Privacy policy

Effective 2026-08-10 · applies to Cartforge apps for Shopify, including Wholesale Gate

Cartforge builds apps that Shopify merchants install on their stores. This policy explains what data our apps handle, why, and what happens to it. The short version: we store only what the app needs to do its job for the merchant, we don't sell data, and we delete it when the merchant leaves.

What we collect

From merchants: your store domain, the access token Shopify issues our app, and the settings you configure.

From wholesale applicants (Wholesale Gate): the information a buyer submits on a merchant's application form — business name, contact name, email, phone, website, business type, tax/resale ID, an optional certificate file, and their message. This data belongs to the merchant whose store the buyer applied to; we process it on the merchant's behalf.

What we do with it

Show applications to the merchant for review, and create B2B records in the merchant's Shopify store when approved.
Send transactional email about an application (confirmation, decision) to the applicant and the merchant. No marketing email, ever.
Keep an audit log of actions taken in the app so merchants can see what happened.

We do not sell or share this data with third parties except the service providers below, and we don't use it for advertising.

Where it lives

Supabase (database & file storage, US) — application data and uploaded certificates.
Vercel (app hosting, US) — processes requests.
Cloudflare (this website, DNS, email routing).
Resend (transactional email delivery), when email sending is enabled.

Retention & deletion

Merchants can delete an application at any time from within the app.
When a merchant uninstalls, Shopify sends us a deletion request ~48 hours later; we then delete all of that store's data, including uploaded files.
Customer-level redaction requests (GDPR/CCPA) sent through Shopify are honored automatically: we delete that person's applications and files.

Your rights

If you're a wholesale applicant, the merchant you applied to is the data controller — contact them first. For anything else, or to reach us directly: support@cartforge.app. We answer within one business day.

Changes

If this policy changes materially, we'll update the date above and note the change in our app changelogs.