Privacy Policy

Last updated 12 November 2026

This policy explains what CartWatchman collects through the CartWatchman plugin and CartWatchman Cloud, why, and what you can do about it.

1. The WordPress plugin

The plugin stores its check results, incidents and settings in your own WordPress database. It does not send anything to us unless you connect the site to CartWatchman Cloud, or unless it is the version downloaded from CartWatchman Cloud, which checks for plugin updates by sending the plugin, WordPress and PHP version numbers.

2. What Cloud receives from a connected site

• Site address, and plugin, WordPress and WooCommerce versions.
• Health score, last scan time and incident summaries (title, severity, times, short description and likely cause).
• Payment gateway IDs and names with their enabled and test-mode status, WooCommerce webhook counts, and how long ago the last paid order was placed.

We never receive customer names or addresses, order contents, card or bank details, passwords, or raw logs.

3. Your account

Name, email address, a hashed password, the organisations you belong to, and a log of important account actions. If you pay, Razorpay processes the payment; we receive the payment status and reference, not your card details.

4. Why we use it

To run checks, show your dashboard, send the alerts you set up, bill you, keep the service secure, and answer support requests. We do not sell personal data or use it for advertising.

5. Service providers

• Hostinger: hosting for the cloud app and database.
• Razorpay: payment processing.
• Our email provider: account and alert emails.
• Slack or Microsoft Teams, only if you add their webhook to receive alerts.

6. Cookies

We use only the cookies needed to keep you signed in and remember the organisation you selected. There are no advertising or tracking cookies.

7. How long we keep data

Check history is kept for your plan's history period (30, 365 or 730 days) and then deleted. If you ask us to delete your account, its cloud data is deleted within 30 days, except records we must keep by law, such as invoices.

8. Your choices and rights

You can disconnect a site at any time, which stops all uploads. You can ask to see, correct, export or delete your personal data through our contact page. We aim to reply within 30 days. Where the Digital Personal Data Protection Act, 2023 or the GDPR applies to you, you have the rights those laws give you.

9. Security

Connections use HTTPS, passwords are hashed, site tokens are stored hashed, and access is limited to members of your organisation.

10. Changes

We will post changes here and email account owners about important ones.