Privacy Policy
Last Updated: July 1, 2026
1. Introduction
Welcome to Cartva ("we," "our," or "us"). Cartva is operated by Hydryos Group LLC, a company registered in New Mexico, United States.
This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our e-commerce platform at cartva.co (the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner.
By using Cartva, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Account Information
When you create an account as a merchant on Cartva, we collect:
- Full name
- Email address
- Phone number
- Password (encrypted and hashed)
- Business/store name
- Business description
2.2 Store and Product Information
As a merchant, you provide:
- Store name, logo, and branding
- Product descriptions, names, and prices
- Product images and media files
- Inventory information
- Category and tag information
2.3 Payment Information
Payment processing is handled by Stripe, our payment processor. We do not store your credit card numbers or banking information. Stripe collects:
- Credit/debit card information
- Billing address
- Bank account details (for merchant payouts)
We may store: Transaction IDs, Payment status, Order totals and history.
2.4 Customer Data (Collected by Merchants)
When your customers make purchases from your store:
- Customer names and email addresses
- Shipping addresses (for physical products)
- Order history and preferences
Important: As a merchant using Cartva, you are responsible for handling your customers' data in compliance with applicable privacy laws.
2.5 Identity Verification (KYC) Data
Before activating any payment method (MonCash, NatCash, or any other provider), all merchants — regardless of subscription plan — are required to complete identity verification ("KYC") through our partner Didit. The data collected during this process may include:
- Government-issued ID (passport, driver's license, national ID)
- Selfie / facial image for liveness check
- Date of birth and nationality
- Proof of address
- Business registration documents (for business accounts)
Important: Identity documents are processed by Didit on our behalf and are not stored by Cartva. We only receive a verification status (approved / rejected) and a unique verification ID. KYC data is retained by Didit in accordance with their own privacy policy and applicable US anti-money-laundering regulations (Bank Secrecy Act, FinCEN MSB rules). Learn more →
2.6 Technical and Usage Data
We automatically collect:
- IP address
- Browser type and version
- Device information
- Operating system
- Pages visited and time spent
- Referral sources
- Cookies and similar tracking technologies
3. How We Use Your Information
3.1 Service Delivery
- • Creating and managing your account
- • Processing transactions and payments
- • Hosting your online store
- • Managing product listings and inventory
- • Facilitating order fulfillment
3.2 Communication
- • Sending order confirmations and updates
- • Providing customer support
- • Sending important service announcements
- • Responding to inquiries
3.3 Platform Improvement
- • Analyzing usage patterns
- • Improving features and functionality
- • Developing new services
- • Conducting research and analytics
3.4 Security and Fraud Prevention
- • Detecting and preventing fraud
- • Ensuring platform security
- • Monitoring for suspicious activity
- • Enforcing our Terms of Service
5. Data Security
Technical Safeguards
- • SSL/TLS encryption for data in transit
- • AES-256 encryption for data at rest
- • Bcrypt hashing for passwords
- • Regular security audits and updates
Payment Security
We are PCI-DSS compliant through Stripe. We never store credit card numbers; all payment data is tokenized.
6. Your Rights and Choices
Access & Correction
Access and review your personal information through your dashboard anytime.
Deletion
Request account deletion via [email protected]. Note some legal retention requirements.
Data Portability
Export your store data, products, and orders in CSV or JSON format.
We do not sell your personal information.
Cartva does not sell your personal information for money. We do share limited data with analytics providers (Google Analytics, PostHog) to operate and improve the Service — which may be considered "sharing" or a "sale" under some U.S. state laws. You can opt out at any time by declining analytics cookies in our consent banner or by emailing [email protected].
6.1 U.S. State Privacy Rights
If you are a resident of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, or another U.S. state with a comprehensive privacy law, you have the right to:
- Know what categories of personal information we collect and how we use it
- Access a copy of the personal information we hold about you
- Request correction of inaccurate personal information
- Request deletion of your personal information
- Opt out of the "sale" or "sharing" of your personal information and of targeted advertising
- Not be discriminated against for exercising any of these rights
To exercise any of these rights, email [email protected] with the subject line "Privacy Request." We will verify your identity and respond within the timeframe required by applicable law. You may also authorize an agent to submit a request on your behalf.
7. Cookies and Tracking Technologies
When you first visit Cartva, a cookie consent banner appears. Essential cookies (security, login, and core functionality) are always active because the Service cannot run without them. Analytics and tracking cookies (Google Analytics, Google Tag Manager, and PostHog) are loaded ONLY after you click "Accept"; if you decline, they are never set. You can change your decision at any time by clearing this site's data in your browser, or manage cookies through your browser settings.
8. Data Retention
Most personal data is deleted within 30 days of account closure. Transaction records are retained for 7 years for legal and tax requirements.
9. International Data Transfers
Your data is primarily processed in the United States. we ensure adequate protection through SCCs and vendor certifications.
10. Children's Privacy
Cartva is not intended for users under 18. We do not knowingly collect info from children.
11. Merchant Responsibilities
You are the data controller for your customers' data. You must provide your own privacy policy and obtain proper consent.
12. Custom Domains
If you use a custom domain for your store: Your domain's SSL certificate is provided by us, and third-party cookies may be set on your domain.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated 'Last Updated' date.
14. Contact Us
Questions? Email our privacy team at [email protected] with 'Privacy Request' in the subject line.