Cartcha Privacy Policy

Last updated: 8 September 2026
Effective: 8 September 2026

This policy explains what the Cartcha Shopify app collects, why, who it is shared with, how long it is kept, and the rights you have over it. It also sets out the terms on which Cartcha is provided, including the limits of our liability — see Disclaimer and limitation of liability.

1. Who we are

Cartcha (“the app”, “Cartcha”) is provided by Whoooop Ltd, a company registered in England and Wales, company number 8877885, VAT number GB182051824, registered office W8A Knoll Business Centre, 325-327 Old Shoreham Road, Hove, BN3 7GS, England (“we”, “us”, “our”).

For questions about this policy, or to exercise any of the rights in section 9, use the contact form on whoooop.co.uk and choose Cartcha as the project type. Please include your store’s .myshopify.com domain.

2. What Cartcha does

Cartcha lets a Shopify merchant mark specific products as protected. A shopper must complete a captcha challenge on the product page before that product can be added to the cart. A completed challenge is exchanged, server-side, for a signed short-lived grant attached to the cart line. The grant is checked again at checkout and audited once more when the order is created.

Cartcha exists to keep automated bots from buying limited stock. It is a bot-mitigation tool, not a customer-analytics tool, and it is built to do its job while holding as little personal data as possible.

3. Our role under data protection law

There are two relationships here, and the law treats them differently:

• Merchant account data — we are the controller. Information about the merchant, their store and their use of the app (section 4.1) is data we decide the purposes and means for, so we are the data controller for it.
• Store and order data — we are a processor. Anything Cartcha touches that belongs to the merchant’s store, principally Shopify order identifiers (section 4.3), is processed only on the merchant’s instructions, in order to provide the app. The merchant is the controller. Our processing of that data on the merchant’s behalf is governed by this policy together with the Shopify App Store terms the merchant accepted on install.

Shoppers: Cartcha stores no shopper identity. See section 4.4.

4. What we collect and store

4.1 Merchant and store information

Received from Shopify when the app is installed and while it runs:

• Store’s .myshopify.com domain, Shopify shop ID, and the store’s configured domains
• Install date, last-seen date, and uninstall date
• The API access scopes granted to the app
• A Shopify session record, including the access token that authorises the app’s API calls
• The ID and name of the store’s published theme, and whether the Cartcha theme block is present

Legal basis: performance of our contract with the merchant.

4.2 Merchant configuration and billing

• The list of product IDs the merchant has marked as protected
• App settings: protection on/off, failure policy, grant lifetime
• Subscription status, plan, billing period dates and trial end date, as reported by Shopify. Cartcha never sees or stores card or bank details — all payment is handled by Shopify
• Cloudflare Turnstile credentials for the store. The public sitekey is stored as-is; the secret key is encrypted at rest. Where a merchant connects their own Cloudflare account, the resulting OAuth tokens are likewise encrypted at rest

Legal basis: performance of our contract with the merchant.

4.3 Challenge grants and order audit records

For each completed challenge, Cartcha stores a grant record containing:

• The store domain, an internal grant ID, and the product ID and quantity it covers
• Issue time, expiry time, current status (issued or consumed), and the ID of the signing key used
• A SHA-256 hash of the captcha token — a one-way fingerprint used to detect reuse. The token itself is not stored

For each new order on a store with protection enabled, Cartcha stores an audit record containing the Shopify order ID, the outcome (clean, flagged, cancelled or unauditable), the reason, and a per-line breakdown of which lines passed.

These records contain no shopper name, email address, postal address, phone number, payment details or IP address. The order ID is an identifier for an order in the merchant’s own store.

Legal basis: performance of our contract with the merchant, and our and the merchant’s legitimate interest in preventing automated abuse and fraud against limited stock.

4.4 Shoppers

Cartcha does not create an account for, profile, or track shoppers, and stores nothing that identifies them.

One thing does leave the shopper’s browser: when a shopper completes the challenge, the shopper’s IP address is passed to Cloudflare along with the challenge token, because Cloudflare uses it as part of verifying that the challenge was genuinely completed by that visitor. We do not store the IP address — it is read from the request, forwarded to Cloudflare for that single check, and discarded. Cloudflare’s own handling of it is covered by Cloudflare’s Turnstile privacy documentation.

The challenge widget itself is served by Cloudflare and may set a short-lived cookie on the storefront so that a recently completed challenge is remembered. Cloudflare states that Turnstile does not use personal data for advertising or cross-site tracking.

Legal basis: our and the merchant’s legitimate interest in preventing automated abuse.

4.5 Compliance records

When Shopify sends one of the three mandatory privacy webhooks, we record the store domain, the webhook topic, Shopify’s webhook ID and the time we received it — and nothing from the body of the request. This is our audit trail that the request was handled.

Legal basis: compliance with a legal obligation.

4.6 Operational logs

Our servers produce operational logs (timestamps, request outcomes, error messages, store domain) used to keep the service running and to diagnose faults. Logs are not used to profile shoppers.

Legal basis: legitimate interest in operating and securing the service.

5. What we do not do

• We do not sell, rent or trade any data
• We do not use any data for advertising, ad targeting, or cross-site tracking
• We do not build shopper profiles or share data between stores
• We do not store shopper names, email addresses, postal addresses, phone numbers, payment details or IP addresses
• We do not use your data to train machine-learning or AI models

6. Who we share data with

We use the following service providers (“sub-processors”). Each is bound by its own contractual and legal data protection obligations.

Beyond these, we disclose data only where we are required to by law, a court, or a regulator, or where it is necessary to establish, exercise or defend legal claims.

