for understanding how the site is used), the seller you buy from, and where the law requires it.
1. Who this policy covers
Sellers: store owners and the team members they invite, who sign in to run a store.
Buyers: anyone who buys from a store, whether on the seller's own website or on cartstation.io.
Visitors: anyone browsing cartstation.io or contacting us.
2. Information we collect
From sellers
Your name, email address and password (stored as a one-way hash), or your Google account's name and email if you sign in with Google.
Your store's details: its name, web address, logo, description and contact information.
The products and files you upload.
From buyers
Your name, email address and what you bought, so we can deliver it and send your receipt.
Download activity (when a file was downloaded, and the IP address and browser used), so download limits work and misuse can be spotted.
Payment details are entered into Stripe's payment form and go straight to Stripe. We never see or store your full card number.
From everyone
Messages you send through our contact form.
Basic technical information, such as IP address, browser type and the pages visited, used for security and to keep the site working.
3. How we use information
To provide the service: host stores and products, take payments, and deliver purchases.
To send email about the service: account invitations, password resets, receipts, download links and replies to your messages.
To keep the service secure: preventing fraud and abuse, such as stolen-card testing, and protecting accounts.
To understand how the site is used and improve it.
To meet legal, tax and accounting obligations.
4. How we share information
We do not sell personal information, and we do not share it for advertising. We share information only as follows:
The seller you buy from. Each sale is made by the seller, so they see your name, email address and what you
bought, to provide support and keep their records.
Stripe processes payments into each seller's own Stripe account. Stripe receives buyers' payment details and
the information sellers provide when connecting their account, and handles it under
Stripe's privacy policy.
The service providers that run our infrastructure, such as the companies that host our servers, store files and
deliver our email, which handle information only to provide those services to us.
When the law requires it, or to protect the rights and safety of our users and the service.
5. Cookies and analytics
Essential cookies and storage keep sellers signed in, protect forms against forgery, carry short messages between pages, and remember a buyer's cart. The site doesn't work properly without them.
Analytics cookies are set by Google Analytics to count visits and see how pages are used. You can block them in your
browser settings, or use Google's opt-out browser add-on.
Stripe's payment form sets its own cookies to process payments securely and prevent fraud.
A seller's own analytics: a seller can add their own Google Analytics or Meta Pixel to their store's pages here,
and is told when you buy from them, with the order number, amount and products (not your name or email). They handle that
under their own privacy policy. On a seller's own website, the seller's own tools apply.
We don't use advertising cookies.
6. How long we keep information
Seller accounts and store information are kept while the account is active, and deleted on request when no longer needed.
Order records are kept for as long as needed for accounting, tax and legal purposes, and so buyers can download their purchases again.
Contact form messages are kept only as long as needed to respond and follow up.
7. Security
The site is served over encrypted connections (HTTPS). Passwords are stored as one-way hashes, payment details go straight to Stripe,
product files are served only through limited download links, and sellers see only their own store's information, according to
their role. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach where
the law requires.
8. Your choices and rights
Access, correct or delete: you can ask for a copy of the personal information we hold about you, or ask us to correct or delete it. Sellers can update much of their information in the portal.
Analytics: block analytics cookies as described above.
State privacy rights: depending on where you live (for example, California), you may have rights to know, access,
correct and delete your personal information, and to opt out of its sale or sharing for advertising. We don't sell or share it for
advertising, so there is nothing to opt out of. We won't treat you differently for exercising your rights.
To make a request, contact us. We may need to confirm your identity first. Where we
hold information on behalf of a seller, such as their order records, we may involve that seller.
Our service is run from, and stores information in, the United States. If you use it from elsewhere, your information will be
handled in the United States.
9. Changes to this policy
We may update this policy as the service changes. We'll post the new version here with a new effective date, and for significant
changes we'll tell sellers by email or in the portal.
10. Contact us
Questions or requests about privacy? Send us a message through our contact page.