سياسة الخصوصيةPrivacy Policy

This is an English translation. If it differs from the Arabic text, the Arabic text prevails.

This policy explains the data CartSync collects and how we use, share and protect it, in line with the Personal Data Protection Law of the Kingdom of Saudi Arabia. It applies to our website cartsync.online, the merchants' stores on it, and the merchant portal.

CartSync is operated by شركة تمكين التقنية الذكية للاتصالات وتقنية المعلومات, unified number 7008771748, Kingdom of Saudi Arabia. Every store on the platform belongs to an independent merchant; the platform provides the store, payments and shipping.

1. The data we collect

We do not store card details; they are processed by a payment provider licensed by the Saudi Central Bank. We do not ask customers for their national ID; we collect only what an order and its delivery need.

2. Who we share data with

• The merchant: sees the customer data needed for orders from their own store only, and never the customer's orders from other stores.
• The payment provider: payment data, the merchant's documents to open their account, and the transaction and merchant data it asks for due diligence and anti-money-laundering checks.
• The shipping provider and carriers: the customer's name, mobile number, address and the shipment's contents, including carriers outside the Kingdom for international shipping.
• Messaging providers: the mobile number and the notification text, by WhatsApp or SMS.
• WhatsApp (Meta): the customer's mobile number and the verification code message they send, and order notifications.
• Advertising platforms: when a merchant turns on a Snapchat, TikTok, Meta or Google pixel in their store, browsing and purchase data from that store is sent to those platforms to measure the merchant's campaigns.
• AI and image processing providers: product photos and descriptions, to suggest product names and descriptions and to enhance images (Azure OpenAI within the platform's cloud environment, and Photoroom, outside the Kingdom, to remove backgrounds). Merchants' documents and IDs are read only within the platform's private cloud environment and are never sent to Photoroom.
• Authorities: when required by law, including the Saudi Central Bank and anti-money-laundering authorities.

The merchant's role

A customer has one account for all CartSync stores, run by the platform. Each merchant receives only the customer data for orders from their own store, to fulfil them and serve the customer, and may not use it for anything else without the customer's consent.

Marketing messages

These are sent only with separate, optional consent, which can be withdrawn at any time. Verification and order status messages are not marketing.

3. What your browser stores

We do not show a cookie consent banner; instead we list here what is stored:

• Your cart and the last store you visited, so you can return to it from your orders and complaints pages.
• The merchant's campaign code if you came through a campaign link, for 7 days, to credit your order to that campaign.
• A random anonymous identifier that carries none of your data, sent with Snapchat pixel events to improve the measurement of the merchant's ads.
• The cookies of the advertising pixels the merchant turned on, and whatever those platforms store under their own policies.
• The site language you chose.

You can clear these from your browser settings at any time.

4. Transfers outside the Kingdom

Data may be transferred outside the Kingdom in the following cases, only as needed and under the applicable safeguards:

• All platform data, for now: the servers and database are with Microsoft Azure and MongoDB Atlas in the United States (East US), and will move to the Azure region in the Kingdom once it opens.
• Product photos and descriptions, to AI and image processing providers (they contain no personal data).
• Browsing and purchase data, to advertising platforms when a merchant turns on a pixel.
• Shipment data, to carriers for international shipping.
• Messages through WhatsApp.

5. Storage and protection

• Data is stored with Microsoft Azure and MongoDB Atlas (currently in East US, later in the Kingdom's region), encrypted and with limited access.
• Merchants' documents are kept in private storage that opens only through temporary links, and only authorised members of the review team can reach them.
• Order and return records are kept for at least 12 months, and merchants' documents for the whole relationship and for the period the law requires after it.

If an incident affects personal data, we notify the competent authority and those affected within the legal period, and take steps to address it. While we are committed to protection, no system on the internet is completely secure.

6. Your rights

You may ask to access, correct or delete your data (unless the law requires us to keep it), to receive a copy of it, and to withdraw your consent to marketing messages at any time, and you can object to advertising tracking from your browser settings. Send your request to info@cartsync.online.

The platform is not intended for anyone under 18.

7. Contact and changes

شركة تمكين التقنية الذكية للاتصالات وتقنية المعلومات, Riyadh, Kingdom of Saudi Arabia, info@cartsync.online.

Any changes are published on this page with their effective date.