7. Where data is stored and international transfers

All data Cartcha stores itself is held in AWS’s eu-west-1 (Ireland) region. Cloudflare and Shopify operate global infrastructure, and data may be processed outside the UK and EEA as part of their services. Where that happens, transfers are made under an appropriate safeguard — the UK International Data Transfer Addendum, the UK Extension to the EU-US Data Privacy Framework, or the EU Standard Contractual Clauses, as applicable to that provider.

8. How long we keep data

When a merchant uninstalls Cartcha, Shopify sends us a shop/redact request — normally within 48 hours of uninstall. On receiving it we erase that store’s stored data, including its settings, credentials, protected product list, grants and order audit records. The uninstall itself also immediately revokes the app’s access to the store.

Because Cartcha holds no shopper personal data, a customers/redact or customers/data_request webhook has no customer record to erase or return. We acknowledge it and record the receipt.

9. Your rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to: be informed about how your data is used; request a copy of it; have inaccurate data corrected; request erasure; restrict or object to processing; and request portability of data you provided to us.

To exercise any of these, use the contact form and choose Cartcha as the project type. We will respond within one month. We may need to verify that you control the store in question before we act.

Shoppers: we hold no data identifying you, so we cannot locate a record about you. Requests about an order should go to the merchant whose store you bought from — they are the controller of that data.

If you are unhappy with how we have handled your data, you may complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You may also complain to the supervisory authority in your own country.

10. Security

• Turnstile secret keys and Cloudflare OAuth tokens are encrypted at rest using managed keys; the public sitekey is not secret and is exposed to the storefront by design
• Grants are cryptographically signed with a per-store signing key, so a grant cannot be forged or transplanted between stores
• Captcha tokens are stored only as a one-way SHA-256 hash
• All traffic is over HTTPS. Admin access requires an authenticated Shopify session; webhook and app-proxy requests are signature-verified before processing
• Data is segregated by store; a request authenticated for one store cannot read another’s data

No system is perfectly secure. We take reasonable and proportionate technical and organisational measures, but we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to individuals’ rights, we will notify the ICO within 72 hours of becoming aware of it, and notify affected merchants without undue delay.

11. Disclaimer and limitation of liability

This section sets out the basis on which Cartcha is provided. Please read it carefully. Nothing in it affects your statutory data protection rights, or the rights described in section 9.

11.1 Provided “as is”

Cartcha is provided “as is” and “as available”. To the fullest extent permitted by law, we exclude all warranties, conditions and representations of any kind, whether express or implied, including any implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, and non-infringement.

11.2 No guarantee of results

Cartcha is a bot-mitigation measure, not a guarantee. We do not warrant that Cartcha will prevent any particular purchase, bot, scalper, resale, fraudulent order or automated attack, nor that it will correctly classify every order. Determined attackers adapt, captcha providers change their scoring, and legitimate customers are occasionally flagged. Nothing in our documentation, listing copy or marketing constitutes a warranty of outcome.

You are responsible for deciding whether Cartcha is appropriate for your business, for configuring it — including which products are protected and what happens to a flagged order — and for reviewing its decisions before acting on them.

11.3 Availability and dependencies

We do not warrant that Cartcha will be uninterrupted, timely, error-free, or free of defects. The app depends on third-party services we do not control, including Shopify, Cloudflare and Amazon Web Services. Interruption, degradation, change or discontinuation of any of those services may affect or disable Cartcha, and we are not liable for it. We may modify, suspend or discontinue any part of the app at any time.

11.4 Merchant responsibilities

You are responsible for: your own compliance with data protection, consumer and e-commerce law; maintaining your own privacy notice and cookie disclosures to your shoppers, including any disclosure required for the captcha challenge served on your storefront; the security of your Shopify account and any credentials you supply to the app; and the accuracy of the configuration you set. This policy does not reduce or replace any obligation you owe your own customers.

11.5 Limitation of liability

To the fullest extent permitted by law, we shall not be liable to you for any:

• loss of profit, revenue, sales, business, contracts or anticipated savings
• loss of or damage to goodwill or reputation
• loss, corruption or unavailability of data
• lost, blocked, cancelled, delayed or mis-classified orders, or chargebacks arising from them
• business interruption, or the cost of procuring substitute services
• indirect, special or consequential loss or damage of any kind

whether arising in contract, tort (including negligence), breach of statutory duty or otherwise, and whether or not such loss was foreseeable or we were advised of its possibility.

Subject to section 11.6, our total aggregate liability to you arising out of or in connection with Cartcha, whether in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the total fees you actually paid for Cartcha in the twelve (12) months immediately preceding the event giving rise to the claim.

11.6 What we do not exclude

Nothing in this policy excludes or limits our liability for: death or personal injury caused by our negligence; fraud or fraudulent misrepresentation; any liability that cannot lawfully be excluded or limited, including under the Consumer Rights Act 2015 where it applies; or our obligations and liability under applicable data protection law.

11.7 Business use

Cartcha is supplied for use in the course of a business. If you are dealing as a consumer, you have statutory rights that this section does not affect.

12. Children

Cartcha is a business tool sold to merchants and is not directed at children. We do not knowingly collect data from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top always reflects the current version. Where a change materially affects how we handle your data, we will notify merchants by email or through the app before it takes effect. Continued use of Cartcha after a change takes effect constitutes acceptance of the updated policy.

14. Governing law

This policy and any dispute arising out of or in connection with it or with Cartcha is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Contact

Contact form: whoooop.co.uk/#contact — choose Cartcha as the project type
Postal: Whoooop Ltd, W8A Knoll Business Centre, 325-327 Old Shoreham Road, Hove, BN3 7GS, England

Please include your store’s .myshopify.com domain in any enquiry about a specific store.