!Draft — not yet in force

This document is a first-pass draft prepared for review by a licensed attorney. It is not legal advice and should not be relied on. Values shown as highlighted code are placeholders that must be resolved before publication, including the contracting entity, registered address, governing law, and retention periods.

36 values still to set

All of these live in src/lib/legal/config.ts and are read from the environment. Nothing needs editing in the document text.

legalEntityName — legal entity name
entityType — entity type
stateOfIncorporation — state of incorporation
registeredAddress — registered address
privacyContactEmail — privacy contact email
billingContactEmail — billing contact email
governingLawState — governing law state
arbitrationForum — arbitration forum
arbitrationVenue — arbitration venue
liabilityLookbackMonths — liability lookback (months)
liabilityFloorAmount — liability floor
securityDisclosureUrl — disclosure policy URL
securityResponseTimeframe — security response timeframe
securityOverviewUrl — security overview URL
securityIncidentNoticeHours — incident notice window (hours)
dpaBreachNoticeHours — DPA breach notice window (hours)
slaSummary — SLA summary
sccModule — SCC module
accountRetentionMonths — account retention (months)
authLogRetentionMonths — auth log retention (months)
serverLogRetentionDays — server log retention (days)
paymentRecordRetentionYears — payment record retention (years)
smsConsentRetentionYears — SMS consent retention (years)
marketingSuppressionRetentionMonths — email suppression retention (months)
terminationExportDays — post-termination export window (days)
backupRotationDays — backup rotation (days)
smsDailyMessageCap — SMS daily message cap
abuseReviewFee — abuse review fee
dataCenterRegion — data center region
awsSesRegion — AWS region
smtpProviderName — SMTP provider name
smtpProviderRegion — SMTP provider region
stripeRegions — Stripe regions
twilioRegions — Twilio regions
errorTrackingProvider — error tracking provider
errorTrackingRegion — error tracking region

Subprocessor locations still to confirm: Stripe, Twilio, Amazon Web Services (SES), Self-hosted VPS operator, Umami Analytics.

Cart Billing App updates these documents by posting a new version with a new effective date. The version above is what applies to your account.

Privacy Policy

Version 2026-09-28 · Effective 2026-09-28

This Privacy Policy explains how Cart Billing App collects, uses, discloses, and retains personal information. It applies both to the information you give us directly and to the information that flows through a Cart Billing App customer portal or hosted pay page operated for a business that uses our platform.

We operate in two distinct roles. For account and billing information about you — your name, work email, password hash, and subscription records — we are the controller and we decide why the information is used. For the personal information of a business’s own customers, collected through a portal or pay page that business operates, that business is the controller and we are its processor acting only on its documented instructions. Where that applies, the Data Processing Addendum governs and this Policy describes our processing practices in support of it.

1. Information we collect as controller

Account and identity. Business name, your name, work email address, a hashed password, role, and optional website. Platform administrators also create and record audit entries identifying platform staff who act on a tenant.
Sign-in and security data. Session records, IP address, user agent, two-factor configuration, and time and IP of successful and failed authentication. We keep this to operate sessions and investigate credential compromise.
Commercial records. Plan, subscription, invoice, payment, and refund records associated with a tenant, including the terms version and timestamp at which the administrator accepted these Terms.
Communications. Trial signup inquiries and anything you send to admin@example.com.
Technical data. Diagnostics and error records, server and request logs, and, on marketing pages only, analytics described in section 5.

2. Information we collect as processor

A business using Cart Billing App may import or enter its customers’ records. Those records commonly include the customer’s name, email address, mobile number, service address, account number, and payment status. We process that information only to deliver the Service: to generate invoices, to render the customer portal and hosted pay pages, to process and reconcile payments, to send the emails and texts that business has configured, and to operate its automated billing and reminder jobs.

We do not use a business’s customer information to build advertising profiles or to market our own services, and we do not sell it. We do not use it for our own product analytics except in aggregated and de-identified form.

3. Sources of information

From you and your representatives; from the businesses that use the platform, in the form of account, customer, service, and invoice records they import or enter; from the Payment Processor, in the form of payment status, payment method tokens, and charge outcomes — we never receive or store full card numbers; and automatically, from your browser and device.

4. How we use information

To create and administer accounts, tenants, sessions, and roles.
To operate, secure, monitor, and support the Service, including detecting fraud and abuse.
To process, reconcile, refund, and report on payments, and to respond to chargebacks and disputes.
To send service email — invoices, receipts, notices, password resets — and, where a customer has opted in, SMS.
To run the automated billing, late-fee, and reminder jobs a business has enabled.
To collect fees, manage subscriptions, and enforce these Terms.
To detect and prevent spam, abuse, and security incidents, and to comply with law, legal process, and Payment Processor rules.
To improve the Service using aggregated, de-identified Service Data, per section 4 of the Terms.

