Privacy Policy

Undercart

Undercart (undercart.co) provides business intelligence about Shopify stores through its web application, REST API, MCP connector for AI assistants, and Chrome extension. Undercart is operated by Noam Szpiro(“Undercart”, “we”, “us”). This policy explains what personal data we collect about the people who use Undercart, why, who receives it, how long we keep it, and the choices you have. Questions: hello@undercart.co.

Information we collect

Account information. You sign in with Google. We receive and store your name, email address, profile image and Google account identifier, and we keep your plan, role and monthly usage counts on your account.

How you found us. On your first visit, a first-party cookie records the site that referred you, any campaign tags in the link (such as utm parameters) and the first page you landed on. If you sign up, that record is saved to your account.

Product activity. We record what you do in Undercart, with the time of each action: the searches and filters you run, the store profiles you open, the exports you download, and the lists, alerts and settings you save. We use this to enforce monthly plan limits, show your recently viewed stores and saved work, answer support requests, and improve the product.

API and MCP connector requests. When you use the Undercart API, or the Undercart connector in an AI assistant such as ChatGPT or Claude, we receive the requests it sends on your behalf: the tool or endpoint called and its parameters (for example store domains, categories, countries, revenue ranges and technology filters), plus the name, version and user agent the client reports. We log each request with its time, its parameters, a summary of what we returned (such as the number of results and the store domains listed), how long it took, and whether it counted toward your monthly limit. We use these logs to run plan limits, debug errors and improve results. We receive only the requests the assistant chooses to send. We do not receive your conversations with the assistant, and the assistant provider (for example OpenAI or Anthropic) handles those under its own privacy terms. The connector authenticates with an OAuth authorization you grant through your Undercart sign-in, or with an API key you create. We store both only in hashed form.

Chrome extension.When you open the extension, it sends the domain of your active tab to Undercart to find or create that store’s profile. While the extension is installed, it checks each page you visit for Shopify markers locally, in your browser. When a page is a Shopify store, it sends that store’s domain to Undercart so the store can be added to the catalog. That domain is not saved to your account. The extension sends nothing about pages that are not Shopify stores. It does not read page content beyond that check, record your browsing history, or access your other open tabs.

Billing. Payments are processed by Stripe. We store your Stripe customer identifier, subscription status and renewal dates. We never receive or store your full card number.

Messages and notifications. If you contact us, your message reaches us by email. The in-app contact form does not store it in Undercart. If you turn on browser notifications for alerts, we store the push subscription address your browser provides.

Analytics, cookies and logs. We use cookies to keep you signed in, remember interface preferences and record how you found us (above). We use Google Analytics to measure how Undercart is used: pages and features used, device, browser and approximate location. For signed-in users, it is linked to a pseudonymous account identifier, not your email. The store domains you research are removed from what we send to Google Analytics. Our hosting provider keeps server request logs, which can include your IP address. We also use IP addresses briefly, in memory, to rate-limit our public revenue checker. We do not store IP addresses in our database.

Store data.Undercart’s catalog describes Shopify stores, which are businesses. It is compiled from public sources: the stores’ own websites, public web datasets, public ad libraries, and newsletters we subscribe to. Store profiles can include contact details that a business publishes. To ask about or correct a store profile, contact hello@undercart.co.

How we use information

We use personal data only to provide and secure Undercart: to authenticate you, return the store intelligence you request, enforce plan limits, process payments, send the alerts and account emails you ask for, provide support, prevent abuse, and measure and improve the service. We do not sell personal data. We do not use it for advertising profiles, lending or creditworthiness decisions, or any purpose unrelated to Undercart.

Who receives it

We share personal data only with service providers that process it on our behalf:

• Hosting, database and server logs: Render
• Sign-in: Google
• Payments: Stripe
• Email delivery (alerts, account and billing emails): Resend
• Product analytics: Google Analytics
• AI tools we use to analyze product usage and operate the service: Anthropic
• Browser notifications: your browser vendor’s push service, if you enable them

The store intelligence you request through the API or connector is returned to the client or AI assistant you connected. We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a sale or transfer of the Undercart business.

How long we keep it

• Account information, product activity and API and connector logs: while your account is open. When you ask us to delete your account, we delete it and the data linked to it within 30 days. That includes activity and request logs, saved lists, alerts, API keys and connector authorizations. The search terms you entered are kept with no link to you, as anonymous search statistics.
• Per-store usage records that count toward a monthly limit: deleted after that month ends.
• Connector authorizations: access tokens expire after one hour and refresh tokens after 30 days. Disconnecting the connector ends them sooner.
• Server request logs: kept by our hosting provider for up to 30 days.
• Billing records: as long as tax and accounting law requires. Stripe keeps payment records under its own policy.
• Support emails: as long as needed to handle your request.

Your choices

• Disconnect the Undercart connector at any time in your AI assistant’s connector or app settings, and revoke API keys under Settings → API keys.
• Edit or delete your saved lists and alerts in the app, unsubscribe from alert emails, or turn off browser notifications.
• Cancel a subscription at any time on the Billing page.
• Ask for a copy of your data, a correction, or deletion of your account by emailing hello@undercart.co. We respond within 30 days.
• Block or delete cookies in your browser settings, or opt out of Google Analytics with Google’s browser add-on.

Security

Undercart is served over HTTPS. API keys and connector tokens are stored only as one-way hashes. Access to production data is limited to the people who operate Undercart.

Children

Undercart is a business tool. It is not directed to children under 13, and we do not knowingly collect their personal data.

Where data is processed

Undercart’s servers and database are in the United States. Our service providers may process data in other countries.

Changes

When we change this policy we update the date above. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.

Contact

For privacy questions or requests, contact hello@undercart.co. See also our Terms of Service and Support page.