Cartline is a Shopify app operated by GnK Web, LLC. This policy covers what we hold, what we do not, and what happens when you stop using it.
The short version
What we store about your shop
| What | Why |
|---|---|
| Your myshopify domain | To know which shop a request belongs to |
| An access token, encrypted | To read your products and build your page |
| Your plan and charge reference | To know what you are subscribed to |
| Install and uninstall dates | Billing history and support |
Access tokens are encrypted at rest with AES-256-GCM. They are never logged and never shown in any interface.
Where your page settings live
The configuration for each Cartline page — packs, cards, colours, layout — is stored on the product in your Shopify store, as a metafield. Not in our database. That is deliberate: your settings stay with your products, under your control, and they survive us.
What we do not store
- Customer names, emails, phone numbers or addresses
- Payment details of any kind — we never see them
- Order contents or order history
- Cart contents; the cart is Shopify's and lives in your customer's browser session
The assistant, if you enable it
The AI assistant is off unless you turn it on. When enabled, a shopper's question and the relevant product data are sent to Anthropic's API to generate a reply. Conversations are held in memory for the length of a session and are never written to disk. You supply your own API key, so that relationship is between you and the provider.
Shopify's compliance webhooks
Shopify requires every app to answer three requests. Ours do:
- Customer data request — we report that no personal data about shoppers is held, because none is.
- Customer redact — nothing to erase, for the same reason.
- Shop redact — sent 48 hours after uninstall. We delete the install record, including the encrypted access token, outright.
Uninstalling
Uninstalling immediately stops the app using your access token and stops any further billing. Forty-eight hours later Shopify sends the redact request and the record is deleted. Your page settings remain on your products, where they always were.
Third parties
| Who | What they receive |
|---|---|
| Shopify | API requests to read your products and create checkouts |
| Anthropic | Only if you enable the assistant: the question and product context |
| Hostinger | Hosts the server the app runs on |
We do not use analytics, advertising or tracking services in the app, and we do not sell or share data with anyone.
Security
Everything is served over HTTPS. Access tokens are encrypted at rest. Webhooks are verified against Shopify's signature before being acted on, and requests to the storefront page are verified against Shopify's app proxy signature.
Contact
Questions about this policy, or a request about data we hold, go to support@cartline.app. We answer within two business days.