Last updated: May 2026
CoCart Headless LLC and its affiliates (“CoCart”, “we”, “us”, or “our”) have prepared this Privacy Policy to explain what Personal Data we collect, how we use it, and your rights.
Through our website and product (the “WordPress® plugin”), we provide tools that allow users (“you”) to manage the REST API for their store. The plugin, https://cocartapi.com (the “Site”) and https://docs.cocartapi.com (the “Documentation”) are collectively referred to as the “Service”.
Scope of this Privacy Policy
This Privacy Policy applies only to visitors of our website (cocartapi.com) and users of CoCart in their capacity as our customers.
If you are a shopper interacting with an online store that uses CoCart, this Privacy Policy does not apply to you.
In that case, your personal data is collected and processed by the store you are interacting with. That store is the data controller responsible for your information. We do not have access to or control over data processed within individual stores using our plugin.
We recommend contacting the store directly if you have questions about how your data is handled.
Compliance & Data Processing
CoCart is designed with a privacy-first architecture.
The CoCart plugins (both the free version distributed via WordPress.org and the premium version delivered via our distribution system) operate entirely within the user’s own WordPress environment. CoCart does not collect, store, or have access to customer, order, or store data processed through the plugin.
For premium plugins, an update service is provided via a CoCart-hosted endpoint. This service only processes a license key to validate access to updates. License keys used for premium plugin updates are technical identifiers and are not used to directly identify individuals or combined with personal data.
CoCart does not act as a data processor in relation to customer store data processed through the plugin.
Separately, CoCart acts as a data controller for its own website (cocartapi.com), where limited data may be processed for analytics and purchases via third-party providers.
We are committed to data minimization, transparency, and security in all aspects of our services.
Who we are (Data Controller)
CoCart Headless LLC is the data controller for Personal Data processed under this Privacy Policy.
Contact details:
Email: sebastien @ cocartheadless.com
CoCart Headless, LLC
30 North Gould Street,
Sheridan, WY 82801,
United States
What data we collect
1. Analytics Data
We use Datafast analytics (https://datafa.st/) to understand how our website is used. This service:
- Creates a cookie to help with more accurate data
- Collects anonymous usage metrics such as page views, referrers, device type, browser, country or region
- Creates a user profile upon completion of a Polar checkout from this site so we can see which visits led to purchases
We do not use this data to directly identify you. Where required by law (such as in the EU/UK), analytics will only be used with your consent.
For more details, see Datafast’s Privacy Policy: https://datafa.st/privacy-policy
2. Account and Payment Data
If you create an account or make a purchase, this is handled by Polar.sh. All customer information, billing details, and account data are processed securely by Polar according to their own Privacy Policy.
3. Marketing Preferences
If you subscribe to our newsletter, we process:
- Your email address
- Your subscription preferences
You can unsubscribe at any time using the link in any email we send.
Email communications: product updates and marketing
If you provide your email address to us (for example, purchasing a product, or signing up for updates), we may use it for two distinct types of communications: product/service communications and marketing communications.
Product and service updates (transactional communications)
We may send you essential product-related communications that are necessary for the operation and use of CoCart. These include:
- Security updates or critical bug fixes
- Product release notes and feature announcements related to your usage
- License, account, or access-related notifications (for premium products)
These communications are considered necessary for the proper functioning of the Service and are based on our legitimate interest in maintaining and supporting the product you use.
Marketing communications (newsletter and promotions)
Where you have given consent (for example, by subscribing to our newsletter), we may send you marketing communications such as:
- Product news and general updates
- Educational content or tutorials
- Promotional materials or announcements
You can withdraw your consent at any time by clicking the unsubscribe link included in any marketing email.
Email processing providers
To manage and deliver email communications, we may use third-party service providers, including:
– Zapier (https://zapier.com/), for automation and webhook-based data routing between services
– Resend (https://resend.com/), for email delivery and infrastructure
These providers act as data processors on our behalf and only process your email address according to our instructions.
Your choices
You can:
- Unsubscribe from marketing emails at any time
- Continue receiving essential product or service-related communications where necessary for the functioning of the Service
Legal basis for processing (GDPR)
We rely on the following legal bases:
- Legitimate interests: to understand and improve our Service, where these interests are not overridden by your rights
- Consent: for marketing communications and analytics where required by law
- Contract performance: to provide purchased services
- Legal obligations: for accounting, tax, and compliance purposes
How we use your data
We use Personal Data to:
- Operate and maintain the Service
- Improve performance and usability
- Process purchases and manage accounts
- Communicate with you (including support and updates)
- Comply with legal obligations
Data sharing
We only share data with trusted third parties:
- Datafast – analytics provider
- Polar.sh – payment and account processing
- Zapier – automation and secure data routing between services (including webhook-based workflows and email automation)
- Resend – email delivery
We do not sell your Personal Data.
International data transfers
Your data may be processed outside your country of residence. Where data is transferred outside the EU/UK, we rely on appropriate safeguards such as:
- Standard Contractual Clauses approved by the European Commission
- Transfers to countries with adequacy decision
Data retention
- Analytics data: retained in aggregated or anonymized form
- Account data: retained as long as necessary to provide services and comply with legal obligations
- Marketing data: retained until you unsubscribe
Your rights
Depending on your location (e.g. EU/UK under GDPR), you may have the right to:
- Access your Personal Data
- Rectify incorrect information
- Request deletion of your data
- Object to processing based on legitimate interest
- Withdraw consent at any time
- Data portability for account information
You also have the right to lodge a complaint with your local data protection authority.
To exercise your rights, contact: sebastien @ cocartheadless.com
Cookies
We use cookies and similar technologies to operate our Site.
These may include:
– Strictly necessary cookies (required for core functionality)
– Analytics cookies (used only where legally permitted and with consent where required)
You can control cookies through your browser settings. Disabling cookies may affect how the Service functions.
For more information, visit: https://allaboutcookies.org
Data security
We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, loss, or misuse.
Children’s privacy
The Service is not intended for individuals under the age of 16, and we do not knowingly collect Personal Data from children.
Third-party links
Our Service may contain links to third-party websites. We are not responsible for their privacy practices.
Changes to this policy
We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised “Last updated” date.
Contact us
If you have questions about this Privacy Policy or your data:
Email: sebastien @ cocartheadless.com