Privacy Policy

Last updated: 18 October 2026

ConvoCart is run by Rich Jackson from 11816 Inwood Rd #1295, Dallas, TX 75244, with customers across Australia. The legal entity is R P JACKSON LTD, company number 13224794, registered in England and Wales. In this policy, “ConvoCart”, “we”, “us” and “our” mean R P JACKSON LTD trading as ConvoCart. You can contact us by email at richard@convocart.co, by post at the registered office above, by phone on 01329 722036, or by messaging the chat on convocart.co or @convo.cart on Instagram or Facebook.

Who is responsible for your data

If you run a shop on ConvoCart, R P Jackson Ltd is the controller of your account details. If you are a customer of a shop that uses ConvoCart, that shop is the controller of your details, and R P Jackson Ltd processes them on the shop's behalf under a data processing agreement with the shop. To use your data rights, contact the shop, or email richard@convocart.co and I will pass your request on.

What we collect

From sellers: your name, email, phone number, business name, the social accounts you connect, your product list and prices, your orders, and billing metadata. We never see or store full card numbers; payments are handled by Stripe.

From your customers (buyers): the content of messages and comments sent to a ConvoCart shop, and the details a buyer shares to complete an order, such as name, delivery address, email and phone number. We also receive the buyer's public profile name and the Meta-scoped user ID that Facebook or Instagram provides.

Technical: server logs and diagnostic records needed to keep the service secure and working.

Remembering customers

Unless a shop switches it off, ConvoCart remembers a customer's past orders with that shop so it can offer their usual, and anything the customer asks the shop to remember, such as a size or scent they prefer, or a reminder before a gift occasion. Reminders are only sent if the customer said yes, by email, and every one has a link to stop them. It never keeps health, allergy, religious, political or financial details. A customer can ask the shop to forget them at any time, just by saying so in the chat, and reminders and offers stop straight away. Remembered details are deleted after 18 months without an order. Order records themselves are kept as the shop's business records.

How we use it

To run your shop: replying to messages and comments, taking orders, creating invoices, sending receipts and payment reminders. Our lawful basis is our contract with you. We also process limited data for security, fraud prevention and service improvement under legitimate interests, and we will only send you marketing with your consent.

Data from Facebook and Instagram

To provide the messaging experience we receive data through the Facebook and Instagram platforms, including the messages and comments people send to a shop and their Meta-scoped identifiers. We use this data only to hold the ordering conversation and complete the order the person is asking for, on behalf of the connected shop. We do not sell it, we do not use it for advertising, and we do not use it to build profiles unrelated to the order. Our use of data received through the Facebook and Instagram platforms complies with the Meta Platform Terms and Developer Policies. You can end our access at any time by removing the connection or by requesting deletion, as set out under “Deleting your data” below.

Automated processing

Messages that pass through a ConvoCart shop are processed by Anthropic, whose technology writes the shop's replies. This data is not used to train third-party models. We do not sell message content and we do not share one seller's data with another.

Who we share data with

Service providers who help us run ConvoCart: Stripe for payments, Meta platforms for Instagram and Facebook messaging, Anthropic for writing replies, Railway for hosting the service (United States), Supabase for the database (hosted in the United Kingdom), Google for email, Twilio for text messages where a shop turns them on, and Cloudflare for web addresses and traffic. Each acts under contract and only processes what is needed. We do not sell personal data.

Shops that need a written data processing agreement can email richard@convocart.co and I will send one the same day.

International transfers

Some providers process data outside the UK. Where that happens we rely on recognised safeguards such as adequacy decisions and standard contractual clauses.

How long we keep it

Account data while your account is active. Order and invoice records for up to six years to meet tax and accounting law. Message history while your shop is active; you can ask us to delete it sooner.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, restrict or object to processing, and receive your data in a portable format. To exercise these rights, email richard@convocart.co, or message the chat on convocart.co or DM @convo.cart on Instagram or Facebook, and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Deleting your data

You can ask us to delete your data at any time. Full instructions are at convocart.co/data-deletion. In short: buyers can reply DELETE in the chat with a shop or email richard@convocart.co; sellers can email us or use the delete option in the dashboard. We action deletion within 30 days, keeping only records the law requires us to retain.

Buyers of ConvoCart shops

If you message a shop powered by ConvoCart, the shop is your seller. We process your messages and order details on the shop's behalf so it can serve you. For questions about your order, contact the shop; for questions about your data, email richard@convocart.co or message the chat on convocart.co or DM @convo.cart on Instagram or Facebook.

Measuring our ads

This website uses the Meta pixel and the Google Ads tag to understand which of our ads lead people to try ConvoCart, so I can spend less on ads that do not work. It records visits and button taps on this website. You can control ad tracking in your Facebook and Instagram ad settings. I also keep a simple count of visits and button taps on this website, so I can see which parts of the page help. That count does not store your name, email address or IP address.

Cookies

This website uses essential cookies and the Meta pixel and Google Ads tag described above.

Changes

If we make material changes to this policy we will update this page and tell sellers by email.

Contact

R P JACKSON LTD trading as ConvoCart, 11816 Inwood Rd #1295, Dallas, TX 75244. Email richard@convocart.co.