Legal

Privacy Policy

Last updated 28 August 2026

Who processes your data

The controller of personal data collected through this service is Live-cart. Full registration details are set out in the Public Offer.

For anything concerning personal data, write to [email protected].

Two roles: seller and buyer

Live-cart deals with two different groups of people, and our role differs for each.

The seller registers an account and uses the dashboard. For their data, we are the controller.
The buyer places an order on a shop page. The seller is the controller of that data; we act as a processor, handling it on the seller’s instructions so the page and the checkout work.

In practice: if you ordered from a shop running on Live-cart and want your data deleted, contact that shop first. We cannot decide the fate of another business’s orders on our own, but we will pass your request to the seller and help technically.

Seller data

When you register and use the dashboard we collect:

first and last name — how we address you in the dashboard and in email;
email address — sign-in, email verification, password reset, invoices and payment reminders;
phone number — a contact point for your account;
password — stored only as an Argon2id cryptographic hash. We do not store and cannot recover your password;
sign-in session records — a hash of the session token, and its creation and expiry times;
interface preferences — language and colour theme;
shop data you enter yourself: name, description, logo, contacts, products, prices, and the access keys for services you connect. Those keys are stored encrypted and are never displayed again.

Buyer data

Buyers do not register. We process only what they enter in the checkout form and what delivery requires:

last name, first name, and — for Ukrposhta — patronymic;
phone number, and email address where the shop requires one;
settlement and the branch, parcel locker or delivery address;
order contents, payment method, order comment and a “do not call me” flag;
an anonymous visit identifier, the device type and the name of the app the page was opened from. This produces page statistics for the seller; it cannot identify a person.

We never see or store card details. Card payment happens on the payment provider’s own page; only the payment status comes back to us.

Our legal basis

For seller data the basis is the conclusion and performance of a contract to which you are a party (Art. 11 § 1(3) of Ukraine’s Personal Data Protection Act) — that is, providing the service you signed up for. For buyer data the basis is performance of the sale between the buyer and the seller.

Web analytics on the marketing pages (Google Analytics) is separate. It is not necessary to perform the contract, so we rely on our legitimate interest — understanding whether people find us and what interests them — bounded by the fact that the data is anonymous and does not identify you to us. You can opt out at any time without losing access to the service: see the Cookie Policy.

We run no marketing mailings.

Who we share data with

We do not sell personal data. It goes only to those without whom the service cannot work:

payment providers the seller connected (plata by mono, LiqPay, WayForPay, NovaPay). Most receive only an amount and an order number. The exception is NovaPay, which by its own rules requires the buyer’s name, phone and email;
delivery carriers (Nova Poshta, Ukrposhta, Meest, Rozetka Delivery) — today for branch lookup only: they receive the search text the buyer types. We do not send them orders or create waybills;
CRM systems (KeyCRM, SalesDrive) where the seller has connected one and enabled order forwarding. The full order, including buyer contacts, is then sent to that CRM;
the seller’s webhooks — if the seller configured order forwarding to their own address, order data is sent there. The seller chooses that address and is responsible for where the data ends up;
infrastructure providers: Cloudflare (traffic protection and delivery, file and backup storage), the hosting provider of our server, and our email provider;
Google — from this site’s pages only (live-cart.com), and only anonymous visit statistics via Google Analytics 4: page address, referral source, approximate city, device type, and clicks on the “Get started” and “Log in” buttons. Your name, email and phone number are not sent, and the seller dashboard and shop pages are not covered by the tag. Details and how to opt out are in the Cookie Policy; how Google processes this data is described on Google’s own page;
state authorities — only in the cases and manner expressly required by law.

Where data is stored

Accounts, products, orders and buyer contacts are held on the service’s own server. We do not disclose its location or hosting provider — that is a security measure.

We should be equally clear about three cases where data is processed away from that server — including outside Ukraine:

the secure connection. The site runs behind Cloudflare, and the encrypted connection is decrypted there before the request reaches our server. Cloudflare chooses which of its locations serves a given visitor, and it may be outside Ukraine;
backups. A daily backup of the database is stored in Cloudflare R2 object storage, which has no Ukrainian region;
product images are held in that same storage.

Where a seller connects third-party services or webhooks, data goes wherever they direct it — including outside Ukraine.

How long we keep it

account and shop — for as long as you use the service. After a closure request we delete the data manually, within a reasonable period;
orders — kept by the seller for as long as their own record-keeping requires; we do not delete them on our own initiative;
sign-in sessions — 30 days;
page visit records — 400 days;
backups — 30 days, then overwritten.

There is no self-service account deletion in the interface yet — a request is handled by a person. We regard that as a shortcoming and intend to fix it.

Your rights

Article 8 of Ukraine’s Personal Data Protection Act gives you the right to:

know the sources of collection, the location of your data, the purpose of processing, and the location of the controller or processor;
receive information about the conditions of access to your data, including about third parties it is transferred to;
access your personal data;
receive an answer within 30 calendar days as to whether your data is processed, and what it contains;
make a reasoned objection to the processing of your data;
demand the change or destruction of your data where it is processed unlawfully or is inaccurate;
protection of your data against unlawful processing and accidental loss, destruction or damage, and against the supply of information that is inaccurate or damaging to your honour, dignity and business reputation;
complain about the processing of your data to the Ukrainian Parliament Commissioner for Human Rights or to a court;
apply legal remedies in the event of a breach of data protection law;
enter reservations limiting the right to process your data when giving consent;
withdraw consent to the processing of your personal data;
know the mechanism of automated processing of personal data;
be protected against an automated decision that has legal consequences for you.

To exercise any of these, write to [email protected]. If the request concerns an order placed in a shop, we will pass it to that seller as the controller of the data.

How we protect data

all connections to the site are encrypted;
passwords are stored only as an Argon2id hash and cannot be recovered;
access keys for third-party services are encrypted separately for each shop;
each shop’s data is isolated at the database level;
server access is by key only, with no passwords.

No measure is a complete guarantee. If a breach occurs that threatens your rights, we will notify you.

Children

The service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect children’s data.

Changes to this policy

The date at the top of this page is when the text last changed. We will notify sellers by email of material changes. If we ever add third-party analytics or advertising services, this policy and the Cookie Policy will be updated before those services go live.