Cookie Policy

This policy explains which cookies cartstack.com sets, what each one is for, and how to change your choice. It covers this website only. The CartStack product, which runs on our customers' own websites, is described in the privacy policy.

Your choice

You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page, wherever you are. Withdrawing analytics consent also clears the identifier held by our product analytics.

What you see on your first visit depends on where you are, because the law does.

What you are shown, and where

• The European Economic Area, the United Kingdom, Switzerland and Brazil. A banner asks how you would like to be tracked, and nothing in the analytics or marketing categories below loads until you answer it. Choosing "Essential only" means none of it ever loads. Not answering has the same effect as choosing "Essential only", for as long as you do not answer.
• The United States. A notice, the categories below active, and a working opt-out: the Do Not Sell or Share My Personal Information link in the footer, which applies the moment you follow it. We also honour the Global Privacy Control signal automatically, on every visit, before any tag has run — if your browser or an extension sends it, you are opted out without doing anything at all.
• Everywhere else. A notice, the categories below active, and the same Cookie settings link if you would rather they were not.

If we cannot tell where you are — a privacy-preserving browser, a VPN, Tor — you get the first of those, which is the strictest.

Strictly necessary

These are set for every visitor and cannot be switched off, because the site does not work without them. They carry no advertising or analytics information.

• cartstack_session — keeps your session on the site. Expires after the session ends.
• XSRF-TOKEN — protects forms against cross-site request forgery. Expires after the session ends.
• cs_consent — records the choice you made in the cookie banner, or an opt-out you have exercised, so you are not asked on every page. Lasts 365 days. Without it we cannot honour your choice.
• cs_tier — records which of the three sets of rules above applies to you, so we do not repeat the lookup on every page. It holds a single letter and nothing about you. Lasts 12 hours.

Analytics

Set only if you accept analytics. They tell us which pages are read and which are ignored, so we can write better ones. We do not use them to build advertising profiles.

• Google Analytics, loaded through Google Tag Manager — _ga and _ga_<id> distinguish one visitor from another and measure how pages are used. Typically last up to 2 years. See Google's privacy policy.
• PostHog — ph_<key>_posthog holds an identifier for your visit and the pages and clicks within it. Lasts up to 365 days. If you give us your email address through a form on this site, that identifier is associated with it, and the pages you viewed after granting consent are attributed to you. See PostHog's privacy policy.

Marketing

Set only if you accept marketing cookies.

• LeadDyno — records that you arrived from a referral link, so the partner who referred you is credited if you later sign up. Set on the cartstack.com domain so the record survives the move to our application at signup. See LeadDyno's privacy policy.
• RB2B — identifies anonymous business visitors to this website, so our sales team can see which companies are reading about us. It is described in full in the section below. See RB2B's privacy policy.
• Where advertising tags are active, Google Tag Manager may also set advertising and remarketing cookies. Google Consent Mode is enabled, so these receive no advertising identifiers unless you accept this category.

Visitor identification

This one deserves more than a line in a list, because it is the item on this page most likely to surprise someone.

We use RB2B to identify anonymous visitors to this website. Where it can, it tells us who visited — a name, a professional profile, a work email address — from a visit in which you never filled in a form. That is different in kind from counting pageviews, so we would rather say it plainly than bury it.

Three things bound it:

• It runs only for visitors in the United States. RB2B does not attempt to identify anyone outside it, and we do not load it for them.
• It follows the marketing category on this page. Turn that off in Cookie settings, or follow the Do Not Sell or Share My Personal Information link in the footer, and it stops. Send Global Privacy Control and it never starts.
• It applies to this website. It has nothing to do with the CartStack product running on our customers' sites, which is covered by the privacy policy.

Under California law, sharing data with a service of this kind is treated as sharing personal information, which is what the footer opt-out exists for. You can also opt out directly with the vendor at app.retention.com/optout, which covers every site using RB2B rather than just ours. The address is on a different domain because RB2B and Retention.com share the same opt-out register; it is the one RB2B's own privacy policy directs you to.

Cookies set by embedded content

Some pages embed content from other companies, and that content can set its own cookies once it loads. We do not control those cookies and cannot read them.

• Calendly on the demo booking pages.
• ActiveCampaign where a form on this site submits to it, including the contact form.
• Wistia and YouTube where a video is embedded, including in blog posts.

Managing cookies in your browser

Every major browser lets you see the cookies a site has set, delete them, and block future ones. Blocking the strictly necessary cookies above will stop parts of this site working. Browser settings are per-device, so a choice made on a laptop does not carry to a phone.

Changes to this policy

We update this page when the cookies we set change. It was last reviewed on the date shown on this page.

Questions

Write to support@cartstack.com.