Privacy Policy

2. Who this policy applies to

This policy applies to merchants and authorised staff who register for and use Cartpo, and to visitors of cartpo.com. Cartpo is a merchant-facing product of the iHolda platform. Some features (for example iHolda identity link, paid events on iHolda, or creator collaborations) also involve the iHolda consumer app and are described below and in iHolda’s Merchant & Commerce Terms.

3. Information we collect

We collect information you provide, information generated when you use Cartpo, and limited technical information from your device as described in this policy.

4. Account and contact information

When you register, we collect your phone number, email address (where provided), one-time verification codes (OTP), and account credentials (password stored in protected form). We use this to create and secure your merchant account, authenticate you, and communicate about your shop and orders.

5. Business, shop, and catalog data

• Business name, type, description, contact phone, physical address, and map coordinates where you provide them.
• Opening hours, cover and gallery images, currency, delivery options, and accepted payment methods.
• Product names, descriptions, prices, categories, images, stock or availability settings, and referral or commission settings.
• Discount and loyalty rules (percentages, customer-type conditions, order thresholds, validity).

6. Transactions, orders, and buyer details

When you process sales through Cartpo POS or receive orders from iHolda, we record amounts, payment method, discounts, change due, timestamps, line items, quantities, and order status (for example new, pending, shipped, completed, cancelled). Cartpo does not offer consumer accounts to your buyers; however, you may enter limited buyer-related fields on orders (such as a buyer name or delivery contact) as part of fulfilling sales.

7. Creator collaboration and commissions

When Creators on iHolda request to collaborate with your shop, we store request status (pending, approved, rejected), Creator identifiers, and commission parameters you configure. Approved Creators may see business and product information needed to promote your catalog; they do not receive your full financial ledger or unrelated transaction history.

8. Delivery and shipping

If you use delivery features, we process shipping status, tracking references, drop-off locations, and interactions with delivery workflows you enable in the app.

9. Merchant business verification

For trust, eligibility, and certain selling features, we may collect verification information you submit in the app, such as:

• WhatsApp contact number and iHolda username (to help match your ecosystem accounts).
• Identity or business documents you upload (for example personal ID, business registration, or application letter).
• Verification status, admin messages, and payment confirmation for optional manual verification fees.

Verification payments are processed by third-party payment providers; we do not store your full payment card number.

10. iHolda identity link

• When your Cartpo merchant account and an iHolda consumer account use the same email, you may initiate or approve an identity link so the consumer can act as the store owner on iHolda (for example paid events, go-live selling, or owner-linked flows).
• Linking stores linkage metadata on both accounts (such as linked merchant and consumer user identifiers). It does not automatically add every Creator to your shop; creator linking remains subject to separate approval and plan limits.
• You may unlink through in-app flows; unlinking can affect selling, catalog visibility, and paid-event eligibility on iHolda.

11. Device and technical data

We collect technical information needed to operate and secure the app, including:

• Push notification tokens (Firebase Cloud Messaging) and platform (iOS or Android) to deliver order and account alerts.
• App version, operating system version, and IP address for security, debugging, and service delivery.
• General usage and error logs where needed to maintain reliability.

We do not collect advertising identifiers for cross-app tracking, and we do not collect hardware serial numbers or permanent device IDs for merchant analytics. If crash or diagnostic tools are enabled on our infrastructure, they are used to fix defects, not to sell your data.

12. Location, camera, and photos

With your permission, we may access device location to help set your shop address or support location-aware discovery features. Camera and photo-library access is used when you upload shop or product images or scan QR codes. You can change permissions in device settings; some features will not work without the relevant permission.

13. Offline use and local storage

Cartpo may cache shop settings, catalog drafts, sales summaries, and pending transactions on your device when you are offline. This data is stored locally until connectivity returns and sync completes. Local caches are tied to your logged-in merchant account and should be protected by your device passcode or biometrics.

14. Communications and support

If you contact us through in-app support, email, or the cartpo.com contact form, we retain the content and contact details needed to respond and improve support quality.

15. How we use your information

• Provide POS, catalog, order, discount, delivery, and analytics features.
• Authenticate you and prevent fraud or abuse.
• Facilitate iHolda discovery, identity link, creator collaboration, and cross-platform orders.
• Process subscriptions, verification fees, and payouts through payment partners.
• Send service notifications (orders, collaboration requests, account updates).
• Comply with law and enforce our Terms of Service.
• Improve the Services using aggregated or de-identified analytics where possible.

16. Legal basis for processing

• Contractual necessity — to provide Cartpo and related merchant features you request.
• Legitimate interests — security, fraud prevention, and product improvement, balanced against your rights.
• Legal obligation — tax, accounting, or regulatory retention where applicable.
• Consent — optional permissions (such as location) and marketing where offered; you may withdraw consent in device or account settings.

17. Sharing and disclosure

We may share information in these circumstances:

• iHolda platform — when you enable social commerce or identity link, we share shop, catalog, and visibility data needed for discovery, orders, and owner or creator flows, as controlled in-app.
• Creators — when you approve a collaboration, limited business and product data needed for referrals.
• Service providers — cloud hosting, image storage, email or messaging, customer support, and security vendors processing data on our instructions.
• Payment providers — Stripe, Paystack, or Korapay (as applicable) for subscriptions, verification fees, and merchant payout setup; we do not store full card numbers.
• Push delivery — Google Firebase Cloud Messaging for device notifications.
• Professional advisers, regulators, or acquirers — where required by law or a business transfer (with notice where practicable).

We do not sell your personal data to third parties.

18. International transfers

Your data may be processed in countries other than where you operate, including where our hosting or payment partners maintain infrastructure. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

19. Data retention

• Account and shop data — while your account is active and for a reasonable period afterward for reactivation and legal compliance.
• Transaction records — typically at least seven (7) years where tax or financial rules require, or longer if mandated locally.
• Technical logs — generally up to twelve (12) months for security and debugging, then deletion or anonymisation.
• Support tickets — about two (2) years after resolution unless longer retention is required.
• Verification documents — for the period needed to maintain eligibility and regulatory obligations, then deleted or archived securely.

20. Security

We use technical and organisational measures including encrypted transmission (TLS), access controls, and secure credential handling. No online service is perfectly secure; please use a strong password and protect your device.

21. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, port, or object to processing of your personal data, and to complain to a supervisory authority. Contact support@iholda.com to exercise these rights. We respond within timeframes required by applicable law (often within 30 days).

22. Cookies and the marketing website

cartpo.com uses essential cookies only for basic site functionality. We do not use advertising or cross-site tracking cookies on this website. The Cartpo mobile app does not use browser cookies.

23. Age restrictions

Cartpo is for merchants and staff aged 18 and over. We do not knowingly collect personal data from anyone under 18.

24. Automated decision-making

Cartpo does not use automated decision-making that produces legal or similarly significant effects solely through automation. Plan eligibility and verification outcomes may use rule-based checks tied to your subscription and submitted documents.

25. Third-party links

The Services may link to app stores, payment pages, or iHolda. Third-party practices are governed by their own policies.

26. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app, email, or a notice on cartpo.com. Continued use after the effective date constitutes acceptance of the updated policy.