ShareCart – Privacy Policy

ShareCart
Last updated: September 7, 2026

This Privacy Policy describes how Wlek (“we”, “us”, or “ShareCart”) collects, uses, stores, and deletes information when a merchant installs the ShareCart Shopify app and when shoppers use a shared cart on that merchant’s store.

ShareCart is a Shopify app that lets shoppers share a cart and lets store staff send a checkout-ready link. Payment and checkout are handled by Shopify, not by ShareCart.

This Privacy Policy is provided for informational purposes and is not legal advice. We recommend having qualified legal counsel review it before publication.

1. Who This Applies To

This Privacy Policy applies to:

  • Merchants who install ShareCart on a Shopify store.
  • Merchant staff who use the embedded ShareCart admin.
  • Shoppers who share a cart, open a shared-cart link, or are named on a support cart.

For shopper data, we act as a processor on behalf of the installing merchant, who generally acts as the controller. For merchant account and billing data needed to operate the app, we act as a controller.

If you are a shopper and want to request access to or deletion of your information, please contact the store you shopped with first. We also honor Shopify’s mandatory compliance webhooks.

2. Information We Collect

Shop and Staff Information

We may collect:

  • Shopify shop domain
  • Shop name
  • Shopify shop ID
  • Store currency
  • Staff name
  • Staff email address
  • Shopify user ID
  • Staff role required to operate the embedded admin
  • OAuth access tokens, which are stored securely/encrypted or through Shopify session storage as applicable

Cart Information

We may collect:

  • Product and variant IDs
  • Product titles
  • Quantities
  • Price snapshots
  • Discount codes
  • Optional customer or internal notes
  • Share token
  • Share URL
  • Cart expiration
  • Cart status

Customer Information

Customer information is collected only when provided through the merchant’s use of ShareCart and may include:

  • Name
  • Email address
  • Shopify customer ID

We do not collect phone numbers, shipping addresses, billing addresses, or payment card information. We do not request Shopify protected customer fields that are not necessary for ShareCart’s functionality.

Usage and Analytics Information

We may collect events related to ShareCart functionality, including:

  • Cart created
  • Cart shared
  • Cart opened
  • Checkout started
  • Purchase completed
  • Cart expired
  • Order ID
  • Order name
  • Order totals when a Shopify order can be matched to a ShareCart share token

Billing Information

We may process Shopify App Subscription information, including:

  • Subscription status
  • Plan name, such as Free, ShareCart Starter, ShareCart Growth, or ShareCart Pro

Payment processing for app subscriptions is handled through Shopify’s billing systems. ShareCart does not directly collect or store payment card information.

Technical Logs

We may maintain technical logs containing information such as:

  • Shop
  • Operation
  • Timestamp
  • Error type

Secrets, authentication credentials, and payment-related fields are redacted from logs where applicable.

We do not use technical logs for advertising.

3. How We Use Information

We use information only as necessary to:

  • Create and display shared carts.
  • Generate, send, or allow merchants and shoppers to copy share links, including email, WhatsApp, or QR links where enabled.
  • Hand off checkout to Shopify cart permalinks.
  • Provide merchants with cart and conversion analytics.
  • Enforce subscription plan limits.
  • Authenticate the app and keep merchant stores isolated.
  • Operate, maintain, troubleshoot, and secure ShareCart.
  • Respond to Shopify GDPR and compliance webhooks.
  • Respond to valid legal requests and comply with applicable law.

We do not sell personal data.

We do not use shopper data for advertising or behavioral profiling, and we do not make automated decisions that produce legal or similarly significant effects on individuals.

4. Legal Bases for Processing — EEA / UK

Where the GDPR or UK GDPR applies, we may rely on the following legal bases:

Contract — to provide the ShareCart services requested by the merchant.

Legitimate interests — for security, abuse prevention, fraud prevention, troubleshooting, service maintenance, and product operations, where those interests are not overridden by applicable individual rights.

Legal obligation — to comply with applicable laws, regulations, court orders, and Shopify compliance requirements.

Merchant instructions — where we process shopper information on behalf of the merchant to provide features requested by the merchant.

5. Service Providers and Data Sharing

We may use reputable third-party service providers to operate, maintain, secure, and improve ShareCart. These providers may process information on our behalf and only to the extent necessary to provide their services.

