Privacy Policy

Who we are

Flavr Web Dev Ltd (company number 14994358), registered in England and Wales ("we", "us") makes Cartage, a macOS app sold as a one-time purchase. For any privacy question, contact us at support@flavrapps.com.

The app is private by design

Cartage runs entirely on your Mac. It does not collect, upload, or have access to your files, your file names, or anything you copy or move — and it makes no advertising or analytics calls. The only time the app talks to the internet is to check for updates and to validate your licence key (see below).

What we collect

• Your email address — given at checkout, so Lemon Squeezy can send your receipt and licence key, and so we can help if you contact support. You don't need an account, and the free trial needs no email at all.
• Payment data — handled by Lemon Squeezy, our payment provider and Merchant of Record. They process your card; we receive only transaction metadata (amount, currency, status, order and licence IDs). We never see or store full card details.
• Licence activation — when you activate Cartage, the app sends your licence key and a device identifier to Lemon Squeezy to verify the licence and count activations. No file data is ever sent.
• Website & security logs — the IP address and browser sent with requests to this site, used for delivery, security, and abuse prevention.
• Website analytics (only if you accept) — how this website is used, via Google Analytics. See Analytics and cookies below. The Cartage app itself has no analytics.
• Support messages you send us.

Why we use it (lawful bases)

• To perform our contract with you — sell you a licence, deliver your key, and validate it.
• Legitimate interests — security, preventing licence abuse, and improving the product.
• Consent — website analytics cookies, only if you choose “Accept analytics”. You can withdraw it at any time.
• Legal obligation — keeping tax and transaction records.

Who processes your data

• Lemon Squeezy — payment processing, licence keys, receipts and invoicing (as Merchant of Record).
• Amazon SES — delivering any email this site sends.
• Google — website analytics (Google Analytics 4), only if you accept analytics cookies.

These providers may process data outside the UK under appropriate safeguards.

Analytics and cookies

This section is about this website only. The Cartage app has no analytics and sets no cookies.

Essential cookies (always on, no consent needed): a session cookie that keeps the site's forms secure, a preference cookie if you switch between light and dark mode, and cartage_consent, which remembers your analytics choice for 6 months.

Analytics cookies (optional, off unless you say yes): we use Google Analytics 4 to see which pages help people find Cartage. It only loads after you choose “Accept analytics” — until then, or if you reject, nothing is sent to Google. If your browser sends a Global Privacy Control signal, we treat that as a rejection unless you opt in yourself. When you accept, Google Analytics collects:

• pages viewed, how you arrived (the referring site or link) and how far you scroll;
• clicks on the Buy and Download buttons and on links to other sites;
• device, browser, operating system and screen size;
• approximate location (country/city), worked out from your IP address — Google Analytics 4 does not log or store IP addresses.

It sets two cookies: _ga and _ga_<container-id>, which hold a random identifier so visits can be counted, and last up to 2 years. We don't run ads, and advertising features and Google signals are switched off. If you then buy, the random analytics identifier is passed to Lemon Squeezy with your order so we can tell which pages led to a sale; it doesn't identify you by name.

Google's role. Google processes analytics data for us as a processor under its terms, and may act as an independent controller for some of it under its own policies — see Google's Privacy Policy. Analytics data is kept for 14 months, then deleted.

International transfers. Google may process analytics data in the United States. That transfer is covered by the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) and, where that doesn't apply, by standard contractual clauses (the UK Addendum).

Changing your mind. Use the Cookie settings link in the site footer at any time to accept or reject. Rejecting stops analytics and deletes the Google Analytics cookies from your browser. You can also clear cookies in your browser settings.

Retention

We keep purchase and licence records for as long as needed to support your licence and as required for tax/accounting (generally up to 6 years). Security logs are kept short-term.

Your rights

Under UK GDPR you can request access, correction, erasure, restriction, portability, or object to processing. Email support@flavrapps.com and we'll respond. You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

We may update this policy; the "last updated" date above reflects the latest version.

This page is provided in good faith and is not legal advice.