Privacy Policy

1. Your account

Email address (for sign-in codes and service emails), your language, and for abuse prevention the sign-up IP address and a technical device fingerprint. Sign-in codes are stored hashed and expire in 10 minutes.

2. Store workspace

The product catalog you import or add (titles, descriptions, photos, prices), the clips we generate for you, your reactions and the post statistics you enter, your plan and credit ledger. Card data is handled by Stripe and never reaches us.

3. Affiliate tracking on brand stores

When a buyer opens a generator's link, we record the click (a hashed IP address and the browser user agent) and send the buyer to the brand's store with a click id.

The brand's CartViral pixel runs in the brand's own store under its customer-privacy settings. It stores the click id in the store's first-party storage and sends us: the click id, the store's anonymous client id, and at checkout the order id, order amounts and currency, and a one-way hash of the buyer's email - used only to block generators from buying through their own links. We never receive buyer names, addresses or payment details.

Stores on Shopify plans with Flow may also send order confirmations and refunds (order id, amounts, taxes, the link that brought the visit).

For its storefront visitors the brand decides whether tracking runs (cookie consent); CartViral processes this data on the brand's behalf to attribute sales. Tracking memory expires after 90 days; raw tracking events after 60 days.

4. Earn workspace

Your handle and the social accounts you choose to show brands, the offers you join, clips you generate and the post links you record, attributed sales, payouts and the payout destination you provide (PayPal email or USDT address).

5. Cookies

Essential first-party cookies only: the sign-in session, your language, the last page per workspace and, if you arrived through a referral link, its code. No advertising or analytics cookies on app.cartviral.com.

6. Who helps us

Railway (hosting and database), Resend (email), Stripe (payments), fal.ai and Fish Audio (AI video and voice generation - they receive product images, prompts and scripts, never buyer data), Vercel (the cartviral.com website), and public currency-rate services (no personal data).

7. Keeping and deleting

We keep account data while your account exists. Request deletion in Account settings or by email; we erase your data within 30 days, after paying out any earned balance and keeping only what the law requires (for example payment records).

8. Your rights

You can ask for access to your data, correction, deletion, restriction or a copy, and object to processing. Write to support@cartviral.com; we answer within 30 days. You can also complain to your data protection authority.