1. Controller
For merchant data, the controller is the company that controls GetCart. For end-shoppers of stores, the controller is the merchant who operates the store where GetCart is installed; GetCart is the processor, per art. 5, VI and VII, of the LGPD.
The merchant decides whether to use GetCart, configures limits and answers end-shoppers. GetCart processes personal data following the merchant's instructions and the DPA signed between the parties.
2. Data we collect
From website visitors: IP address, user agent, pages visited, cookie accept or decline event (Microsoft Clarity, local storage).
From merchants: name, email, billing and payment data (processed by the Shopify, Nuvemshop, Tray gateway or by GetCart's own gateway), panel usage logs.
From end-shoppers, only what the store sends via the provider app: name, phone, cart items, amount, last visit date and history of messages exchanged with the store.
3. What we use it for
Running the AI agent, generating the unique coupon, building the cart URL, charging the 2.5% fee, providing support, and complying with legal and tax obligations.
For product improvement, we use aggregated and anonymized data. For model training, we only use conversation samples when the merchant explicitly authorizes it.
4. Sharing
We share data only with whoever is necessary for the service: Meta (WhatsApp messages), the store provider (coupons and orders), the payment gateway (billing) and the hosting infrastructure (AWS or equivalent). All of these partners have a contract and data-protection obligations.
We do not sell personal data. In case of a court order or competent authority request, we share the minimum necessary and notify the merchant whenever possible.
5. Data subject rights
Data subjects can exercise the rights of LGPD art. 18 — confirmation, access, correction, anonymization, portability, deletion, information about sharing, consent withdrawal and opposition — by emailing [email protected], or directly with the merchant when the subject is a shopper.
We reply within 15 days.
6. Retention
Conversation data: 24 months. Billing logs: 5 years (tax obligation). Site visitor data: 13 months (Microsoft Clarity). Afterwards, we delete or anonymize.
7. Data Protection Officer (DPO)
GetCart's DPO can be reached at [email protected].
8. Changes to this Policy
Material changes are notified by email and in the panel. The current version stays on this page with the last-updated date.