Privacy policy

Last updated October 15, 2026

GroupCart is an app for Shopify stores, made by NovusEcom (“we”). It lets a group of shoppers fill one cart together on a store. This policy explains what GroupCart keeps about the stores that install it (merchants) and about the people who use a group cart on those stores (shoppers), why, for how long, and who it is shared with.

Who is responsible for what

For what we keep about merchants, we decide how it is used. For shoppers’ data in a group cart, the store is responsible for it (the controller), and we process it on the store’s behalf, only to run GroupCart for that store. Our Terms of Service set out how we do that.

What we keep about merchants

• Your store’s address and an access key that Shopify gives GroupCart when you install it, used only to run the app for your store.
• Your GroupCart plan, as Shopify reports it: which plan, and when its free trial ends. Billing is done by Shopify; we never see payment details.

What we keep about shoppers

A shopper never creates an account with us. In a group cart we keep:

• the display name the shopper types (for example “Dana”), shown to the others in the same cart;
• the cart’s name, if the organizer gives one (for example “Office order”);
• the products and quantities each person added, and the items they liked;
• a deadline, if the organizer sets one.

We do not ask for or keep a shopper’s email, phone number, postal address, payment details or customer account. The shopper’s browser keeps a random key that lets it return to the cart; we keep only a protected form of it. A shopper’s IP address is held only in our server’s memory, to limit abuse, and is never written to our database or logs.

In the shopper’s browser (local and session storage, on the store’s own website): that key (and, for the organizer, their private organizer link), the cart’s link, a copy of the cart so it shows at once, and a few display preferences, such as whether the panel is open. We use no advertising or tracking cookies.

Orders

When the organizer checks out, the store’s normal Shopify checkout receives the items with “Added by” and the person’s name on each line, and the cart’s name on the order. That order belongs to the store, like any other order.

Order tracking is optional and off unless the merchant turns it on. With it, Shopify sends GroupCart each new order of the store. We use only GroupCart’s own mark on the order (to know which group cart it paid for) and the order’s total and currency. We do not keep or read the customer’s name, email, phone or address.

Numbers about how GroupCart is used

To show merchants their results, we record what happens to each group cart: when it was started, joined, sent to checkout and ordered, its size (how many people, items and likes) and, with order tracking, its order’s total. These records hold no names, no cart names and no products.

Why we use it

• To provide GroupCart to the stores that install it, as they asked when installing it.
• On each store’s behalf, to run group carts for its shoppers.
• To keep GroupCart secure and working: preventing abuse, and finding and fixing errors.

We do not sell or share personal data, use it for advertising, or use it for anything else.

How long we keep it

• A group cart nobody changed for 30 days is deleted, with its names, items and likes. A cart with a deadline is kept until 30 days after the deadline.
• A cart whose order was placed is deleted when the organizer confirms the order, or 7 days later when the store uses order tracking.
• The organizer can delete the cart at any time.
• When a merchant uninstalls GroupCart, the store’s group carts, access key and plan are deleted at once, and anything left is erased within 48 hours. Usage numbers stay only in a form that no longer names the store.
• Usage records are kept for 400 days, then only as totals that name no store.

Who it is shared with

• Shopify, which hosts the store, its checkout and its billing.
• Service providers that host our server and database and report errors to us, who may use the data only to provide their service to us. Error reports carry technical details only, filtered to leave out names and what a shopper typed.

The data is stored in the United States.

Your rights and requests

Depending on where you live, you may have the right to ask what personal data is held about you, to have it corrected or erased, and to complain to your data protection authority. A shopper can ask the store, which Shopify passes on to us, or write to us directly. A display name in a group cart is not tied to an email, phone or account, so we may not be able to find a cart from a person’s details alone; every cart is deleted within the times above.

Security

Data travels over encrypted connections, each store can reach only its own data, and access is limited to what is needed to run GroupCart.

Children

GroupCart is not aimed at children, and we do not knowingly collect children’s personal data.

Changes

If this policy changes in substance, we update the date at the top of this page.

Contact

novusecom.support@gmail.com. See also our support page.