Privacy Policy

Last updated: 28 August 2026

Green Cart Carbon ("the App", "we") is a Shopify application operated by SEEDVISION SARL, a French limited liability company (SARL) registered under 103 159 596 R.C.S. Nantes, VAT FR09103159596, with its registered office in Nantes, France. SEEDVISION SARL publishes the App and the website seedvision.fr. The App is hosted at greencartcheckout.com.

This Privacy Policy explains what personal data we collect when merchants install the App and when their customers complete a checkout with a climate contribution. It applies to both groups. A French version is available at Politique de confidentialité.

1. Data we collect

1.1 From merchants (Shopify and WooCommerce store owners)

When a merchant installs the App via the Shopify OAuth flow, Shopify provides us with:

• Shop domain (e.g. your-store.myshopify.com) and Shop ID
• OAuth access token (stored encrypted), scoped to the permissions the merchant explicitly granted
• Granted permission scopes
• Stripe customer ID if the merchant subscribes to a paid plan
• Merchant contact email if provided during setup
• App configuration: contribution price, planting project, language

1.2 From end customers (shoppers of merchant stores)

When a customer's order includes a climate contribution, Shopify's orders/paid webhook delivers to us strictly what is required to issue the certificate:

• Order ID and order number on the merchant's store
• Customer email — used solely to deliver the PDF certificate
• Customer first name, when the store provides it — used solely to make the certificate nominative. It is held for the time it takes to generate and send that certificate and is not written to our database.
• Amount contributed and number of trees
• Certificate serial number generated by us

We do not receive or store postal address, phone number, payment details, IP address, or any cross-session tracking identifiers.

1.3 Technical data

Standard request metadata (timestamp, path, status, user agent) is logged for security and operations for a maximum of 30 days, without personal identifiers.

2. How we use this data

• Authenticate API calls to the merchant's Shopify or WooCommerce store
• Create and maintain the hidden contribution product used to collect the amount at checkout
• Process paid-order webhooks, request the planting from our operator, and issue the certificate
• Send the PDF certificate by email to the customer
• Display impact metrics in the merchant's admin dashboard
• Bill the merchant for the platform fee via Stripe

We do not sell or rent personal data, profile customers across stores, or share data with advertisers or analytics platforms.

3. Data sharing

We share limited data only with the following operational third parties:

• Shopify — platform the App runs on; we exchange merchant authorization and order data through its official APIs
• Stripe — payment processor for the merchant platform fee; receives merchant billing details directly, we only hold a customer ID reference
• Email service provider — receives the customer email address and PDF to deliver the certificate
• Planting operator (DigitalHumani) — receives the shop domain and the number of trees, nothing else. No customer name, email, or order content is sent to it.

4. Data retention

• Merchant data: retained while the App is installed. On uninstall (app/uninstalled webhook), we invalidate the access token immediately. Shop record kept up to 7 years for accounting/legal compliance.
• What stays in your Shopify store: the « Climate contribution » product belongs to your store, not to the App. It must stay published for the contribution to be addable to the cart, and it is hidden from your storefront by a script. Uninstalling removes that script but not the product, and once the App is uninstalled its access is revoked, so we can no longer clean it up. Use « Archive the product » on the setup page before uninstalling, or archive the product yourself from Products in your Shopify admin afterwards. Past orders are unaffected.
• Customer email: removed from records 30 days after issuance of the certificate.
• Certificate metadata: 7 years, for planting traceability and accounting.
• Technical logs: 30 days maximum.

5. Your rights (GDPR & French Data Protection Act)

• Right of access, rectification, erasure, restriction, portability, and objection
• Right to lodge a complaint with the CNIL — cnil.fr
• Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact) are implemented and operational
• All requests answered within 30 days as required by the GDPR

Customers of merchant stores may exercise these rights through us or through the merchant.

6. International transfers

Data is processed on EU servers. Where third-party processors operate outside the EU (Shopify, Stripe), transfers occur under Standard Contractual Clauses approved by the European Commission.

7. Security

• HTTPS/TLS encryption for all data in transit
• Encrypted database storage for OAuth access tokens
• HMAC-signed verification on all incoming webhooks
• CSP frame-ancestors on the embedded admin app
• Regular security audits and dependency updates

In case of a personal data breach affecting your data, we notify the CNIL within 72 hours and inform affected parties without undue delay (GDPR Art. 33).

8. Children's privacy

The App is a B2B service for Shopify and WooCommerce merchants and is not directed at children under 16. We do not knowingly collect personal data from children.

9. Contact

10. Updates to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will be revised. For substantive changes, installed merchants will be notified via the App's admin dashboard at least 30 days before the changes take effect.

Green Cart Carbon is a product of SEEDVISION SARL — seedvision.fr. See also our pricing page.