Summary version — replace with the official text from the CMS before publishing.
Effective date: 12 June 2026
Last updated: 1 July 2026
This policy explains what personal information CartPilot (“we”, “us”) collects, how we use and share it, and how we protect it — when you visit our website, create an account, buy a plan, or use the CartPilot AI sales agent on a WooCommerce or Shopify store.
CartPilot is a StorePulse product operated by weDevs Pte. Ltd., a Singapore company. This policy is part of our Terms of Service; if you don’t accept it, please don’t use CartPilot.
We play two roles. For merchants’ own account, billing and usage data we are the controller. For shopper data the AI agent handles on a merchant’s store, we are a processor (a “data intermediary” under Singapore law) acting on that merchant’s instructions — the merchant is the controller and owns its shopper-facing privacy notice.
1. Information We Collect
a. Information you provide. Account, company, billing, purchase and licence details, plus anything you send to support or when subscribing to updates.
b. Information collected automatically. Device and usage data (IP address, browser, device IDs, time zone, referrers, pages viewed) via cookies, logs and analytics — see Section 4.
c. Service data (conversations, voice, catalog, training). Chat transcripts and logs, voice input converted to text (audio isn’t kept), catalog data from connected stores and merchants’ training items. It runs on our hosted backend and is sent to model providers to generate replies (Section 3). Please keep sensitive personal data out of training items.
d. Payment information. Handled by Stripe, Inc., our payment provider and merchant of record, under its own privacy statement. We never store full card numbers.
2. How We Use Information
To run, secure and support the Service, generate AI responses, process purchases and licences, send account and transactional messages, share product news and marketing (opt out any time), and meet legal and accounting duties.
Under the GDPR or UK GDPR our legal bases are contract, legitimate interests (operating, securing and improving the Service, including cart and product-discovery analytics), consent (marketing email and non-essential cookies, withdrawable any time) and legal obligation.
3. AI Model Providers and Your Data
We don’t train our own models on your data, conversations or catalog.
Each request sends only the data it needs to our model providers — currently Google Gemini, and OpenAI where enabled — under their own terms: Google Gemini API terms and OpenAI enterprise privacy.
On a Lifetime BYOK plan you use your own key, and your contract with that provider applies.
4. Cookies and Analytics
We use cookies for core site functions, preferences and performance measurement. Where required, we ask consent for non-essential cookies; you can also manage them in your browser.
5. How We Share Information
Only as needed: with Stripe (payments), our AI model providers, processors for hosting, analytics, error monitoring, email and support, and authorities where the law or safety requires — or as part of a merger, acquisition or asset sale.
We don’t sell personal information or “share” it for cross-context behavioral advertising under the CCPA/CPRA.
A Data Processing Agreement is available to merchants on request.
6. International Data Transfers
We’re based in Singapore, so data may be processed there, in the United States and wherever our providers operate, where protection levels can differ from your country’s.
For EEA and UK data we use safeguards such as the EU Standard Contractual Clauses and the UK transfer addendum, backed by a transfer risk assessment. Contact us for a copy.
7. Data Retention
We keep data only as long as the Service and our legal, accounting, security and dispute needs require. When a merchant closes their account, account data, transcripts, voice-derived text, catalog data and training items are deleted or de-identified within 90 days unless the law requires longer. You can request deletion at any time.
8. Your Rights
Your rights depend on where you live, and we aim to honour them everywhere we reasonably can:
- EU / UK (GDPR, UK GDPR): access, correction, erasure, restriction, portability, objection, safeguards against solely automated decisions, withdrawing consent and complaining to a regulator (in the UK, the ICO).
- California (CCPA/CPRA): to know, access, delete and correct; to opt out of sale or sharing (we do neither); to limit sensitive data use; and to equal treatment.
- Singapore (PDPA): access, correction and withdrawing consent.
Email support@storepulse.co to make a request. We’ll verify it and respond within legal timeframes; requests about shopper data go to the relevant merchant as controller.
9. Automated Processing
The AI searches catalogs, answers questions and suggests products before checkout. It makes no solely automated decisions with legal or similarly significant effects. Output can be imperfect, and merchants remain responsible for their storefront content.
10. Children
CartPilot is a business tool not intended for anyone under 18, and we don’t knowingly collect children’s data. Merchants handle age and consent rules for their own shoppers.
11. Security
We use reasonable technical and organizational measures to protect personal information, though no system can be guaranteed completely secure.
12. Communications and Support
Expect account, transactional, product, marketing (unsubscribe any time) and support messages. Any support access to your site or logs is permission-based, limited to the issue, removed once it’s resolved and not kept longer than needed.
13. Changes to This Policy
We may update this policy and will refresh the “Last updated” date here, notifying you of material changes by email or in the dashboard where required.
14. Contact Us
For any privacy question or request, contact us at support@storepulse.co.
weDevs Pte. Ltd., 160 Robinson Road, #14-04 SBF Centre, Singapore 068914
CartPilot is a StorePulse product, operated by weDevs Pte. Ltd.