Privacy Policy
Last updated: 5 November 2026
inCart is a service for creating online shops, operated from Islamabad, Pakistan. This policy covers incart.pk, the shops built on inCart (addresses ending in .incart.pk) and the sign-in pages at accounts.incart.pk. In this policy, "inCart", "we" and "us" mean the operator of inCart.
It explains what information we collect when you visit a shop, place an order, sign in with Google or create a shop; how we use, share, store and protect it; and the choices you have. If you have a question, contact us.
1. Information we collect
When you order from a shop
- Order details: your name, mobile number, city, area and delivery address, the products you ordered and the amount to be paid on delivery.
- Delivery location (optional): if you tap "Use my current location" or "Pick on map", we save that point (latitude and longitude) with your order, together with how it was set and, for your phone's location, its estimated accuracy. We only read your location when you tap the button, your browser asks for your permission first, and you can skip it.
- Fraud prevention: your mobile number and your internet connection's IP address are used to limit the number of cash-on-delivery orders that can be placed in a day. Before an order is placed we may use Cloudflare Turnstile, a check that looks at signals from your browser to confirm a real person is ordering.
When you sign in with Google
Buyers can choose "Continue with Google" instead of ordering as a guest. With your permission, Google shares with us your name, email address and a Google account identifier. We do not receive your Google password, and we do not ask for access to your contacts, Gmail, Drive, calendar or any other Google data. See section 5 for exactly how we handle this information.
When you are signed in, we also keep the addresses you choose to save and the orders you place.
When you create a shop
- Your shop name, web address, logo, colours, contact details such as a WhatsApp number, the products you choose and the prices you set.
- Today, shops are created by resellers of our supply partner. Your reseller account with that partner is covered by its own privacy policy.
Automatically
- Basic technical information such as your IP address, device and browser type, and the pages you visit, recorded by our hosting and security provider to keep the service working and safe.
- Shop pages currently use Google Analytics and Meta Pixel to measure visits and the performance of our marketing. These tools do not receive the information Google shares with us when you sign in.
2. Cookies and storage on your device
| What | Why | How long |
|---|---|---|
| Shopping bag | Remembers the items in your bag on that shop (stored in your browser). | Until you place the order or clear it |
| Guest id cookie | Lets you see the orders, and their tracking, that you placed from this device without an account. | 1 year |
| Sign-in cookie | Keeps you signed in to your account on that shop. | Until you sign out or it expires |
| Analytics cookies | Google Analytics and Meta Pixel, described above. | As set by Google and Meta |
You can block or delete cookies in your browser settings. If you do, the bag and the order list will not work on that device. You can also use the Google Analytics opt-out add-on and your Meta ad preferences.
The incart.pk home page itself uses no cookies and no analytics.
3. How we use your information
- To place, deliver and support your order, including collecting cash on delivery, returns, exchanges and customer service.
- To let you sign in, see your orders and saved addresses, and follow your parcel. Tracking is shown only to the person who placed the order, on the device they ordered from or when signed in with the Google account they used.
- To prevent fake orders, fraud and abuse of the service.
- To run, secure and improve inCart and the shops built on it.
- To meet our legal, tax and accounting obligations.
We do not sell your personal information, and we do not use it to make decisions about you that have legal or similarly significant effects.
4. Who we share it with
- The shop owner you ordered from receives your name, mobile number, delivery address and order details, so they can serve you and follow up on your order.
- Our supply and delivery partners, who stock, pack and ship the products sold on inCart shops, receive the order and delivery details they need to fulfil your order.
- Courier companies receive your name, mobile number, address and the amount to collect, so they can deliver your parcel.
- Service providers that help us run the service, under their own security and confidentiality commitments: Cloudflare (hosting, security and the bot check), Google (sign-in and analytics) and Meta (Meta Pixel).
- OpenStreetMap: if you open the map at checkout, your browser loads map images and place search results directly from OpenStreetMap's servers, which receive your IP address and the area being viewed.
- Authorities, when required by the laws of Pakistan or a valid legal request, or to protect the rights and safety of our users and the public.
- A successor, if inCart or its business is reorganised, merged or sold, in which case this policy continues to apply to your information.
Some of these providers process information on servers outside Pakistan. We only share what each one needs for the purpose described.
5. Information received from Google
When you choose "Continue with Google", we request only Google's basic sign-in permissions (openid, email and profile).
- What we access: your name, email address and Google account identifier.
- How we use it: only to sign you in, to show your name on your account, and to link your orders and saved addresses to your account on the shop you signed in to.
- How we share it: we do not sell it, use it for advertising, or share it with advertising or analytics providers. It is shared only with the service providers that host and secure inCart, and when required by law.
- How we store and protect it: on access-controlled servers, transferred only over encrypted connections. Only people and systems that need it to run the service can access it.
- How long we keep it: while your account is in use. You can ask us to delete your account and the Google information linked to it at any time (see section 7). Records of orders you have placed may need to be kept for legal and accounting reasons, without being linked to your Google account.
- Removing access: you can disconnect inCart from your Google account at any time at myaccount.google.com/connections.
inCart's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. How long we keep information
- Orders: as long as needed to deliver and support the order and to meet legal, tax and accounting requirements.
- Buyer accounts and saved addresses: while your account is in use, or until you ask us to delete them.
- Fraud-prevention counts: only as long as needed to apply the daily order limits.
- Shops: while the shop exists, and afterwards only as long as needed for its orders and our legal obligations.
7. Your choices and rights
- You can order as a guest without creating an account, and you can skip the delivery location.
- Signed-in buyers can view and edit their saved addresses on the shop's account page.
- You can ask us for a copy of your information, ask us to correct it, or ask us to delete your account and the information linked to it, by emailing us from the email address you used or with your order details. We will confirm the request and respond within 30 days. Some order records must be kept by law; we will tell you if that applies.
- You can withdraw permissions at any time: location in your browser settings, and Google sign-in at myaccount.google.com/connections.
8. Security
All inCart pages are served over encrypted connections (HTTPS). Access to personal information is limited to the people and services that need it to run inCart. No method of storing or sending information is completely secure, but we work to protect your information and will act promptly if we learn of a problem.
9. Children
inCart is not intended for children under 18, and we do not knowingly collect personal information from them. If you believe a child has given us their information, please contact us and we will delete it.
10. Applicable law
We handle personal information in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016. We will update this policy as data protection law in Pakistan develops.
11. Changes to this policy
We may update this policy as inCart grows. The date at the top shows when it last changed. If a change significantly affects how we use information you have already given us, we will make it clear on this page before it takes effect.
12. Contact us
For privacy questions and requests: incartwillhelp@gmail.com
inCart, Islamabad, Pakistan