Privacy Policy – Gulacart

Gulacart ("we", "us", "our") operates the gulacart.com platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this policy carefully.

1. Information We Collect

1.1 Information you provide directly

Account data: email address, full name, and password when you create an account
Store data: store name, WhatsApp number, product listings (names, descriptions, prices, images), categories, and store settings
Payment data: billing information processed by our payment partner Dodo Payments. We do not store credit card numbers on our servers.
Support communications: emails, messages, and feedback you send to us

1.2 Information collected from store customers

Order data: customer name, phone number, and delivery address provided at checkout. This data is used solely to generate a WhatsApp order message to the store owner and to display in the store owner's order dashboard.
Browsing data: page views and add-to-cart events on storefronts, collected for analytics provided to store owners on paid plans

1.3 Information collected automatically

Device and browser: browser type, operating system, screen resolution, and language preferences
Usage data: pages visited, features used, session duration, referral source
IP address: used for security, fraud prevention, and approximate geolocation (country-level)
Cookies: see our Cookie Policy

2. How We Use Your Information

To create and maintain your Gulacart account and store
To process orders and send order notifications to store owners via email
To process subscription payments through Dodo Payments
To provide product analytics (page views, conversion rates) to store owners on paid plans
To send transactional emails: order confirmations, verification emails, password resets, and billing receipts
To detect and prevent fraud, abuse, and security incidents
To improve and develop new features for the Gulacart platform
To track affiliate referrals and calculate partner commissions
To respond to your support requests and communications
To comply with legal obligations

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal basis for collecting and processing your data includes:

Contract performance: processing necessary to operate your store and fulfill our service agreement
Legitimate interests: improving our platform, fraud prevention, and marketing our services
Consent: where you have provided explicit consent, such as for marketing communications
Legal obligation: where we are required to process data by law

4. Data Sharing

We do not sell your personal data. We share data only with the following third-party service providers who process data on our behalf:

Supabase (San Francisco, USA) — database hosting and user authentication
Vercel (San Francisco, USA) — website hosting and edge computing
Dodo Payments — subscription and payment processing
Resend — transactional email delivery
Umami — product analytics and event tracking, self-hosted on our own infrastructure (analytics.pixelhivellc.com); analytics data is not passed to a third-party analytics vendor
Endorsely — affiliate program tracking

We may also disclose your data if required by law, court order, or governmental authority, or if necessary to protect our rights, property, or safety.

5. Data Retention

We retain your account data and store content for as long as your account is active. After account deletion:

Account and store data is deleted within 30 days
Order records may be retained for up to 12 months for legal and accounting purposes
Anonymized analytics data may be retained indefinitely for aggregate reporting
Backup copies are automatically purged within 90 days

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure that appropriate safeguards are in place, including standard contractual clauses approved by the European Commission where applicable.

7. Data Security

We implement industry-standard security measures to protect your data:

All data transmitted over HTTPS with TLS 1.3 encryption
Row-level security (RLS) on our database, ensuring users can only access their own data
Server-side role-based access controls
Webhook signature verification to prevent tampering
Passwords hashed using bcrypt via Supabase Auth
Regular security reviews and dependency updates

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you
Correction: request correction of inaccurate or incomplete data
Deletion: request deletion of your personal data ("right to be forgotten")
Portability: request a machine-readable copy of your data
Restriction: request that we limit processing of your data
Objection: object to processing based on legitimate interests
Withdraw consent: withdraw previously given consent at any time

To exercise any of these rights, contact privacy@gulacart.com. We will respond within 30 days.

9. Children's Privacy

Gulacart is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email to your registered address. Your continued use of Gulacart after the changes take effect constitutes your acceptance of the updated policy.

11. Contact

For privacy-related questions or data requests, email privacy@gulacart.com.