Privacy Policy

This policy explains what OnlyCarts collects from consolidators (the businesses that sign up and run a group-buy) and their customers (the people who submit carts through a consolidator's shop link), and what we do with it. It doesn't cover SHEIN's own handling of data on their platform — that's governed by SHEIN's own privacy policy.

From consolidators:business name, email address, and password (or, if you sign up with Google, your Google account's name and email — we never see your Google password). We also store your chosen client-link slug and subscription/payment status.

From customers: a name and WhatsApp number, submitted directly to the consolidator whose link they used. We also store the cart items they submit — titles, images, and prices pulled from SHEIN links they paste in — and any proof-of-payment image they upload.

Item photos:if a customer uploads a screenshot or photo to search for an item, that image is uploaded to SHEIN to find matching products, and is stored on SHEIN's servers as part of how their image search works. We strip location and camera metadata from it first, and we don't keep a copy ourselves — only the item a customer picks from the results is saved to their cart. Don't upload photos you wouldn't want SHEIN to hold.

Automatically:basic product-usage analytics (pages visited, signup/login events) via PostHog, so we can see where people get stuck and fix it. We don't sell this data or share it with advertisers.

We never collect or store payment card numbers, bank account numbers, or mobile money PINs. Payment for SHEIN orders happens directly between a consolidator and their customer, outside the platform; subscription payments to OnlyCarts are confirmed manually from a proof-of-payment image, not processed by us.

We use this data to run the service: showing consolidators their own customers' orders, sending confirmation and password-reset emails, sending WhatsApp order updates, pulling real prices from SHEIN links, and improving the product based on aggregate usage patterns. A consolidator can only ever see their own customers' data — never another consolidator's.

We use a small number of third-party services to run OnlyCarts, each only for the purpose below:

• Supabase — hosts our database and handles authentication.
• Resend — delivers signup, confirmation, and password-reset emails.
• PostHog — product analytics (EU-hosted), covered above.
• Google — only if you choose "Continue with Google" to sign in.
• WhatsApp — used only as a messaging channel to deliver order updates; we don't share stored data with Meta beyond the message content itself.
• SHEIN — receives item photos a customer uploads to search by image, and the links they paste in, so real prices and matching products can be looked up. No name, number, or order data is sent with them.

We don't sell personal data to anyone, and we don't share it with advertisers.

We use a session cookie to keep consolidators logged in, and PostHog sets its own cookies/local storage to recognize repeat visits for analytics. We don't use third-party advertising or tracking cookies.

We keep account and order data for as long as an account is active, plus a reasonable period after in case it needs to be restored. A consolidator can request deletion of their account and associated customer data at any time by contacting us below — we'll delete it unless we're required to keep records for a legal or accounting reason.

OnlyCarts is a business tool for group-buy consolidators and isn't directed at children. We don't knowingly collect data from anyone under 18.

We may update this policy from time to time; the "last updated" date at the top reflects the most recent change. Continuing to use OnlyCarts after an update means you accept the revised policy.

Questions about your data, or want something deleted? Reach us at onlycarts4@gmail.com or +260 968 332 100.