Pre-launch draft. Operator and hosting disclosures must be completed before App Store submission.

Privacy policy

How CartLadder handles merchant and storefront data.

Version: 17 October 2026. Operator: CartLadder, part of Digital Heroes. Creator: Divyansh Singh. Privacy contact: support@digitalheroes.co.in.

What the app does

CartLadder lets Shopify merchants configure quantity discounts and same-product BOGO offers, display an offer block on product pages, and collect per-item text customization. The merchant controls its products, offer rules and customer relationship.

Information processed

• Store domain, currency, time zone, selected product/collection identifiers and labels, offer rules, appearance settings and synchronization status.
• Shopify installation/session data and access/refresh tokens needed to authenticate the app. Shopify session records can include an authorized merchant staff member’s user identifier, name, email and locale.
• Theme identifier, role and a last-seen timestamp used to check setup.
• Optional aggregate daily offer-view, selection and add-to-cart counts. The app does not create advertising profiles or store visitor identifiers. Optional metrics are disabled by default and are collected only when enabled and Shopify reports analytics consent is permitted.
• Support messages and any diagnostic information you choose to send. Hosting infrastructure may process technical request data to deliver and secure the service.

Customer personalization and payments

The text a shopper enters for each item is sent directly from the storefront to Shopify as cart line-item properties. CartLadder does not store that text in its application database or copy customer/order records. The merchant and Shopify manage the resulting cart, order and fulfillment information. The app does not collect payment card details; Shopify handles checkout and any app subscription approval.

Use and sharing

Data is used to provide the app, maintain authenticated access, synchronize offers, troubleshoot support requests and secure the service. It is not sold or shared for advertising. Necessary service providers may process it for hosting, database storage, backups and support under the operator’s instructions. Service providers: Cloudflare (application hosting); Supabase (PostgreSQL database). Hosting region: Cloudflare container: eastern North America; Supabase: AWS us-east-1; edge processing may occur globally. Request details and applicable provider agreements from the privacy contact. Shopify processes data under its own applicable terms and privacy policy.

Retention and deletion

App configuration and merchant session data are kept while the app is installed. Authenticated uninstall and shop-redaction webhooks remove the store’s app records, with related offer tiers and metrics deleted through database relations. Optional interaction records have a default 90-day retention period; the production retention job must run daily. The backup retention period must be confirmed before launch. Deletion requests must be reapplied after any restore.

Requests and rights

Merchants can request access, correction or deletion through support@digitalheroes.co.in. Shoppers should contact the store that collected their order or personalization details. CartLadder authenticates Shopify’s mandatory customer data-request, customer-redaction and shop-redaction webhooks. Where no customer data is held by CartLadder, there is no matching customer record to export or delete. The operator will address valid requests within applicable legal and Shopify deadlines.

Security and transfers

Production deployment requires HTTPS, restricted access to secrets and the database, and protected backups. Hosting and support providers may process data outside your country; contact the privacy address for details of applicable safeguards and provider agreements. Never send passwords, API secrets, card details or unnecessary customer data in a support ticket.

Changes

Material changes will be published here with an updated version date. Changes to personal-data use must be reviewed and communicated before they take effect.