Draft · 14 October 2026
Privacy
This is a plain-language draft, not a finished legal policy. Have it reviewed, and add your legal entity, before you rely on it.
Cartable audits a public store URL and, if you ask, keeps an email so we can follow up. There is no account.
What the audit requests
When you submit a URL, the server fetches public pages: the homepage, robots.txt, llms.txt, the sitemap, the Shopify catalog feed, one product, shipping and return policy URLs, and — when a variant id is available — one POST /cart/add.js with quantity 1. That call puts a unit in a session cart. It does not open checkout, pay, create a customer, or edit the theme. Requests are spaced by a short pause so the audit stays polite.
If you submit the email form, we keep the address, the store name you were auditing (or which plan you asked about), and the time. On the hosted site that record is a line in the function logs, prefixed CARTABLE_LEAD. On a machine running the local server it is also appended to data/leads.jsonl. There is no separate database in this version. We use the address to follow up about the Fix Pack or checkout. We do not sell it. Nothing is emailed automatically.
To ask for a lead to be deleted, email hello@getcartable.com from the same address. Say which store it was about. Log lines cannot always be erased from a host’s retained logs; we will stop using the address and delete the local copy where we have one.
Rate limit and cache
Six audits are allowed per 10 minutes per IP. The counter is kept in memory on the function instance and is not a global account. The IP comes from the request (the forwarding header or the socket). It is not written into the lead record. The host’s ordinary request logs still include IP addresses.
A successful audit response may be cached at the edge for about an hour, so repeating the same URL can return the earlier JSON.
Cookies and fonts
This site does not set analytics cookies and does not load a third-party analytics script. Fonts are files on this site, not a Google Fonts request.
Who else is involved
We request the store whose URL you submit. The site is hosted on Vercel. Payment, when checkout is open, will be a Stripe Payment Link, and Stripe will handle the card data. That is not wired up in this version.