Cartalyst AI — Privacy Policy

This Privacy Policy explains how Cartalyst AI (“Cartalyst”, “we”, “our”, “us”), an unincorporated UK-based business currently in the process of establishing a registered company, collects, uses, and protects information when you visit our website or when our services are used on e-commerce platforms. By using the Site or our services, you agree to the terms of this Privacy Policy.

1. Who We Are
   Cartalyst AI operates the website located at https://cartalyst.ai and provides an AI-powered sales agent for e-commerce stores. For the purposes of applicable data protection law, including the UK GDPR, the EU GDPR, and the California Consumer Privacy Act (CCPA), Cartalyst AI acts as the Data Controller for personal data collected through its website.
   Contact: robert@cartalyst.ai

2. Information We Collect
   2.1 Website Visitors
   When you visit the Site, we may automatically collect:
   IP address
   Browser type and version
   Device type and operating system
   Pages viewed and time spent on the Site
   Referring websites
   Basic technical and analytics logs
   This data is collected through standard analytics tools, such as Google Analytics, and is used solely for operating and improving the Site.

2.2 Business Clients
When you register or enquire about our services, we collect:
Name
Business email address
Company name
Phone number (optional)
Message or enquiry details

2.3 Shopper Conversation Data
Cartalyst AI integrates with e-commerce stores as a conversational sales agent. When shoppers interact with the Cartalyst agent on a client's store, the content of those conversations is processed and temporarily stored on our infrastructure (Google Cloud Platform). We do not collect, store, or process shoppers' names, email addresses, or any other personal identifiers. Conversation data is used solely to power and improve the agent's responses within the client's session and is not used to train third-party AI models.

3. How We Use Personal Data
   We use personal data for the following purposes:
   Responding to enquiries and providing information about our services
   Onboarding and managing client accounts
   Operating, maintaining, and improving the Site and our services
   Detecting and preventing security issues or misuse
   Analytics and performance measurement
   Compliance with legal obligations
   We do not sell personal data or share it with third parties for advertising or marketing purposes.

4. Legal Basis for Processing
   We process personal data based on the following legal grounds:
   Legitimate interests — responding to enquiries, improving our services, and securing our systems
   Contract performance — processing data necessary to provide our services to clients
   Consent — where you voluntarily submit your information
   Legal obligation — where disclosure is required by applicable law

5. Multi-Jurisdiction Compliance
   5.1 EU/UK GDPR
   We process personal data of EU and UK residents in accordance with the General Data Protection Regulation (GDPR) and UK GDPR, including rights of access, rectification, erasure, restriction, objection, and data portability.

5.2 California Consumer Privacy Act (CCPA)
Residents of California have the right to:
Know what personal information we collect, use, or disclose
Request deletion of their personal information
Opt out of the sale of personal information (we do not sell personal data)
Non-discrimination for exercising their privacy rights
To exercise your rights under the CCPA or GDPR, contact us at robert@cartalyst.ai.

6. Data Sharing
   We may share personal data only with:
   Service providers that support the operation of the Site and our services, including hosting providers (Google Cloud Platform) and analytics tools
   Legal or regulatory authorities, where required by applicable law
   Internal team members for operational purposes
   All service providers are required to comply with UK GDPR, EU GDPR, or equivalent safeguards. We never sell personal data.

7. International Data Transfers
   Our infrastructure is hosted on Google Cloud Platform. Some data may be stored or processed outside your country of residence. Where international transfers occur, we ensure appropriate safeguards are in place, including:
   Standard Contractual Clauses approved under EU or UK law
   UK International Data Transfer Agreements (UK IDTAs)
   Transfers to countries recognised as providing adequate protection

8. Data Retention
   We retain personal data only for as long as necessary for the purposes described in this Policy:
   Enquiry and contact data: up to 12 months from last contact
   Client account data: for the duration of the contract, and deleted upon termination
   Shopper conversation data: deleted upon contract termination with the relevant client
   Analytics data: in accordance with the retention settings of the analytics provider
   Legal and compliance records: as required by applicable law

9. Security
   We implement reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Our infrastructure is hosted on Google Cloud Platform, which provides industry-standard security controls. However, no system can guarantee absolute security.

10. Cookies
    The Site may use cookies for essential functionality, analytics, and performance measurement. You can manage or disable cookies through your browser settings. Where required by law, we will obtain your consent before placing non-essential cookies.

11. Third-Party Links
    The Site may contain links to third-party websites. We are not responsible for the privacy practices, security, or content of any third-party sites.

12. Your Rights
    Depending on your jurisdiction, you may have the right to:
    Access your personal data
    Request correction of inaccurate data
    Request deletion of your data
    Restrict or object to processing
    Withdraw consent at any time
    Request data portability
    To exercise any of these rights, contact us at robert@cartalyst.ai. We will respond within 30 calendar days.

13. Changes to This Policy
    We may update this Privacy Policy from time to time. Revised versions will be posted on this page with an updated effective date. Your continued use of the Site or our services constitutes acceptance of the updated Policy.

14. Contact
    For questions about this Privacy Policy or to exercise your data rights:
    Email: robert@cartalyst.ai
    Website: https://cartalyst.ai