Draft for owner review. This page is not legal advice. Have counsel review it before treating it as the live policy.

Three Paths, LLC operates CartReady. This draft explains what the site stores. Counsel should review it before it is treated as final.

A free scan stores the store URL, the hostname, the report, a hash of the network address for rate limits, and the time. We do not keep the raw IP address in the scan record. If you order, we store your email, the order, and the files we generate. Contact messages store the name, email, and message you send.

Stripe processes card payments when checkout is configured. Resend sends email when an API key is configured. The database is Neon Postgres. A first-party beacon at /api/collect stores the path and the day so we can see which pages were opened. It does not set a tracking cookie and it does not record the IP address.

Account login uses a magic link. The cookie holds a random token. We store only a hash of that token. Download links are unguessable and expire after 30 days.

We do not sell personal information. We share it with the processors above only to run the service. Email ops@threepaths.co to ask for a copy or deletion of an order, a message, or a scan tied to your email. Scans submitted without an email are tied to a URL, not to a person, and a deletion request should include that URL.