Effective Date: June 2026
Cart.com, Inc. is committed to the responsible collection, use and care of the personal data of its customers and website users. This Global Privacy Notice for customers and website users (“Privacy Notice”) provides information on our practices for collecting, using, maintaining, and disclosing information we may collect from you or that you may provide when you use or access our services, including websites, products, mobile applications, or other sites that display this Privacy Notice or otherwise engage with us (the “Services”).
If you are in a jurisdiction that recognizes the concept of a data controller, the data controller is Cart.com, Inc.. If you have a query about how your personal data is being used, you can contact the data controller at DPO@cart.com.
Please read this Privacy Notice carefully. If any term in this Privacy Notice is unacceptable to you, please do not use our Services or provide us with any personal data.
This Privacy Notice does not apply to any products, services, websites, mobile applications, or content (including advertising) offered by third parties or that may be linked to or from the Services. Data collected by these third parties is covered by their own privacy policies.
Depending on your relationship with us, we may collect, process, disclose, and maintain your personal data in a number of ways including, but not limited to: when you access or use our Services, such as by visiting our websites, and branded pages and applications; register an account with us and/or purchase products our products; communicate with us including through messaging platforms such as text message, live chat, social media, and email or otherwise provide us with information including via direct marketing campaigns, sweepstakes and competitions; or submit a review regarding our Services.
The categories of personal data we collect may include:
Similar to many companies, when you interact with our Services, including websites and applications, we may use automatic data collection technologies to collect and log certain information about your equipment, browsing actions and patterns, and network activity. Such information may include: your unique device identifier, device model and manufacturer, domain name, browser type and version, browsing history, search history, information about your visit to our website or application (including products viewed, purchased or search for), details of any website which has referred you to our website, application, or advertisement, location and time zone setting, browser plug-types and versions, operating system and platform, page responses times and errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, keystrokes typed, and mouseovers), the amount of time you spend viewing or using the our website or application and the pages visited, the number of times you return, or other click-stream or site usage data and mouseovers) and methods used to browse away from the page. If you are using our mobile application, we may also collect location-based information from your mobile device.
The technologies we use for automatic data collection include browser cookies, flash cookies, web beacons, pixels, and software development tools (collectively, “Cookies”). Cookies are small text files that are stored by your web browser when you visit a website. We may store Cookies on your device when you use our Services. These technologies help us speed up your future activities and improve your experience by remembering the information that you have already provided to us. Third parties operating on our behalf may also use these technologies to provide us with information regarding your use of our Services, as well as to help us manage and display advertisements, tailor advertisements to your interests, or send abandoned shopping cart reminders (depending on your communication preferences). You may block or delete these technologies from your device. However, by disabling such technologies, you may not have access to the entire set of features of our Services. For more information about these technologies, including links to web browser instructions for disabling and managing such technologies, visit https://optout.networkadvertising.org/.
Specific information about how we use such technologies and how you can manage our use of certain Cookies is set out in our Cookie Notice.
Please note that where the placement of Cookies involves the processing of personal data, the legal basis for processing personal data in connection with strictly necessary Cookies is our legitimate interest in the functioning of our Services. For the processing of personal data in connection with other Cookies, including performance Cookies and targeting Cookies, we obtain your consent where required by applicable law. You can revoke your consent at any time by visiting our cookie management tool available on our Services and changing your preferences.
We may share your information with Google Analytics to track and analyze the use of the Services. Access by U.S. authorities to the data stored by Google cannot be ruled out. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You may also manage our use of analytics cookies by visiting our cookie management tool here. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.
We may receive your personal data from other sources, including our business and promotional partners such as in connection with our loyalty or rewards program, social media platforms, or individuals who purchase goods or services to be delivered to you (such as gifts or gift cards). We also may obtain information you have made publicly available, including from websites and online services you use, consumer research platforms, and/or business contact databases.
