1. Introduction

CartixAI ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at cartixai.com and related services.

By using CartixAI, you consent to the practices described in this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, phone number, business name, and password when you register.
Business Data: Product listings, inventory, order information, customer data you upload or create within the platform.
Payment Information: Billing details processed through our secure payment provider, SafePay. We do not store card numbers.
Communications: Messages you send to our support team via contact forms or email.

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, session duration, and interaction patterns.
Technical Data: IP address, browser type, operating system, device identifiers.
WhatsApp Conversation Data: Messages processed through your connected WhatsApp Business Account to provide AI responses and analytics.
Cookies: Session cookies and persistent cookies as described in our Cookie Policy.

3. How We Use Your Information

To provide, operate, and improve CartixAI services
To process WhatsApp messages through your AI configuration
To process payments and manage subscriptions
To send transactional emails (order confirmations, alerts)
To provide customer support
To analyze usage and improve platform performance
To comply with legal obligations
To detect and prevent fraud and security threats

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. WhatsApp Data Processing

CartixAI connects to WhatsApp Business API on behalf of businesses. When your business connects its WhatsApp account:

Messages are processed in real-time to generate AI responses
Conversation history is stored for analytics and AI improvement
Customer phone numbers are stored for contact management
Business information is used to train your AI assistant

Your customers' data is processed as a data processor on your behalf. You, as the business, are the data controller responsible for obtaining appropriate consents from your customers.

We integrate with the WhatsApp Business API (provided by Meta Platforms, Inc.) to enable merchants to send and receive WhatsApp messages. Through this integration we collect: WhatsApp Business Account (WABA) IDs, phone number IDs, business display names, and message content. This data is used solely to operate the messaging service on behalf of merchants and is never used for advertising or sold to third parties. WhatsApp message data is retained for 90 days after account termination. The Embedded Signup process used to connect a WhatsApp Business Account temporarily processes OAuth tokens which are stored securely and used only to maintain the API connection.

5. Data Sharing

We may share data with:

Service Providers: Cloud hosting (storage, compute), payment processors (SafePay), email services — bound by confidentiality agreements.
WhatsApp/Meta: As required to operate the WhatsApp Business API.
Legal Authorities: When required by applicable law, court order, or government request.
Business Transfers: In the event of a merger or acquisition, subject to equivalent privacy protections.

6. Data Security

We implement industry-standard security measures:

All data transmitted between your browser and our servers uses TLS/SSL encryption
Data at rest is encrypted using AES-256
Passwords are hashed using modern cryptographic algorithms (never stored in plain text)
Access to data systems is restricted by role-based permissions
Regular security audits and vulnerability assessments

7. Data Retention

We retain your data for as long as your account is active. Upon account termination:

Your data is retained for 30 days to allow for export
After 30 days, data is permanently and securely deleted
Some data may be retained longer where required by law

8. Your Rights

You have the right to:

Access: Request a copy of personal data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your data
Portability: Export your business data in standard formats
Objection: Object to certain processing activities
Withdraw Consent: Withdraw consent for optional data processing

To exercise these rights, contact us at [email protected].

9. Pakistan Privacy Notice

For users in Pakistan, this policy is provided in compliance with the Prevention of Electronic Crimes Act (PECA) 2016 and applicable data protection requirements. Data collected is stored on servers compliant with applicable Pakistani law.

10. GDPR Notice (EU Users)

For users in the European Union, CartixAI acts as a data processor when handling your customers' data. We provide a Data Processing Agreement (DPA) upon request. Legal bases for processing include: contract performance, legitimate interest, and consent.

11. Cookies

We use cookies as described in our Cookie Policy.

12. Children's Privacy

CartixAI is not directed at children under 18. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes via email. Continued use of CartixAI after changes constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related inquiries:

Email: [email protected]
Contact form: cartixai.com/contact