Privacy

Scanning a store collects nothing about you

You can scan a store without giving us anything. We do not use cookies for advertising, we have no login, and we do not build a profile of you. What a scan stores is about the store: its domain, its score, and the signals we parsed from its public pages.

We never store the pages themselves — no HTML, no response bodies. Only the parsed facts a score is made of, such as whether a product page carried a price in its structured data.

Your email address, if you give it

The report form asks for an email address so we can send you the full findings. When you submit it we store three things: the address, which store you asked about, and where on the site you asked from. That is the whole row.

We do not store your IP address, name, or anything else alongside it. We use the address to send the report you asked for and to reply if you write to us. We do not sell it, and we do not send marketing to it.

Your IP address, briefly

To stop one person scanning thousands of stores through us, we count requests against your IP address — 5 scans an hour, and a limit on how often any single store can be rescanned (1h). Those counters live in our Redis cache keyed by the address, and they expire within the hour. We do not write your IP address to our database and we do not keep logs of it ourselves.

Analytics and error reporting

We count page views through Vercel Analytics and Cloudflare Web Analytics. We set no analytics cookies of our own.

When something breaks, the error is reported to Sentry so we can fix it. We turn off Sentry’s default collection of personal data, strip cookies from the report before it is sent, and redact any value that looks like a credential.

Who else processes it

Running this site means data passes through other companies. Below is what we send to each. For how long they keep it and where, their own policies are authoritative and linked — we would rather point you at the source than paraphrase it.

• Supabase (Postgres)Scanned domains, scan results and parsed signals, and the email address you give the report form.
• Upstash (Redis)Your IP address as a rate-limit key, and cached scan results. The rate-limit entries expire within the hour.
• ResendYour email address and the report we send to it.
• VercelEvery request to this site, as the host. Vercel Analytics is enabled for page-view counts.
• CloudflareCloudflare Web Analytics is enabled for page-view counts.
• SentryError reports when something breaks. We disable Sentry's default personal-data collection, drop cookies from the report, and redact anything matching a credential.

Deleting it

Email hello@cartiqhq.com and say what you want removed. Specifically:

• Your email address. We delete the row. Ask from the address itself, or tell us which address to remove.
• A store’s scans. If you run the store, we will delete its scan history and remove it from the leaderboard. We may ask you to confirm you control the domain, so that one person cannot erase another’s.
• Rate-limit counters. Nothing to do — they expire within the hour on their own.

We answer from a person, not a form. If a request is unclear we will write back and ask rather than guess.

What we scan, and whose permission we need

Anyone can ask us to scan any public store, including one they do not own, because a scan reads only pages that store already publishes to anyone — the same pages a search engine or a shopping assistant reads. We honour robots.txt for everything we request, we identify ourselves in our user agent, and we never attempt to get round a block. If you operate a store and want us to stop, the crawler page explains how.

Changes

If this changes we update the date at the top. We do not keep a version history of this page yet; if that matters to you, ask and we will tell you what changed.