We process your personal data for a variety of reasons, depending on how you interact with our Services, including for legitimate business and commercial purposes and in accordance with the legal bases further described in Section 3. In particular, we may use your personal data:
We process your personal data on the following legal basis:
We may disclose your personal data as follows and as otherwise described in this Privacy Notice:
We may also process and disclose information to third parties if the information has been de-identified or aggregated in a way so it cannot be used to identify you.
We store your personal data processed for the purposes stated in this Privacy Notice and for the duration of our business relationship with you. Once our business relationship with you has ended and your data is no longer required for these purposes, we will delete your data, unless your data is required also for other purposes set out in this Privacy Notice, and/or is necessary to fulfil applicable legal or regulatory obligations. When determining the retention period, we take into account criteria, such as the type of services requested by or provided to you, the nature and length of our relationship with you, use of our Services, and the impact on the functionality of the Services if we delete your personal data.
We may also transfer your personal data from your country or jurisdiction to other countries or jurisdictions in accordance with this Privacy Notice and applicable law.
We implement appropriate and reasonable technical, physical, and organizational measures designed to protect the security of any personal data we process and comply with applicable law. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best to protect your personal data, transmission of personal data to and from our Services is at your own risk. You should only access the Services within a secure environment.
Our Services are designed and intended for adults. However, due to the nature of our Services, we may collect certain information about children under the age of majority in their state or country of residence. In such cases, our collection and processing of information about children will be based on consent from a parent or guardian in accordance with the applicable law. If you learn that a child has, in violation of this Privacy Notice, registered for email newsletters, or otherwise provided their personal data, please report it to us using the contact information provided in Section 13. If we become aware that a child has provided personal data without parental or guardian permission, we will terminate that account and delete all personal data provided by that individual to the extent feasible and as soon as practicable. Depending on the country you are based, we may use your personal data to carry out age verification checks and enforce any such age restrictions.
You can unsubscribe from our marketing and promotional communications emails at any time by clicking on the unsubscribe link in the marketing and promotional emails that we send . Please note that if you opt out of marketing communications, we may still contact you with non-promotional communications, such as those about ongoing business relations or administrative messages (e.g., updates on online orders).
You can unsubscribe from our marketing and promotional SMS messages by texting “STOP” or similar revocation language as permitted under applicable law to the short code or phone number from which the promotional SMS messages are sent. After you send the SMS opt-out message to us, we will send you an SMS message to confirm that you have been unsubscribed from our promotional SMS messages.
If you have permitted one of our mobile applications to send you push notifications or alerts, you can deactivate these messages at any time in the notification settings on your mobile device.
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.
Our Services may contain content, services, advertising, and materials that link to external websites. We do not endorse and are not responsible for the content of any such external website. Please refer to the terms and conditions and privacy policies of the external website for more information.
We may update this Privacy Notice periodically and will revise the date at the top of the Privacy Notice to reflect the date when such update occurred. Continued use of the Services after such change constitutes acceptance of the new Privacy Notice. We encourage you to periodically review this page for the latest information on our privacy practices.
If you have any questions or comments about this Privacy Notice or our data collection and processing practices more generally, you may contact us at:
morservices@cart.comWe may offer you various incentives, including special offers, discounts, rewards, and coupons pursuant to certain rewards and loyalty programs (each, a “Rewards Program”), throughout the year for providing us with your personal information. Categories of personal information that may be collected pursuant to a Rewards Program, include, but are not limited to, identifiers (e.g., name, date of birth, phone number, Rewards Program account information, and a valid email address), financial information (e.g., credit card number or other payment information), commercial information (e.g., payment receipts), internet or other electronic network activity information (e.g., browsing history or search history on the Services), and geolocation data.
We may disclose the personal information collected pursuant to the Rewards Program to the categories of third parties listed in Section 4 “How We Disclose and Share Your Information” including Rewards Program partners such as Yotpo. We do not disclose personal information collected in connection with a Rewards Program to data brokers. We may also sell and/or process and share this information (as those terms are defined by applicable law) with third parties for targeted advertising purposes.