6. Service providers and subprocessors

We use the following providers. Each processes data only for us and only on our instructions, except the Payment Processor, which contracts with the business whose customer is being charged.

Provider	Purpose	Data	Location
Stripe	Card and bank payment processing, subscription billing, refunds, and chargeback handling	Name, email, billing address, payment method tokens, transaction amounts, and dispute records	`stripeRegions`
Twilio	Delivery of SMS messages to your customers on your behalf	Mobile number and message content; opt-in and opt-out records	`twilioRegions`
Amazon Web Services (SES)	Delivery of transactional and invoice email, and administrative notifications	Recipient email address, tenant name, and message content	`awsSesRegion`
Self-hosted VPS operator	Hosting of the application, MySQL database, and scheduled job runner	All Customer Data, including customer records and personal information	`dataCenterRegion`
Umami Analytics	Aggregate traffic measurement on self-hosted marketing pages only; not loaded on the dashboard, portal, or pay pages	Pseudonymous visitor identifier, page URL, referrer, and coarse device/browser data	`dataCenterRegion`
Google Analytics 4	Aggregate measurement of public marketing page traffic; disabled outside production marketing pages	Pseudonymous visitor identifier, page URL, referrer, and coarse device/browser data	Google, global

Action required before publication: several subprocessor locations above are still placeholders. Set them in src/lib/legal/config.ts along with the deployment region, then confirm the rest of the table against the real account configuration.

7. Cookies and analytics

We set one functional cookie to keep a signed-in session. It is required for the Service to function and cannot be turned off without losing access. It is not a tracking cookie, is not readable by third parties, and does not carry personal information.

On public marketing pages only, we use Google Analytics 4 to measure aggregate page traffic. It is not loaded on the dashboard, the customer portal, or any pay page. You can opt out with a browser-based advertising-differences tool, and doing so does not affect the Service. We do not use advertising cookies or cross-site tracking pixels.

8. Retention

We keep personal information only as long as needed for the purpose collected, which is ordinarily:

Account and session data — for the life of the account, plus accountRetentionMonths after closure.
Security and authentication logs — authLogRetentionMonths, unless needed longer to investigate an incident.
Tenant customer records — for as long as the tenant holds the account, and per the tenant’s own retention schedule once the tenant exports or deletes them.
Payment, refund, and chargeback records — paymentRecordRetentionYears, where required by tax and accounting law.
SMS consent records and opt-out log — smsConsentRetentionYears, to substantiate consent and honor opt-outs.
Suppressed marketing sends and email events — marketingSuppressionRetentionMonths.
Server and error logs — serverLogRetentionDays.

On termination we make your data available for export for terminationExportDays, then delete or de-identify it, except where retention is required by law or to resolve a dispute.

9. Security

We use TLS in transit, encrypted storage of sensitive fields including two-factor secrets, bcrypt password hashing, role-based authorization, tenant-scoped database queries, signed customer webhooks, and audit records for privileged administrative actions. Access to production is limited to the personnel who need it. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to know or be told what personal information we process about you, to access and correct it, to delete it, to restrict or object to processing, to receive it in a portable form, to withdraw consent, and to opt out of “sale” or “sharing” as those terms are defined by the CCPA/CPRA. We do not sell personal information and do not share it for cross-context behavioral advertising, so we do not offer a “do not sell or share” link.

To exercise a right, email admin@example.com with the subject line “Privacy request” from the address on the account. We will verify your identity before acting. We respond within the period the law requires, generally 30 days, extendable to 90 days with notice. We do not discriminate for exercising a right.

If your information belongs to a business’s customer records. Contact that business first — it is the controller and holds the relationship. We will assist it, and any request it forwards to us, within our obligations as processor.

European and UK data subjects. Where the GDPR or UK GDPR applies, you have rights of access, rectification, erasure, restriction, portability, and objection, and you may complain to your supervisory authority. Our lawful bases are contract performance for account and payment processing, legitimate interests in operating and securing the Service, consent for marketing email and for SMS to a business’s customers, and legal obligation for tax records. Contact privacyContactEmail to exercise a right or to reach our data protection contact. Cart Billing App is not certified under the EU-US Data Privacy Framework.

11. Children

The Service is a business tool and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child’s information has been submitted, email admin@example.com and we will investigate and delete it.

12. Changes and contact

We revise this Policy by posting a new version with an updated effective date and notifying account administrators. Prior versions are available on request. Material changes that affect a business’s customers are communicated to that business, which is responsible for notifying its customers.

Questions about this Policy, privacy requests, and complaints go to privacyContactEmail, or by post to registeredAddress. If you are in the EEA or UK and are unsatisfied with our response, you may complain to your local supervisory authority. See the DPA for the international transfer mechanism.