Effective 2026-09-11. Working draft pending legal review.
This policy explains what [Cart Kingpins legal entity name] ("we") collects when you use Cart Kingpins (https://cartkingpins.com), why, and who we share it with.
What we collect
- Account: your email address, name if you provide it, and sign-in records (magic-link tokens, Google account ID if you sign in with Google).
- Orders: what you bought, when, the amount, the delivery email, the status, and the redeemable links we issued to you.
- Payments: we use Stripe to process cards. We receive a payment reference, the last four digits, card brand and country, and Stripe's risk assessment. We never receive your full card number.
- Fraud and security signals: IP address, device and browser details, approximate location, and attempt logs for code redemptions, used to detect fraud and abuse.
- Support: anything you send us.
Why we use it
- To deliver what you bought and show it on your Orders page.
- To take payment and prevent fraud, including manual review of some orders.
- To send transactional email: sign-in links, receipts, gift card delivery, order status. We do not send marketing email without your consent.
- To comply with legal obligations, including record-keeping and responding to lawful requests.
- To run and improve the service (aggregate, non-identifying analytics).
Our legal bases, where they apply, are performance of our contract with you, our legitimate interest in preventing fraud and securing the service, and legal obligation.
Who we share it with
- Gift card network / Brands: the product, amount and an order reference so the card can be issued. The network does not receive your name or card details from us.
- Stripe (payments and fraud screening), Resend (email delivery), Vercel (hosting), Prisma (database hosting).
- Authorities, card networks and Brands where required by law or to investigate fraud.
We do not sell personal information.
Retention
Order and payment records are kept for at least 7 years for tax, accounting and fraud-prevention purposes. Sign-in tokens expire within 24 hours. Fraud-attempt logs are kept for 30 days unless linked to an investigation. You can ask us to delete your account; we will remove what we are not required to keep.
Your choices and rights
You can view your orders and sign out from your account page. Depending on where you live you may have the right to access, correct, delete, or port your data, or to object to some processing. Email [support@yourdomain.com] and we will respond within 30 days. California residents: we do not sell or "share" personal information as defined by the CCPA.
Cookies
We use strictly necessary cookies for sign-in sessions and your cart. We do not use advertising cookies.
Children
The service is for adults. We do not knowingly collect data from anyone under 18.
Changes and contact
We will update the effective date when this policy changes. Questions: [support@yourdomain.com] · [Cart Kingpins legal entity name], [Mailing address].