Privacy policy
Last updated 21 August 2026. CartPass is operated by Serious Studios Limited, a New Zealand company. This page says what information we hold, why we hold it, and how to get it changed or removed. We collect only what the service needs, we run no advertising or analytics trackers, and we never sell data.
Who this covers
Three groups of people: visitors to this website, people who hold an account or buy something, and people who operate the online stores we scan. Where a section applies to only one group, it says so.
What we collect, and why
Account details. Your email address, a name, and a password. The password is stored hashed — we never see it. We use these to sign you in and to know which stores are yours. Purchases and subscriptions. Card details go straight to Stripe, our payment provider, and never reach our servers. We keep Stripe's reference for you, what you bought, when, for how much, the email address Stripe gives us, and the status of any monitoring subscription. We use these to unlock your report, run your monitoring, and keep invoicing and tax records. Store claims and scan results. The store domain you claim, and the results of scans of it: the pages our agents visited, screenshots, timings, the responses your store gave, its robots.txt, and what the agents found. This is information about a store, not about a person. Scans use synthetic test identities; we never use real customer data. Cookies. Two, both strictly necessary: a session cookie when you sign in, and a report-access cookie set when you open a report you have bought. There are no analytics, advertising or tracking cookies, which is why there is no cookie banner. Request logs. Our hosting provider keeps standard web-server logs — IP address, URL, time, browser — for a short period, for security and debugging. Correspondence. Email you send to hello@cartpass.ai is kept so we have the history next time you write.Stores we scan
CartPassBot visits public storefronts the way a shopper would — search, product page, variant, cart, checkout — and stops at the payment screen. It never places an order. We keep what the agent saw: screenshots, page text, the responses the store returned, and timings. This is information a store has published for anyone to see. We keep it to produce the report, to re-check results when a store questions them, and for aggregate research on how stores treat AI shoppers.
A scan's summary is reachable only by its unlisted link. The full report is available only to the person who bought it or to the store's verified operator. Aggregate figures we publish never name a store.
If a screenshot captured personal information — a customer review with a name, say — email us and we will remove it. To stop CartPassBot visiting your store at all, add it to your robots.txt as described on our contact page, or email us and we will exclude the domain by hand.
Who else handles it
A small number of providers hold data on our behalf and on our instructions: a hosting provider in the United States, a payment processor, an email provider, and the AI model providers that power the shopping agents — who receive only the public pages of the store being scanned, never your account or billing details.
We do not sell or rent personal information, and we do not share it with anyone else unless the law requires us to.
Where it lives
The service and its database run in the United States. Serious Studios Limited remains responsible for your information under the New Zealand Privacy Act 2020 wherever it is held; our providers hold it only on our behalf. If you are in the European Union or the United Kingdom, transfers to our providers rely on their standard contractual clauses and on the need to deliver what you asked us for.
How long we keep it
- Account details — while your account is open, and deleted within 30 days of you asking us to close it.
- Purchase and subscription records — seven years, as New Zealand tax law requires.
- Scan results and reports — for as long as they are needed to keep your reports and monitoring history working and for aggregate research; removed on request from the store's operator.
- Request logs — a few weeks.
- Correspondence — up to two years after the last message.
Your rights
Under the Privacy Act 2020 you can ask what personal information we hold about you and ask us to correct it. We extend the same rights to everyone, wherever you are: access, correction, deletion, a copy of your data, and the right to object to how it is used. Email hello@cartpass.ai. We will check that the request really comes from you and respond within 20 working days.
If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner at privacy.org.nz. If you are in the EU or UK you can also contact your local data protection authority.
Security
Everything travels over TLS. Disks are encrypted. Passwords are hashed. Card details never touch our systems. Access to account data is limited to a small number of named people and is used only to support you or to investigate misuse.
Changes
When we change this policy we update the date at the top. If the change is material we also email account holders before it takes effect.
Contact
Serious Studios Limited, New Zealand. Questions about this policy or your information: hello@cartpass.ai.