Cartfix: Cart Drawer & Upsell – Privacy Policy

Cartfix: Cart Drawer & Upsell (“the App”) replaces a Shopify store’s cart page with a slide-out cart drawer with reward bar, product recommendations and add-ons (“the Service”). This Privacy Policy describes which information is collected, used and shared when you install or use the App. Last updated: November 2026.

Information the App stores

• Shop – your shop domain, shop currency and the access token Shopify issues to the App.
• Drawer configuration – the design, texts, reward tiers, chosen products and add-ons you set in the App. It is also written to an app metafield of your store so the drawer can show it.
• Anonymous daily counters – how often per day the drawer was opened, products were added, recommendations were shown and checkout was clicked. No IP address, cookie, visitor, session, cart or customer identifier is stored.
• Orders (read_orders) – for every new order the App keeps the order ID and date (to count orders per 30 days for your plan). For orders placed through the drawer it also keeps the order total, the amount of recommended products in it and the currency. It does not store customers, names, addresses, e-mail addresses or order contents.
• Products (read_products), shipping (read_shipping), discounts (write_discounts) – to pick products for recommendations, gifts and add-ons, to read your free-shipping threshold, and to grant reward discounts. This data is not stored beyond the configuration above.
• Store contact data – shop name and contact e-mail from Shopify, used to answer support requests and for service messages about the App.

Your customers

The drawer runs in your customers’ browsers and talks to your store’s own cart. The App sets no cookies, runs no third-party trackers and does not receive personal data of your customers.

How we use the information

Only to provide the Service: show the drawer as you configured it, show you its statistics, bill the plan that matches your order volume, support you, and send the emails described under "Emails to merchants".

Sharing

The data is hosted by Fly.io (Frankfurt, Germany). We do not sell it and share it only as described here and under "Emails to merchants" (Brevo) and "AI-assisted handling of support requests". Shopify processes data as the platform operator.

Retention and deletion

When you uninstall the App, Shopify sends a shop deletion request 48 hours later; then all data of your store (configuration, counters, order records) is deleted. Order records are pruned after 60 days anyway. Customer data requests are answered with “no customer data stored”. Data for the emails to merchants is kept as described under "Emails to merchants".

Emails to merchants

After an install, Appsentials (Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany) sends service and information emails about the App to your store's contact email (the store email or contact email stored in Shopify):

• a welcome email with help for the setup,
• reminders about your plan and the end of a trial,
• a monthly summary of the App's own numbers for your store,
• a request to rate the App in the Shopify App Store,
• occasionally, information about our own similar apps,
• after an uninstall, one short question about what was missing.

We also reply by email to the support messages you send us. For these emails we process your store name, store domain, contact email, language and country, the App's usage status (e.g. installed, plan, trial, setup progress, uninstalled) and the App's own monthly numbers for your store.

Legal basis: for service emails that are necessary for using the App (e.g. setup help, plan and trial reminders, replies to support messages) Art. 6(1)(b) GDPR; for review requests and information about our own similar apps our legitimate interest in looking after existing customers, Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (German Act Against Unfair Competition, existing-customer exception). You can object to these emails at any time, free of charge (apart from the transmission costs at basic rates), via the unsubscribe link in every email or by replying to an email.

The emails are sent via Brevo (Sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France), which processes the data as our processor (Art. 28 GDPR). The planner that schedules the emails is hosted on Fly.io in the EU region Frankfurt, Germany.

Storage: we keep this data for as long as the App is installed and for at most 12 months after an uninstall. If you unsubscribe or object, we keep your email address permanently on a block list so that we do not email you again.

AI-assisted handling of support requests

When you write to us through the chat in the app, we have an AI service suggest a draft reply. For this we send the text of your message, the previous conversation and the following details about your store to Anthropic: store name and store domain, your plan and subscription status, the end of a trial, admin and store language, country, whether it is a development store, install date, whether setup is complete, and the app page you wrote from. We do not send your email address. A human reads every draft and changes it where needed before we reply. There is no automated decision-making within the meaning of Art. 22 GDPR.

The provider is Anthropic (contracting party for customers in the EEA: Anthropic Ireland, Limited; parent company: Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA). Anthropic processes the data as our processor under its Data Processing Addendum (Art. 28 GDPR), which is part of Anthropic's commercial terms. Under these terms Anthropic may not use the data to train its AI models. The data may also be processed in the USA. Such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) agreed in Anthropic's Data Processing Addendum. Anthropic keeps the data only as long as its terms require for providing the service and preventing abuse.

The legal basis is our legitimate interest in answering your request quickly and correctly (Art. 6(1)(f) GDPR); where the request concerns your use of the app, also Art. 6(1)(b) GDPR. You can object to this processing at any time, for example by email to hello@monetais.de. We will then answer your requests without AI. We keep the conversation and the draft replies while we handle your request and while the app is installed.

More about privacy at Anthropic: https://www.anthropic.com/legal/privacy

Your rights

If you are a European resident, you have the right to access, correct and delete the information we hold about you. Contact us below.

Contact

E-mail: hello@monetais.de · Appsentials, Luis Benz, Comeniusstr. 4, 01307 Dresden, Germany.