Privacy Policy

1. Introduction

This Privacy Policy explains how DevCart Studio ("DevCart", "we", "our", "us") collects, uses, and protects information when you visit devcart.io, contact us for development work, or use our Shopify apps — including ShipCast. If you do not agree with this policy, please do not use our website or services.

2. Data we collect

2.1 Information you give us directly

When you contact us, request a quote, or fill out an audit request, we collect:

• Your name and work email
• Your Shopify store URL, if you choose to share it
• The project details and goals you describe
• Any files or documents you share with us

2.2 Information from active engagements

For active client projects, we also process:

• Billing details — company name, billing address, payment-processor IDs
• Shopify store access tokens you grant us during a build
• Code, designs, and content you share with us under contract

2.3 App merchant data

When you install one of our Shopify apps, we receive and store:

• Your store domain, primary email, and country
• The offline access token Shopify issues when you approve the app
• The rules, templates, schedules, and thresholds you configure
• The email- and SMS-provider credentials you connect (see 2.4)

2.4 Shopper data processed on your behalf (ShipCast)

ShipCast sends abandoned-checkout and order reminders on your behalf. To do that, it processes personal data about your shoppers. For this data, you (the merchant) are the data controller and DevCart is the data processor — we act only on your documented instructions and never use shopper data for our own purposes. We receive this data through Shopify webhooks and your storefront:

Our other apps do not process individual shopper personal data.

2.5 Website usage data

When you browse devcart.io, we may automatically collect:

• IP address and approximate location
• Browser type and device information
• Pages viewed, time on page, referring URL
• Cookie identifiers (see Section 11)

3. How we use your data

We use the information we collect to:

• Respond to your inquiries and provide quotes
• Deliver the services you have engaged us for
• Operate, maintain, and improve our Shopify apps
• Process payments and meet our contractual obligations
• Comply with legal, accounting, and tax requirements
• Detect, prevent, and address technical issues or fraud

We do not sell your data. We do not use your data to train AI models. We do not share it with advertisers.

4. Legal basis for processing (EU and UK visitors)

If you are in the EEA or UK, we process your data on these legal bases:

• Contract — to deliver services you have engaged us for
• Legitimate interest — to respond to inquiries and improve our products
• Consent — for non-essential cookies and direct marketing
• Legal obligation — tax, accounting, and regulatory compliance

5. How we share data

We share data only with parties that help us run our business, and only as needed:

• Payment processors (such as Stripe) to handle billing
• Email and CRM tools to manage replies and project communication
• Cloud infrastructure providers (such as Cloudflare and AWS) for hosting
• Professional advisors (accountants, lawyers) under confidentiality
• Shopify, as required by the Shopify Partner Program and app review

5.1 Sub-processors for ShipCast reminders

To deliver the reminders you configure, ShipCast transmits shopper contact and order data to the following sub-processors:

• Resend — delivers email reminders
• Twilio — delivers SMS and WhatsApp reminders

ShipCast uses a bring-your-own-account model: reminders are sent through the Resend and Twilio accounts you connect, so your own agreements with those providers also govern that delivery. DevCart transmits shopper data to them only to fulfil the sends you have set up.

Each processor is bound by data-processing terms that limit what they can do with your information.

6. Marketing communications

We do not run a newsletter. We do not buy or sell email lists. If we email you, it is because you contacted us first, you are an active client, or you opted in to a specific announcement (such as the ShipCast launch waitlist). You can opt out of any marketing email at any time using the unsubscribe link, or by emailing [email protected].

6.1 Shopper opt-out in ShipCast reminders

Reminders that merchants send through ShipCast honor shopper consent and always offer a one-tap way out:

• Email — every reminder includes a one-click unsubscribe header (RFC 8058) and an in-body unsubscribe link. Unsubscribed addresses are added to a suppression list and are never emailed again.
• SMS and WhatsApp — shoppers can reply STOP to opt out at any time. That number is suppressed from all future messages.

7. Data retention

We retain personal data only as long as we need it:

• Contact form submissions — 24 months from submission
• Closed project files — 5 years after the engagement ends, for tax and dispute purposes
• App merchant data — retained while the app is installed, then deleted within 30 days of uninstall
• ShipCast shopper data — retained only as long as needed to send the reminders you configure, and cascade-deleted when you uninstall the app
• Waitlist sign-ups — until you unsubscribe

We also honor Shopify's mandatory privacy webhooks: when Shopify sends a customer-redaction or shop-redaction request, we delete the corresponding shopper data, and we respond to customer data-access requests through the store owner.

8. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Delete your data ("right to be forgotten")
• Port your data to another service
• Object to certain types of processing
• Withdraw consent for processing that is based on consent

To exercise any of these rights, email [email protected]. We respond within 30 days.

California residents have additional rights under the CCPA, including the right to know what categories of personal information we collect and the right to opt out of any sale of personal information. We do not sell personal information.

9. Data security

We protect your data with industry-standard measures:

• Encryption in transit (TLS) for all data, and encryption at rest for stored shopper data and access tokens
• Access controls based on the principle of least privilege
• Regular security reviews of our infrastructure
• Vendor security assessments before integration

We never sell shopper or merchant data, and we never use it to train AI models.

No system is perfectly secure. If we ever experience a breach affecting your data, we will notify you and the appropriate authorities as required by law.

10. International transfers

DevCart is based in Delaware, United States. Some of our service providers — including Cloudflare, Stripe, and Shopify — operate globally. When your data is transferred outside your country, we rely on standard contractual clauses or other lawful transfer mechanisms.

11. Cookies and tracking

devcart.io uses a small set of cookies:

• Essential cookies — required for the site to work; cannot be disabled
• Analytics cookies — anonymous usage data; can be disabled in your browser

We do not use third-party advertising cookies. We do not run retargeting pixels.

12. Children

Our services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a child, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page reflects the most recent revision. Material changes will be announced at devcart.io or by direct email to active clients.

14. Contact

Questions or requests about your data?

DevCart Studio
124 Broadkill Rd #599
Milton, DE 19968
United States
[email protected]