These providers may include:

  • Cloud hosting and infrastructure providers
  • Database and storage providers
  • Security and fraud-prevention providers
  • Application monitoring and error-reporting providers
  • Shopify and Shopify-related services required to operate the app

We require our service providers to maintain appropriate safeguards for information they process on our behalf.

We do not sell personal information or share personal information with advertisers.

We may disclose information when reasonably necessary to:

  • Comply with applicable laws, regulations, legal processes, or governmental requests.
  • Protect the security, rights, property, or users of ShareCart.
  • Detect, prevent, or investigate fraud, abuse, or security incidents.
  • Provide services necessary to operate ShareCart.
  • Facilitate a merger, acquisition, financing, restructuring, or sale of all or part of our business, subject to applicable legal requirements and appropriate safeguards.

Where required by applicable law, we will provide additional information about our subprocessors or service providers.

6. Cookies and Similar Technologies

The merchant administration interface uses Shopify session mechanisms and Shopify App Bridge authentication as applicable.

Shared-cart pages may be rendered on the merchant’s domain through Shopify’s app proxy.

We do not use third-party advertising cookies.

7. Retention and Deletion

Cart expiration is controlled by merchant settings and may be configured for:

  • 24 hours
  • 7 days
  • 30 days
  • Never, where the merchant enables this option

Expired or revoked carts that are not associated with an order are purged after 90 days.

When a merchant uninstalls ShareCart:

  • We mark the shop as inactive.
  • We delete access tokens.
  • We process Shopify’s required shop/redact compliance request.
  • Remaining shop data is deleted in accordance with Shopify’s requirements and applicable law.

Shopify customers/redact requests are used to clear applicable customer information, including names, email addresses, customer IDs, and notes associated with matching carts.

Shopify customers/data_request requests are processed so that applicable access requests can be fulfilled.

Certain information may be retained where required by law, for legitimate security purposes, or to establish, exercise, or defend legal claims.

8. Security

We use reasonable technical and organizational measures designed to protect information, including:

  • HTTPS encryption in transit.
  • Database encryption at rest through our hosting infrastructure where supported.
  • Encryption and secure handling of access tokens.
  • Shop-scoped database queries to prevent one merchant from accessing another merchant’s carts.
  • Role-based limitations for merchant staff.
  • Separation of production and test environments.
  • Redaction of secrets and sensitive payment information from technical logs.

If we discover unauthorized access to personal data, we will take reasonable steps to contain and investigate the incident, preserve relevant logs and evidence, and notify affected merchants, Shopify, regulators, or individuals where required by applicable law.

9. International Data Transfers

ShareCart uses reputable, industry-standard cloud infrastructure and security services designed to provide reliable availability, data protection, encryption, access controls, monitoring, and secure application operations.

Shopify and our service providers may process information in countries other than the country where the merchant or shopper is located.

Where the EEA or UK GDPR applies, we rely on appropriate safeguards for international transfers, such as Standard Contractual Clauses or other legally recognized transfer mechanisms where applicable.

10. Your Rights

Depending on where you live and the laws applicable to you, you may have rights to request:

  • Access to your personal information.
  • Correction of inaccurate information.
  • Deletion of personal information.
  • Restriction of processing.
  • Objection to certain processing.
  • Portability of certain information.

Shoppers

If you are a shopper, please contact the merchant whose store you interacted with first.

We also process Shopify customers/data_request and customers/redact compliance requests as required.

Merchants

Merchants may uninstall ShareCart through Shopify Admin or contact us directly at:

support@wlekofficial.com

After receiving the applicable Shopify shop/redact request, remaining shop data will be deleted in accordance with Shopify’s requirements and applicable law.

We do not sell personal information, including as “sale” or “share” may be defined under applicable CCPA/CPRA requirements.

If our data practices materially change in a way that requires an opt-out mechanism, we will provide the applicable notice and opt-out mechanism.

11. Children

ShareCart is not directed to children under 13, or under 16 where a higher minimum age applies by law.

We do not knowingly collect personal information directly from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make changes, we will update the “Last updated” date at the top of this page.

Material changes will be reflected on this page and, where required, through the Shopify App Store or other appropriate notification channels.

13. Contact Us

Email: support@wlekofficial.com