Privacy Policy

Last updated: 15 October 2026

Cartello ("Cartello", "we", "us") provides an online platform that lets merchants build websites and online stores, manage products and orders, and sell to their customers. This policy explains what personal information we collect, how we use it, and the choices you have. It applies to cartello.online, the Cartello admin dashboard, the Cartello mobile app, and stores hosted on the Cartello platform.

1. Who is responsible for your data

For merchant accounts and the Cartello platform itself, Cartello is the data controller. For shoppers who buy from a store built on Cartello, the merchant who runs that store is the controller of their customer data, and Cartello processes it on the merchant's behalf.

2. Information we collect

Account information: name, email address, phone number, password (stored only as a secure hash), store name and business details you provide when you sign up.
Store content: products, images, pages, settings and other content you upload to your store.
Order and customer data: when shoppers buy from a store, the store's orders, delivery addresses and contact details.
Billing information: subscription plan and payment status. Card details are entered directly with our payment providers; Cartello never receives or stores full card numbers.
Usage and device data: log data, IP address, browser type, pages visited and performance measurements, used to operate and secure the service.
Cookies: essential cookies for sign-in, cart and security. Analytics and advertising cookies are used only with consent where the law requires it.

3. How we use information

To provide, maintain and secure the platform and your store.
To process orders, payments and deliveries.
To send service messages such as account verification, order notifications and security alerts.
To provide support and respond to your requests.
To comply with legal obligations and prevent fraud and abuse.

We do not sell personal information.

4. Google user data

Merchants can optionally connect their Google account to Cartello to set up Google Analytics, Google Tag Manager and Google Search Console for their store. When you connect, Google asks you to approve the following access, and we use it only for the purposes below:

Basic profile (OpenID, email address): to show which Google account your store is connected to.
Google Analytics (analytics.edit): to create or select a Google Analytics 4 account, property and web data stream for your store, create the Measurement Protocol secret used for server-side purchase tracking, and configure key events. We do not read or change Analytics properties you did not select for your store.
Google Tag Manager (tagmanager.manage.accounts, tagmanager.edit.containers, tagmanager.edit.containerversions, tagmanager.publish): to create a Tag Manager container for your store, add the tags you choose to enable, and publish them so they go live on your storefront.
Google Search Console (webmasters): to add your store's website as a Search Console property, submit its sitemap, and retrieve its search performance data (clicks, impressions, queries and pages) so you can see it in your Cartello dashboard.
Site Verification (siteverification): to prove to Google that you own your store's website, using a verification file served by your store.

Google data is used only to provide these features to the merchant who connected the account. We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial intelligence or machine-learning models, and humans at Cartello do not read it except with your permission, for security purposes, or where required by law.

Cartello's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google access tokens are encrypted at rest (AES-256-GCM) and are never shown in full or shared with third parties. You can disconnect Google at any time from your store's integration settings; disconnecting revokes Cartello's access at Google and deletes the stored tokens. You can also remove access at any time from your Google account at myaccount.google.com/permissions. Search performance data already copied into your dashboard is deleted when your store is deleted, or on request.

5. Sharing information

We share personal information only with service providers that help us run the platform (for example hosting, databases, email and SMS delivery, payment processing and shipping carriers), under contracts that require them to protect it; with integrations a merchant chooses to connect; and when required by law or to protect rights and safety. If Cartello is involved in a merger or acquisition, information may be transferred as part of that transaction, subject to this policy.

6. Data retention

We keep information for as long as your account is active and as needed to provide the service. When an account or store is deleted, we delete or anonymize its personal information within a reasonable period, except where we must keep it longer to meet legal, tax or accounting obligations.

7. Security

We use industry-standard safeguards, including encryption in transit (HTTPS), encryption of secrets and tokens at rest, strict separation of each store's data, access controls and activity logging. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. Shoppers should contact the store they bought from first. To exercise your rights, contact us using the details below.

9. Children

Cartello is not directed to children under 16, and we do not knowingly collect their personal information.

10. International transfers

Cartello serves customers worldwide, so information may be processed in countries other than your own. Where required, we use appropriate safeguards for these transfers.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date and, for significant changes, notify merchants by email or in the dashboard.

12. Contact us

Cartello — Tulkarm, Palestine
Email: eng.ahmad753@gmail.com
Phone / WhatsApp: +970 56 611 8784

Last updated: 15 October 2026

2. Information we collect

Account information: name, email address, phone number, password (stored only as a secure hash), store name and business details you provide when you sign up.

Store content: products, images, pages, settings and other content you upload to your store.

Order and customer data: when shoppers buy from a store, the store's orders, delivery addresses and contact details.

Billing information: subscription plan and payment status. Card details are entered directly with our payment providers; Cartello never receives or stores full card numbers.

Usage and device data: log data, IP address, browser type, pages visited and performance measurements, used to operate and secure the service.

Cookies: essential cookies for sign-in, cart and security. Analytics and advertising cookies are used only with consent where the law requires it.

3. How we use information

To provide, maintain and secure the platform and your store.

To process orders, payments and deliveries.

To send service messages such as account verification, order notifications and security alerts.

To provide support and respond to your requests.

To comply with legal obligations and prevent fraud and abuse.

We do not sell personal information.

4. Google user data

Basic profile (OpenID, email address): to show which Google account your store is connected to.

Google Analytics (analytics.edit): to create or select a Google Analytics 4 account, property and web data stream for your store, create the Measurement Protocol secret used for server-side purchase tracking, and configure key events. We do not read or change Analytics properties you did not select for your store.

Google Tag Manager (tagmanager.manage.accounts, tagmanager.edit.containers, tagmanager.edit.containerversions, tagmanager.publish): to create a Tag Manager container for your store, add the tags you choose to enable, and publish them so they go live on your storefront.

Google Search Console (webmasters): to add your store's website as a Search Console property, submit its sitemap, and retrieve its search performance data (clicks, impressions, queries and pages) so you can see it in your Cartello dashboard.

Site Verification (siteverification): to prove to Google that you own your store's website, using a verification file served by your store.

Cartello's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing information

7. Security