We do not assign a monetary value to the data we collect, but based on a good-faith estimate, we believe the value received from your personal information is reasonably equal to the value of the benefit we offer you pursuant to a Rewards Program. This estimate is not specific to any specific individual who participates in a Rewards Program (a “Member”) and may vary by Member. We have calculated such value by taking into consideration, without limitation, relevant factors related to the estimated value of such information to us, as set forth under California Law (and defined below).
If eligible, you may opt in to a Rewards Program by following the instructions set forth in a Rewards Program’s terms and conditions and, if applicable, by creating a member account on the Rewards Program’s website. Material terms of participating in a Rewards Program, including all terms and conditions concerning the collection, use, and retention of a Member’s personal information, are set forth in the applicable terms and conditions, this Privacy Notice, and/or our Terms and Conditions and should be carefully reviewed prior to participation in a Rewards Program.
You have the right to cancel your membership and participation in a Rewards Program at any time. To opt out of a Rewards Program, including the receipt of marketing emails provided pursuant to your status as a Member of a Rewards Program, please follow the instructions set forth in the Rewards Program’s applicable terms and conditions or contact us via the methods described in Section 13 “How to Contact Us.” Please note, exercising your right to delete personal information pursuant to applicable law (and as described in this Privacy Notice), may impact our ability to provide you with some or all aspects of a Rewards Program because we will no longer be able to associate you with any points, rewards, or other events, promotions, or offers provided via the Rewards Program.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (Civil Code Section 1798.100, et seq.) (“California Law”), provides eligible California residents with specific rights with respect to our collection, retention, disclosure, selling, sharing, and use of personal data, also known as personal information. This section on Additional Information for Residents of California supplements this Privacy Notice and applies solely to eligible residents of the State of California. Any terms used but not defined in this section have the same meaning as defined in California Law.
In the preceding twelve (12) months, we may have collected the categories of personal information from the sources discussed in Section 1 “Information Collection Practices.” The business or commercial purpose for collecting that information is disclosed in Section 2 “How We Use Your Information.”
In the preceding twelve (12) months, we may have disclosed your personal information for a business or commercial purpose described in Section 2 “How We Use Your Information” to the third parties described in Section 4 “How We Disclose and Share Your Information.”
Please note that we only use and disclose sensitive personal information as permitted under California Law and without the purpose of inferring characteristics about a consumer.
| Category | Business or Commercial Purpose | Categories of Third Parties to Whom Personal Information was Disclosed That May be Considered a “Sale”/“Sharing” Under California Law |
|---|---|---|
| Identifiers. | To provide you with personal advertising and content | Advertisers and advertising networks |
| Internet or other similar network activity. | To provide you with personal advertising and content | Advertisers and advertising networks |
We do not knowingly sell or share the personal information of consumers under 16 years of age.
California Law provides eligible residents with specific rights regarding their personal information. The following section describes your California Law rights and explains how to exercise those rights. Your California Law rights include the:
To exercise these rights, you can contact us by:
We may require you to prove your identity to exercise certain rights. Depending on your request, we may ask for information such as your name, telephone number, email address, and/or date of last communication with us. We may also ask you to provide a signed declaration confirming your identity. We will only use personal information provided in your consumer request to verify your identity or authority to make the request.
Only you, your parent, guardian (if you are under 13 years or age), conservator, a person to whom you have given power of attorney, or an authorized agent may make a verifiable consumer request related to your personal information. You may, however, make a verifiable consumer request on behalf of your minor child if necessary. Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized representative. We cannot respond to your request if we cannot verify your identity or authority to make the request. You may only make a verifiable consumer request for your right to access twice within a 12-month period.
California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in Section 13 “How to Contact Us.”
