Privacy Policy

Cartly Pro - Upsell Cart · Last updated September 26, 2026

Cartly Pro - Upsell Cart (“Cartly Pro”, “we”, “us”) is a Shopify app by Boost Apps that adds a cart drawer, upsells, a free-shipping/rewards progress bar, volume discounts and free-gift offers to a merchant’s online store. This policy explains what data we handle and how.

Store data we access

When a merchant installs Cartly Pro, the app uses these Shopify permissions:

• read_products: to let you pick products and collections for offers and to show product recommendations.
• write_discounts: to create the automatic discounts that apply your offers (volume discounts, free gifts, free shipping, order discounts) at checkout.
• read_orders: to find orders that contain items added through Cartly Pro, so we can show you offer analytics and calculate usage-based billing. We read order totals, line-item prices, line-item properties and discount names only; we do not request customer names, emails, addresses or payment details.
• read_themes: to check whether the Cartly Pro app embed is turned on in your theme.
• Optional, only if you turn on storefront translations: read_locales, read_translations and metaobject permissions, to list your store languages and create translatable entries for your cart texts in Shopify Translate & Adapt.

Information we store

App configuration (drawer appearance, offers and settings), storefront translation entries, the app’s Shopify session, and a copy of basic store details (store name, email, phone, billing address, currency and plan) are stored in your own store as Shopify metafields and metaobjects.

Our servers run on Cloudflare. Cloudflare Workers KV holds the store’s Shopify access token and session so the app can work in the background (for example to process order webhooks), plus a short-lived cache (up to 12 hours) of the store details above.

Our internal admin service (Boost Apps admin, backed by a Supabase database) keeps a record for each store that installs the app: store domain, store name, store email, shop owner name, primary domain, country, currency, Shopify plan, app plan and billing tier, install/uninstall dates and, while the app is installed, the Shopify access token. We use this record to support you, manage billing and send emails.

We do not access, collect or store your customers’ personal information (names, emails, addresses or payment details).

Emails

We send a welcome email when you install the app and a goodbye email when you uninstall it, and occasional product update or promotional emails to the store email. Emails are delivered through Resend. Every promotional email contains an unsubscribe link.

Storefront behaviour

The cart drawer runs in the shopper’s browser and uses Shopify’s standard cart, product and recommendation APIs to read and update the cart. Items added through Cartly Pro carry hidden cart line properties so offers and analytics can recognise them. The drawer does not transmit shopper data to us or to any third party.

Service providers

We do not sell or rent your data, and we do not send any shopper data to third parties. We use these service providers to run the app:

• Cloudflare: app hosting and storage of access tokens/sessions (Workers KV).
• Supabase: database for the store records described above.
• Resend: delivery of the emails described above.
• Tidio: live chat loaded only inside the app’s admin (never on your storefront) so you can reach our support team. So we can help without asking for details first, the chat receives your store’s name, myshopify address, website, contact email, Shopify plan and country, the name, email and role of the staff member using the app, and which app page they are on. It never receives any data about your customers. Messages you send and basic technical data (such as your IP address) are processed by Tidio under their privacy policy.
• ExchangeRate-API: our server downloads public currency exchange rates to convert revenue to USD for billing tiers; no store data is sent.

Data retention and deletion

When you uninstall the app, Shopify revokes its access token and we delete the token from Cloudflare and from our store record. The app’s own metafields in your store are removed by Shopify; storefront translation entries (metaobjects of type boostapps_cartly_pro_text, only created if you used storefront translations) stay in your store so your translations are kept, and you can delete them under Content › Metaobjects in your Shopify admin. The store record in our admin service (without access credentials) is deleted automatically when Shopify sends the shop/redact request, 48 hours after uninstall; email boostappspro@gmail.com to have it deleted sooner. We honour Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact); because we do not store customer personal data, there is no customer data for us to return or erase.

Contact

Questions about this policy or your data? Email boostappspro@gmail.com.