OpenLift Cart Privacy Policy
Effective November 1, 2026
OpenLift Cart is operated by Ojasvy Dixit, trading as Urban Lalten, a sole proprietorship in India (“we”, “us”). The Fullstack Guys is the developer brand used for this app. This policy describes how we handle information when merchants install and use OpenLift Cart, shoppers interact with its cart drawer, or someone contacts our support team. It applies to OpenLift Cart.
Information the app uses
- Store and authentication information. We process the Shopify store domain, app installation and session identifiers, granted access scopes, access and refresh tokens, and token expiry information to authenticate merchants and operate the app. Shopify authentication may also provide information about the authorized store user.
- Agreement acceptance. We record the store domain, agreement version, acceptance time and authority confirmation in Shopify app-owned installation data. This record follows Shopify’s app-data lifecycle; we do not maintain a separate indefinite archive.
- Products and settings. The app reads product and collection information to help merchants select offers. Drawer preferences, product handles, and display settings are saved in app-owned metafields in Shopify.
- Cart information. The storefront drawer reads and updates product variants, quantities, cart totals, discount codes, and order notes through the store’s Shopify cart. These requests go from the shopper’s browser to Shopify. We do not maintain a separate database of shopper carts, customer profiles, payment details, or full orders.
- Upsell order usage. To enforce your plan’s order allowance, Shopify sends us a reduced paid-order notification with the order identifier, creation date, test/payment/cancellation status and line-item quantities and properties. We retain only the store domain, order identifier and creation date for orders containing an OpenLift cart upsell. Each qualifying order counts once by creation date in the monthly app billing cycle. Test and bundle-only orders do not count; subsequent refunds do not reverse usage. We do not request customer names, email addresses, addresses or payment details for this counter. Usage records are deleted on shop redaction and matching records on customer redaction.
- Optional trust toasts. When enabled by the merchant, we retrieve aggregate counts of paid, non-cancelled, non-test orders created in the last 24 hours or 7 days. We do not retrieve customer fields or individual order details for these counts. Visitor activity uses a random browser identifier only when Shopify’s Customer Privacy API allows analytics processing. The browser sends the identifier and store domain; our database stores a keyed hash, store domain and last-seen time. We do not collect page paths, names, email addresses, precise locations or browsing history for this feature. Infrastructure necessarily receives connection information when servicing requests. Counts are approximate active browser visits seen within 90 seconds, not unique people.
- App subscription status. We check your app plan and trial status with Shopify to provide the features included in your plan. Storefront widgets request a public feature-availability flag from our backend using the store domain. This check does not include shopper identity, cart contents or payment details. Shopify processes app subscription billing.
- Technical records. Our infrastructure processes requests and operational information such as request identifiers, timing, and errors. Privacy-request receipts contain a webhook identifier, request type, and completion time; they do not contain the customer request payload.
- Support correspondence. If you email us, we receive your email address and the information you choose to send, such as your store URL and issue description. Do not send passwords, access tokens, payment details, or unnecessary customer information.
How we use information
We use information to provide the cart drawer and product offers, save merchant preferences, authenticate authorized users, troubleshoot problems, answer support requests, secure the service, and respond to privacy requests. We do not sell personal information or use shopper information for targeted advertising. The app does not install an advertising pixel or a session-replay tracker.
Service providers and international processing
Shopify provides store administration, product and cart services, and checkout. Amazon Web Services hosts the app in Stockholm, Sweden. Supabase hosts our session database in the United States. Hostinger mail servers receive messages sent to our support address. Cloudinary delivers instructional videos when merchants load them in the app; delivery involves connection information such as an IP address. These videos use development-store examples and do not contain real customer records. These providers process information to deliver their services, and information may be processed outside your country. We may also disclose information where legally required or necessary to protect the service and its users.
Security and retention
We use HTTPS for app traffic and encrypt stored Shopify session payloads. Database access is restricted to the backend service. No system can guarantee absolute security.
Authentication records are kept while needed to provide app access. We delete the store’s stored sessions when we receive and successfully process Shopify’s uninstall or shop-redaction notification. App-owned settings are stored in Shopify and are subject to Shopify’s app-data lifecycle. Operational logs expire after seven days. A daily database cleanup removes upsell usage records older than 90 days, privacy-request exports older than 30 days, and privacy-request receipts older than 90 days. Deletion notifications can remove records sooner. Receipts contain no customer payloads. Resolved support correspondence is reviewed monthly and unnecessary messages deleted within 90 days of resolution, unless a documented legal or unresolved-dispute reason requires longer retention. Contact us to request earlier deletion.
Cookies and browser storage
We use Shopify’s authentication mechanisms for merchant access. The storefront drawer relies on Shopify’s cart and its associated browser state. The optional visitor counter stores a random identifier in local browser storage after analytics permission is available. It is reused across tabs and expires logically after 30 minutes without activity; an expired identifier is replaced on the next permitted visit. Withdrawing analytics permission stops heartbeats and removes the browser identifier and its active server record when the request succeeds. Inactive server records are excluded from counts after 90 seconds and removed by a once-per-minute cleanup once older than two minutes. No visitor record is linked to a Shopify customer. We do not add advertising cookies. Shopify and the merchant’s other services may use cookies under their own policies.
Your choices and requests
Merchants must disclose optional visitor counting in their storefront privacy notice and configure Shopify’s consent settings. Merchants can change app settings, disable the theme app embed, or uninstall the app through Shopify. Depending on the laws that apply to you, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information, and to complain to a privacy authority. Email us to exercise a right or ask about processing. We may need to verify that you are authorized to make the request.
Shoppers should contact the store they purchased from for requests about their orders and customer records. We handle Shopify’s mandatory customer-data and deletion notifications. For customer-data requests, we make matching stored upsell order identifiers and creation timestamps available to the authenticated merchant in Privacy requests, including an empty export when no matching records remain. The merchant responds through the store’s privacy process. Customer redaction deletes matching usage records and pending exports; shop redaction deletes all stored sessions, usage records and pending exports for that store.
Changes and contact
We will update this page and its effective date when this policy changes. Material changes will be communicated as required by applicable law.
Ojasvy Dixit, trading as Urban Lalten
Developer brand: The Fullstack Guys
Ajay Housing Society Ke Pass, 3/B, Jawahar Ki Nadi,
Ward No. 11, Daurai, Ajmer, Rajasthan 305003, India
info@thefullstackguys.us
thefullstackguys.us