Eligible residents of states in which there is a comprehensive privacy law in effect, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, also have rights with respect to the personal data that we collect about them. This section supplements this Privacy Notice and applies solely to eligible residents of U.S. states with applicable comprehensive privacy laws in effect to the extent Cart.com, Inc. is subject to those laws. Any terms not defined in this section have the same meaning as defined under applicable law. Subject to certain exceptions, if you are an eligible resident of one of these states with laws that apply to Cart.com, Inc., you have certain privacy rights which may include, depending on your state of residency:
The exact scope of these rights may vary by state. You do not need to create an account with us to exercise your state privacy law rights. To exercise the rights described in this Section, including your opt-out rights, please submit a consumer request to us by:
If you are a resident of the EEA/UK (or if the GDPR or the UK GDPR are otherwise applicable to you), this Section describes our practices and your rights under the GDPR und the UK GDPR, whereby references to the GDPR in this section include the UK GDPR. This Section provides rights and other terms relating to your personal data that are in addition to those provided in this Privacy Notice. These additional rights and other terms are only available to EEA/UK residents (or individuals to whom the GDPR is otherwise applicable) whose personal data we are processing.
The following table summarizes our processing of your personal data as described in as further described in this Privacy Notice.
| Processing Purpose(s) | Data Categories | Legal Basis |
|---|---|---|
| To provide the Services | Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data | Performance of a contract or consent (if required under applicable law) |
| To facilitate account creation, authentication, and administration | Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity | Performance of a contract |
| To fulfill and manage your orders, payments, returns, and exchanges made through the Services | Basic identifiers and personal details, financial information, commercial information | Performance of a contract |
| To assist with the registration and provision of any contests or promotions | Basic identifiers and personal details, financial information, commercial information | Performance of a contract |
| To respond to inquiries, provide customer support, and communicate with you | Basic identifiers and personal details, communication data, views and opinions | Performance of a contract |
| To notify you of changes to our products or services, or changes to regulatory requirements that may affect our products or services | Basic identifiers and personal details | Performance of a contract |
| To send you marketing and promotional communications | Basic identifiers and personal details | Consent |
| To perform our duties in the context of our commercial or business relationship with you | Basic identifiers and personal details, commercial information | Performance of a contract |
| To improve and manage our Services and your user experience | Basic identifiers and personal details, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data | Consent or legitimate interest in improving our Services |
| To comply with our legal obligations, respond to legal requests, and exercise, establish or defend our legal rights | Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data | Comply with our legal obligations |
| To maintain the safety, security, and integrity of our Services | Basic identifiers and personal details, internet or other similar network activity | Consent or legitimate interest in maintaining our Services |
| Strictly necessary cookies | Internet or other similar network activity | Legitimate interest in providing our Services as requested by you |
| Non-strictly necessary cookies | Basic identifiers and personal details, internet or other similar network activity | Consent |
| For any other purpose with your consent | Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data | Consent |
If you are a resident of the EEA/UK (or if the GDPR or the UK GDPR are otherwise applicable to you), subject to certain exceptions, you have certain rights regarding the personal data we hold about you.
If you would like to exercise or discuss any of these rights, please contact us as set forth in Section 13 “How to Contact Us” above.
If you are unsatisfied with our handling of personal data, you also have the right to lodge a complaint with the competent data protection authority. A list of the relevant data protection authorities can be found here.
To the extent you are located in a non-U.S. jurisdiction with laws that are applicable to Cart.com, Inc., including Mexico and Canada, this Section shall apply to you.
As provided in this Privacy Notice, Cart.com, Inc. may share your personal data with third parties to provide the Services or as otherwise described herein. Please note that some of these third parties may be located outside of your country of residence or location and therefore, your personal information may be transferred abroad. For further information regarding our data processing and disclosure practices, please see “How We Use Your Information” and “How We Disclose and Share Your Information” above.
Depending on your location or country of residence, and subject to certain exceptions and limitations, you have may certain rights regarding the processing of your personal data under applicable law, including the right to:
While we encourage you to get in contact with us first to try and resolve your concerns, you may also have the right to file a complaint regarding our data protection practices with a supervisory authority/privacy regulator in your country/province of residence.
To exercise any of the above-mentioned rights, please contact our Data Protection Officer using the contact information provided in “How to Contact Us” above. Please note, in order to comply with applicable law, prior to fulfilling your request, we may require you to provide additional information and documentation including information necessary to verify your identity.
