GDPR and CCPA Compliance
ArrayCart supports privacy rights for website, signup, newsletter, support, checkout and subscription data, and processes tenant business data as a processor on the tenant's instructions.
- No sale of personal data
- Rights requests by email
- Tracking practices disclosed
- Covered laws
- GDPR, UK GDPR, CCPA/CPRA
- Response target
- Within 30 days
- Effective date
- April 10, 2026
- Last reviewed
- July 19, 2026
What this page covers
This page explains how ArrayCart handles privacy rights and regional privacy controls for personal data processed through the ArrayCart website and platform, including signup, newsletter, support, contact, checkout, payment, subscription, refund and account workflows.
Tenant business data is processed on the tenant's instructions
For the business data a tenant enters into ArrayCart, such as employee, customer, order, inventory, accounting and message records, ArrayCart acts as a processor and handles that data only on the tenant's instructions, with each workspace isolated. The tenant is the controller for that data and remains responsible for GDPR, UK GDPR, CCPA/CPRA and other privacy obligations toward the individuals it concerns.
Rights you can request
| Right | What it means |
|---|---|
| Access | Ask what personal data ArrayCart holds about you. |
| Correction | Ask ArrayCart to correct inaccurate personal data. |
| Deletion | Ask ArrayCart to delete personal data where deletion is legally available. |
| Restriction | Ask ArrayCart to limit processing where applicable. |
| Portability | Ask for a copy of data in a portable format where applicable. |
| Objection | Object to processing based on legitimate interests where applicable. |
| Withdraw consent | Withdraw newsletter consent by unsubscribing. Website tracking can be controlled through browser and provider account settings. |
| Opt out of sale or sharing | Use browser controls and Meta advertising preferences to limit tracking and personalized advertising. |
How to make a request
- Email [email protected].
- Use the email address connected to your signup, newsletter, support, contact, checkout or subscription record.
- Include the right you want to exercise.
- For payment or subscription requests, include the order number or invoice number if available.
- Do not send passwords, full card numbers, secret keys, customer exports or unnecessary business data.
ArrayCart may need to verify your identity before completing a request. We respond within 30 days unless a legally permitted extension applies.
Sale and advertising measurement
ArrayCart does not sell personal data. GA4 and Meta Pixel load automatically on website visits. Meta Pixel records page and waitlist-conversion events for Meta ad attribution and campaign measurement. ArrayCart does not use heatmaps or session recordings.
| Practice | ArrayCart position |
|---|---|
| Sale of personal data | No. |
| Advertising measurement | Meta Pixel loads automatically on website visits. |
| Tracking controls | Available through browser settings and Meta advertising preferences. |
| Sensitive personal information use beyond necessary purposes | No. |
| Discrimination for exercising rights | No. |
Lawful bases and consent
| Processing | Basis or control |
|---|---|
| Signup, support and contact forms | Contract or pre-contractual steps. |
| Providing the platform and processing tenant business data | Contract and processor instructions. |
| Newsletter | Consent, with unsubscribe available. |
| GA4/GTM analytics | Legitimate interests in website measurement and improvement. |
| Meta Pixel advertising measurement | Legitimate interests in ad attribution and campaign measurement. |
| Payment provider payments, subscriptions and tax records | Contract and legal obligation. |
| Security logs, audit trails and abuse prevention | Legitimate interests. |
Providers and international transfers
ArrayCart uses Google Analytics 4, Meta Pixel, a third-party payment provider and hosting providers. These providers may process data in countries outside your own. Provider privacy, security and transfer mechanisms apply to their processing.
- GDPR rights reference: European Data Protection Board guide.
- CCPA reference: California Attorney General CCPA page.
Controller and processor roles
ArrayCart website and account data
ArrayCart is the controller for personal data collected through its own website, signup, newsletter, support, contact, checkout, subscription, refund and platform account workflows.
Tenant business data
A tenant using ArrayCart is the controller for the business data it enters into the platform, such as employee, customer and order records. ArrayCart acts as a processor for that data, handling it only on the tenant's instructions and keeping each workspace's data isolated.
Contact
Privacy rights requests should be sent to [email protected]. Put "Privacy rights request" in the subject line.
Email privacy rights requestRelated policies
Each page covers one part of how ArrayCart handles privacy, payments, subscriptions, refunds, and accessibility.
Privacy Policy
What the ArrayCart website collects, why it is used, cookie consent behavior, and how to exercise privacy rights.
Read policyData Safety
How website data, payment data, and per-tenant workspace data are separated.
Read policyRefund Policy
The 60-day ArrayCart subscription refund guarantee and how refund requests are handled.
Read policyNeed help with a privacy rights request?
Email ArrayCart. We route rights requests, refund questions, and accessibility reports to the right place.