Privacy and your data

Cartless stores a buyer’s email, their name if given, and a record of what they bought. It answers WordPress’s own export and erase requests, deletes abandoned checkouts after 60 days, and leaves everything alone when you deactivate or delete it unless you tick the box that says otherwise.

What is stored

For every paid order: the email, the name if the buyer gave one, the lines, amounts, tax and cost snapshots, and the answers to any questions asked after payment. Card details never touch your server; they go from the buyer’s browser to Stripe. Cartless keeps a Stripe customer reference so a saved card can be charged for an upsell — on Pro only, and only with the consent shown at checkout.

For an abandoned checkout: a count, a value and a step. No address, unless the buyer consented to recovery emails on Pro.

Export and erase

Cartless registers with WordPress’s Tools → Export Personal Data and Tools → Erase Personal Data. An export includes every order for that email. An erase anonymises: the name becomes Anonymous, the address is blanked, and the order — its lines, amounts and dates — survives, because tax law requires financial records to be kept and the right to erasure does not extend to them.

Deactivating and deleting

Deactivating never deletes anything. Merchants deactivate to troubleshoot, which is exactly when losing financial records would be worst.

Deleting the plugin also leaves your data alone — unless, under Cartless → Settings, you have ticked the box to delete data on uninstall. Then deleting the plugin drops every Cartless table and option. The box is off by default.

The Freemius opt-in

When you activate Cartless, Freemius — who sell and license the Pro add-on — asks whether you will share basic information about your site. The opt-in screen lists exactly what would be shared. You can decline and keep using everything; the plugin behaves identically either way, and nothing is sent unless you agree. If you opt in, or buy a licence, the plugin talks to api.freemius.com.

Where the rest is written down

The plugin’s listing on wordpress.org carries the full disclosure of every external service — Stripe and Freemius — with links to each one’s terms and privacy policy. This site’s own privacy policy covers what the website collects, which is less.