← Back to CodeCorrect

Privacy Policy

Last updated 14 October 2026

This Privacy Policy explains how CartBooster Limited processes personal data through the CodeCorrect service and the codecorrect.app website, why we process it, and the rights available to individuals.

1. Who we are

CodeCorrect is a product of CartBooster Limited, company number 13969401, registered at 13 Freeland Park Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA, United Kingdom ("CartBooster", "we", "us").

For privacy-related enquiries, contact support@cartbooster.io.

2. What this Privacy Policy covers

This policy covers two separate situations.

If you are a shopper and wish to exercise your privacy rights in relation to a purchase or checkout session, please contact the merchant directly.

3. Website visitors

What we collect

If you use the contact form on codecorrect.app, we may collect:

The contact form is provided through Formspree, which delivers the submitted information to us.

Why we process this information

We process this information to:

Our legal basis is our legitimate interest in responding to business enquiries and, where applicable, taking steps at your request before entering into a contract.

Retention

Enquiries that do not result in a commercial relationship are retained only for as long as reasonably necessary to handle the enquiry and any related follow-up.

Where an enquiry results in a customer relationship, relevant correspondence may be retained for the duration of the agreement and afterwards where required by applicable legal, accounting or contractual obligations.

4. The CodeCorrect app in Shopify checkout

CodeCorrect is designed to respond when a shopper enters a discount code that Shopify rejects. When this happens, CodeCorrect may display an alternative offer configured by the merchant.

To provide this functionality, CodeCorrect may process:

This information is used to identify the correct merchant campaign, connect the discount-code event with the relevant checkout session, display an appropriate offer and measure campaign performance.

What CodeCorrect does not process. CodeCorrect does not intentionally collect or process:

  • customer names
  • customer email addresses
  • shipping addresses
  • billing addresses
  • phone numbers
  • payment card information
  • payment credentials
  • customer account records

CodeCorrect does not require shoppers to provide personal information directly to CartBooster.

Some technical identifiers used by CodeCorrect may nevertheless constitute personal data because they can potentially be linked to an identifiable individual when combined with information held by the merchant. We therefore treat such identifiers as personal data.

Consent and the discount-session cookie

CodeCorrect analytics runs only with analytics consent and stops when that consent is withdrawn. Marketing consent or consent to the sale of data is not required for the automatic discount functionality.

The functional cookie cc_discount_session contains a random session identifier used to maintain discount sessions and enforce offer limits. It expires 48 hours after its last refresh. Without analytics consent, it is created when a discount code is rejected, rather than during ordinary navigation. We treat this cookie and the automatic discount functionality as essential to providing the discount service. See our Cookie Policy for details.

5. Our role and legal basis

When CodeCorrect processes checkout-related data on behalf of a merchant, we do so as the merchant's data processor and in accordance with the merchant's documented instructions and applicable data protection law.

The merchant determines the appropriate legal basis for processing customer data and describes that processing in its own privacy notice.

6. Data retention and deletion

Checkout, session, offer-history and related customer-level analytics records have a 90-day retention period, with automatic daily cleanup. Merchant configuration and unused coupon inventory are separate from this customer-history cleanup.

Better Stack retains operational logs for 3 days and operational metrics for 30 days.

Privacy requests and deletion protection

Shopify privacy requests trigger deletion of matching checkout and offer records and related events, and removal of customer links from coupon records. Requests needing clarification are flagged for manual handling.

We retain restricted, pseudonymous deletion markers for 180 days to prevent deleted records from being recreated by delayed events or restored backups. These markers are held in a separate deletion-protection register.

Backups and recovery

PostgreSQL recovery history lasts 7 days. Firestore has 7-day point-in-time recovery and weekly backups retained for 98 days.

Deletion from active systems does not immediately erase historical backup copies. Those copies expire under these schedules. Restored systems must remain isolated until required deletion cleanup and checks are complete.

7. Sub-processors

CartBooster uses selected third-party service providers to operate CodeCorrect and the codecorrect.app website. These may include:

Where required, we enter into appropriate data protection agreements with service providers that process personal data on our behalf.

Merchants will be informed where required before material changes are made to sub-processors handling checkout-related personal data.

8. International data transfers

Although our backend and main checkout database are hosted in the Netherlands and the Google storage described above is in the EU, not all processing takes place exclusively in the EU. Cloudflare handles traffic and security through its global network.

Where personal data is transferred to a country without an adequacy decision, we use appropriate safeguards as required by applicable data protection law, which may include the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.

9. Security

We use appropriate technical and organisational measures designed to protect personal data. These measures include:

No internet-based service can guarantee absolute security, but we regularly review the measures used to protect the systems we operate.

10. Your rights

Depending on applicable data protection law, you may have rights including:

If you are a shopper using a merchant's Shopify store, please contact that merchant first. The merchant acts as the data controller and will instruct us where necessary.

You may also request access to or deletion of your data by contacting support@cartbooster.io. Please identify the relevant store and describe your request so we can locate the appropriate records and coordinate with the merchant. Requests requiring clarification are handled manually. Do not send payment details or passwords.

You may also lodge a complaint with your applicable data protection authority. For individuals in the United Kingdom, this is the Information Commissioner's Office (ICO). For individuals in Norway, this is Datatilsynet.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to CodeCorrect, applicable law or our data-processing practices. When we make changes, we will update the "Last updated" date at the top of this page. Where required, material changes affecting merchants will also be communicated directly.

12. Contact

CartBooster Limited
Company number: 13969401
13 Freeland Park Wareham Road
Lytchett Matravers
Poole
England
BH16 6FA
United Kingdom
support@cartbooster.io