Privacy Policy — CartFlux
Last updated: May 2026 · Version: 1.0
1. Who we are
CartFlux is a multi-tenant SaaS e-commerce platform operated by:
NOVA CRAFT STUDIO SRL Tax ID (CUI): 54452722 Registered office: Bucharest, Sector 1, Strada Pitar Moș Nr. 27
Email: contact@cartflux.eu Website: www.cartflux.eu
Within the meaning of Regulation (EU) 2016/679 (GDPR), NOVA CRAFT STUDIO SRL is the data controller for merchant data (platform users) and a data processor for end-customer data from stores created on the platform.
2. What data we collect
2.1 Merchant data (platform users)
When you register for and use CartFlux, we collect:
- Identification data: first name, last name, email address, phone number
- Company data: company name, tax ID (CUI), registered office address
- Account data: password (stored encrypted), platform preferences
- Billing data: information required to issue subscription invoices
- Activity data: selected products, processed orders, store configuration, usage statistics
- Technical data: IP address, browser, device, session cookies
2.2 End-customer data from stores
When an end customer places an order in a store created on CartFlux, we collect on behalf of the merchant:
- First name, last name, email address
- Delivery address
- Order details (products, quantities, prices)
- Payment data (processed exclusively through Stripe — CartFlux does not store card data)
2.3 Automatically collected data
- Technical and session cookies
- Server access logs (IP, timestamp, actions)
- Performance and error data (via Sentry)
3. Purpose and legal basis for processing
| Processing purpose | Legal basis (GDPR) |
|---|---|
| Providing platform services | Performance of a contract (Art. 6(1)(b)) |
| Billing and accounting | Legal obligation (Art. 6(1)(c)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Service-related communications | Performance of a contract (Art. 6(1)(b)) |
| Marketing (newsletter) | Consent (Art. 6(1)(a)) |
| Platform analysis and improvement | Legitimate interest (Art. 6(1)(f)) |
4. How long we retain data
| Data category | Retention period |
|---|---|
| Active merchant account data | For the duration of the contract + 3 years |
| Billing data | 10 years (legal accounting obligation) |
| Order data | 5 years from the order date |
| Technical logs | 90 days |
| Marketing data (newsletter) | Until consent is withdrawn |
| Deleted account data | 30 days after deletion, then permanent removal |
5. Who we share data with
We do not sell your data. We share it only with:
5.1 Sub-processors
| Service | Role | Data location |
|---|---|---|
| Supabase | Database and authentication | EU (AWS Frankfurt) |
| Vercel | Application hosting | EU/US |
| Stripe | Payment processing | EU/US |
| Resend | Transactional email | EU/US |
| Sentry | Error monitoring | EU/US |
| SmartBill | Invoicing (optional) | Romania |
| BigBuy | Supplier product catalog | Spain/EU |
All sub-processors are selected in compliance with GDPR requirements and have Data Processing Agreements in place.
5.2 Public authorities
We may disclose data to public authorities when required by law.
6. International transfers
Some sub-processors process data outside the EU (e.g. Vercel and Stripe have infrastructure in the USA). These transfers are carried out with appropriate safeguards under the GDPR (Standard Contractual Clauses, adequacy decisions).
7. Your rights
As a data subject, you have the following rights:
- Right of access — to know what data we hold about you
- Right to rectification — to correct inaccurate data
- Right to erasure — to request deletion of your data ("right to be forgotten")
- Right to restriction of processing — in certain circumstances
- Right to data portability — to receive your data in a structured format
- Right to object — to processing based on legitimate interest
- Right to withdraw consent — at any time, without retroactive effect
To exercise your rights, contact: contact@cartflux.eu
We respond within 30 days of receiving your request.
You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro
8. Cookies
CartFlux uses:
- Strictly necessary cookies — for platform operation and authenticated sessions (consent not required)
- Analytics cookies — Google Analytics 4 (with consent)
- Marketing cookies — Facebook Pixel, TikTok Pixel, per each store's configuration (with consent)
Manage your preferences through the cookie banner displayed on your first visit. Further details in the Cookie Policy.
9. Data security
We implement appropriate technical and organizational measures:
- Encrypted HTTPS/TLS communications
- Passwords stored using secure hashing algorithms (PBKDF2-SHA256)
- Role-based access (RLS — Row Level Security in the database)
- Monitoring and alerting for security incidents (Sentry)
- API keys managed through secure environment variables
10. Minors
CartFlux is a service intended exclusively for persons aged 18 or over. We do not knowingly collect data from minors.
11. Changes to this policy
We reserve the right to update this policy. We will notify you by email at least 14 days before significant changes take effect.
12. Contact
NOVA CRAFT STUDIO SRL Bucharest, Sector 1, Strada Pitar Moș Nr. 27
Email: contact@cartflux.eu Website: www.cartflux.eu
This document is governed by applicable Romanian and European legislation on the protection of personal data.