Privacy Policy

1. Your account

Email address (for sign-in codes and service emails), your language, and for abuse prevention the sign-up IP address and a technical device fingerprint. Sign-in codes are stored hashed and expire in 10 minutes.

2. Store workspace

The product catalog you import or add (titles, descriptions, photos, prices), the clips we generate for you, your reactions and the post statistics you enter, your plan and credit ledger. Card data is handled by Stripe and never reaches us.

3. AI assistants and the API

You can connect CartViral to an AI assistant such as Claude, ChatGPT or Cursor through our MCP server (app.cartviral.com/mcp), or call the REST API with an API key. To connect, you sign in to CartViral and approve the assistant. It then holds an access token for your account and can do what you can do in the cabinet: read your products, credits, characters and results, and start jobs that spend your credits at the cabinet's prices.

We receive only what the assistant sends in a tool call, for example a product link, a prompt, a file it uploads or a choice of format, and we keep it as we keep the same action in the cabinet. We never receive your conversation with the assistant. What the assistant does with our replies is covered by its provider's privacy policy (for example Anthropic for Claude, OpenAI for ChatGPT).

Access tokens last one hour and refresh tokens 90 days; tokens and API keys are stored only as hashes. You can disconnect an assistant or revoke a key at any time in Account, Claude & ChatGPT, and it stops working at once.

4. Affiliate tracking on brand stores

When a buyer opens a generator's link, we record the click (a hashed IP address and the browser user agent) and send the buyer to the brand's store with a click id.

The brand's CartViral pixel runs in the brand's own store under its customer-privacy settings. It stores the click id in the store's first-party storage and sends us: the click id, the store's anonymous client id, and at checkout the order id, order amounts and currency, and a one-way hash of the buyer's email - used only to block generators from buying through their own links. We never receive buyer names, addresses or payment details.

Stores on Shopify plans with Flow may also send order confirmations and refunds (order id, amounts, taxes, the link that brought the visit).

For its storefront visitors the brand decides whether tracking runs (cookie consent); CartViral processes this data on the brand's behalf to attribute sales. Tracking memory expires after 90 days; raw tracking events after 60 days.

5. Earn workspace

Your handle and the social accounts you choose to show brands, the offers you join, clips you generate and the post links you record, attributed sales, payouts and the payout destination you provide (PayPal email or USDT address).

6. Cookies

Essential first-party cookies only: the sign-in session, your language, the last page per workspace, the channel that first brought you here (for example a utm_source tag or the referring site, kept 60 days so we know which channels work) and, if you arrived through a referral link, its code. No advertising cookies and no third-party analytics cookies on app.cartviral.com.

7. Who helps us

Railway (hosting and database) and our own media storage server; Resend (email); Stripe and lava.top (payments; card data never reaches us); Google (only if you choose Continue with Google; we keep just the email); Telegram (if you write to our bot); OpenRouter and OpenAI (understanding product pages, photos and scripts); Jina and the Etsy and eBay APIs (reading the product pages you import); fal.ai, VideoGen, Higgsfield and Fish Audio (image, video and voice generation); Vercel (the cartviral.com website); and public currency-rate services (no personal data). The AI services receive product images, prompts and scripts, never buyer data.

8. Keeping and deleting

We keep account data while your account exists. Request deletion in Account settings or by email; we erase your data within 30 days, after paying out any earned balance and keeping only what the law requires (for example payment records).

9. Your rights

You can ask for access to your data, correction, deletion, restriction or a copy, and object to processing. Write to support@cartviral.com; we answer within 30 days. You can also complain to your data protection authority.