Privacy Policy

Cartoply (“we,” “our,” or “us”) operates the Cartoply platform, a territory-based scheduling service for field sales teams. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using the Cartoply platform (“Service”), you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

Account information. When you register, we collect your first name, last name, email address, and username. Organization admins may also provide a company name, logo, and brand colors.

Booking data. When a prospect books through your Cartoply page, we collect their name, email address, phone number, the selected appointment time, and any notes or address they provide. If the booking page includes custom intake questions configured by the host, we also collect the prospect's answers to those questions. This data is associated with the host's account. Phone numbers are used for appointment coordination and are shared with the host and, where the host has enabled an integration (e.g., Jobber), with that integration.

Location data. If an event type is configured to collect a guest's address for territory routing, the address is stored temporarily to match the prospect to an available rep. We do not track your physical location in the background.

Calendar data. If you connect Google Calendar or Microsoft Outlook, we read your free/busy information to determine availability and write events when bookings are confirmed. We do not read the content of existing calendar events.

Usage data. We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This data is used to operate and improve the Service. Signup and newsletter forms are protected by Cloudflare Turnstile, which processes limited device and network information to distinguish people from bots.

Booking-page experiments. Some booking pages may test alternative page layouts. To keep the experience consistent, we store a random identifier in your browser's local storage. It is not linked to your name or contact details and is not shared with advertisers.

Payment data. We do not store payment card details. Payments are processed by Stripe or PayPal. We receive only a transaction identifier and confirmation status.

• To provide, operate, and maintain the Service
• To send booking confirmation and reminder emails to you and your prospects
• To match prospects to the correct sales rep based on territory
• To sync booking information with connected third-party tools (e.g., Jobber, Google Calendar)
• To communicate with you about your account, including billing and service updates
• To detect and prevent fraud or abuse
• To analyze aggregated, anonymized usage patterns to improve the Service

We do not sell your personal information or your customers' information to third parties.

Cartoply integrates with third-party services at your direction. When you connect an integration, you authorize us to exchange data with that service on your behalf. Each integration is governed by the third party's own terms and privacy policy.

• Google Calendar / Microsoft Outlook — read free/busy data; write booking events
• Stripe / PayPal — process payments for paid event types
• Jobber — create client records and service requests when bookings are confirmed

You can disconnect any integration at any time from your settings. Disconnecting stops future data sharing but does not automatically delete data already sent to the third party.

Google user data. Cartoply's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to determine your availability and to create, update, or delete booking events on your calendar. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your explicit consent, for security purposes, or to comply with applicable law.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used.

Analytics. We use Google Analytics to understand how visitors use our website. Google Analytics sets cookies and collects information such as pages visited, approximate location, and device type. You can opt out with the Google Analytics opt-out browser add-on.

Advertising measurement. We use Google Ads conversion tracking on our marketing pages to measure whether our advertising leads to signups. This involves cookies set by Google. We do not sell browsing data, and we do not use advertising cookies on booking pages or inside the signed-in application. You can manage ad personalization at Google Ads Settings.

You can configure your browser to refuse cookies, but some parts of the Service may not function correctly without them. Where required by law, we ask for your consent before setting non-essential cookies.

We share your information only in these limited circumstances:

• Service providers. We use trusted vendors to host infrastructure, send email, and process payments — currently Vercel (web hosting), Railway (API and database hosting), Resend (transactional email), Cloudflare (bot protection), Google (analytics and advertising measurement), and Stripe and PayPal (payments). These vendors are contractually bound to use your data only to provide services to us.
• Integrations you enable. As described in Section 4, data is shared with third-party services at your direction.
• Legal requirements. We may disclose information if required by law, court order, or to protect the rights and safety of Cartoply, our users, or the public.
• Business transfers. If Cartoply is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

We retain your account data for as long as your account is active. You can delete your account and download an export of your data at any time from your profile settings; deletion is immediate and permanent. You can also request deletion or export by contacting us at hello@cartoply.com.

Booking records associated with your account are deleted on the same schedule. Anonymized, aggregated data derived from your usage (e.g., aggregate booking volume statistics) may be retained indefinitely.

We use industry-standard measures including encryption in transit (TLS), encrypted storage of tokens and credentials, and access controls to protect your data. No method of transmission or storage is 100% secure. We will notify you promptly in the event of a data breach that affects your personal information, as required by applicable law.

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us and we will delete it promptly.

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these rights, email us at hello@cartoply.com. We will respond within 30 days.

If you booked an appointment through a Cartoply page, the business you booked with controls that booking data, and we process it on their behalf. You can direct requests to that business or to us — if you contact us, we will assist and notify the business as appropriate.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the effective date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

Questions or concerns about this Privacy Policy? Reach us at hello@cartoply.com.