Publisher: Shams Factory · SIRET 88889743600026 · 43 Rue Talma, 94400 Vitry-sur-Seine

Privacy policy

Last updated: October 22, 2026 · Contact: legal@cartia.fr

1. Who are we?

This policy describes how the publisher of the Service identified at the top of the page (“Cartia”, “we”) processes personal data in connection with the digital loyalty SaaS service available at cartia.fr and through the associated applications (including Cartia Counter).

Rationalab is, like Cartia, a name and a business of Shams Factory. It is not a separate company: same legal entity, same SIRET. The data controller for merchant accounts, and the data processor for loyalty program members, is Shams Factory.

Data protection / legal contact: legal@cartia.fr.

2. Scope and roles

Cartia processes data in two main contexts:

• Merchant accounts (SaaS Customers) - Cartia is the data controller for account creation, authentication, subscription billing, support and platform security.
• End Members of loyalty programs - the merchant determines the purposes of its program (enrollment, balances, rewards, communications). In this context, the merchant is in principle the data controller; Cartia acts as a technical data processor to host and operate the Service.

At sign-up, a single box covers acceptance of the terms and of this policy, and agreement to receive the merchant’s Wallet notifications and marketing emails. The “program enrollment” and “marketing” consents are recorded separately.

3. Data collected

3.1 Merchants and teams

• identity and contact details (name, email, possibly phone number);
• organization and shop information (name, displayed address, settings);
• account data and technical logs (login, security actions);
• billing and subscription data (Free, Pro or Business Plan, status, history of payment events) - card payment is processed by Stripe;
• exchanges with support.

3.2 End Members (the merchant’s customers)

• enrollment data (first name, last name, date of birth, gender, email and/or phone number);
• balances / progress (stamps, points), history of EARN / REDEEM operations;
• consents (program, marketing) and associated timestamps;
• technical identifiers linked to the digital card / QR (enrollment tokens, card references);
• where applicable, data needed to display the card on a phone.

Apple / Google Wallet. Customers can add their card to Apple Wallet and Google Wallet. Technical pass identifiers (serial number, authentication tokens, balance) are then processed through the Apple and/or Google services needed to display and update the card on the End Member’s device.

Wallet notifications - important distinction (GDPR). Updates to the balance or status of the card (e.g. points earned after a scan) are transactional notifications tied to the performance of the program: they do not require a separate marketing opt-in, subject to clear information at enrollment. Cartia also relies on Wallet notifications and marketing emails to send the merchant’s offers and campaigns. These messages are based on the box ticked at sign-up. To stop receiving Wallet notifications, remove the merchant’s card from your Apple Wallet or Google Wallet. To stop receiving marketing emails, use the “Unsubscribe” link in each marketing email: it also ends the offers sent to the card. The user can also turn off notifications at the level of the pass or of the Wallet app.

3.3 Technical data and audience measurement

• cookies and storage strictly necessary for operation (session, security, essential preferences);
• first-party analytics (audience and usage measurements carried out on Cartia’s behalf, without placing third-party advertising cookies of the ad-network type) - intended to improve the Service and its reliability;
• usage log of the merchant area (dashboard, counter, setup wizard), tied to the account: screens viewed, display time, actions that modify the account or that fail - intended to support the setup of the Service and to fix blocking points in the Service.

4. Purposes and legal bases

• Provision of the Service (account, program, QR, scan, dashboard) - performance of the contract (merchant) / legitimate interest or contract, as the case may be (End Members via the merchant).
• Billing and Plan management (Free, Pro, Business) via Stripe - performance of the contract and accounting obligations.
• Security, fraud prevention, rate-limiting - legitimate interest / legal obligation.
• Support and product improvement - legitimate interest; first-party analytics in this context.
• Cartia marketing communications (to merchants) - consent or legitimate interest depending on the channel and status (prospect / customer), with a right to object.
• Merchant marketing to its End Members - under the merchant’s responsibility, based on the consent collected at sign-up where required.
• Responding to rights requests and compliance - legal obligation.

5. Recipients and processors

Data may be disclosed, to the extent necessary, to:

• authorized Cartia staff (support, operations, billing);
• Stripe for payment of paid Plans (Pro, Business);
• Hetzner Online GmbH - hosting provider of the Service (servers and database located in Germany, European Union);
• where applicable, competent authorities upon legal request, or advisers (lawyer, accountant) under confidentiality.

Cartia does not sell personal data. Transfers to Apple and/or Google related to adding and updating Wallet passes are limited to the technical data necessary for the card to work on the End Member’s device.

For the processing of End Members on behalf of the merchant, see also the data processing agreement (DPA).

6. Transfers outside the EU

Application hosting and the database are located in Germany (Hetzner Cloud), and therefore within the European Union. Certain providers (notably Stripe, Apple, Google) may carry out processing involving transfers governed by appropriate safeguards (standard contractual clauses / recognized mechanisms). For any question: legal@cartia.fr.

7. Retention periods

• Active merchant account: for the duration of the contractual relationship, then archiving limited to what is necessary (billing, evidence) in accordance with statutory periods (notably accounting obligations, up to 10 years for certain documents).
• Inactive / closed account: deletion or anonymization of data that is not necessary within a reasonable time after closure, except where retention obligations apply.
• End Members: for the duration of the program and of the merchant–member relationship, then according to the merchant’s instructions and the reference framework of the CNIL (the French data protection authority) applicable to commercial activities (current management, then intermediate archiving).
• Anonymization: when an End Member record is anonymized through the product, personal identifiers are removed / replaced; the operational history may be kept in non-identifying form to preserve the integrity of the ledger.
• Technical / security logs: limited duration, proportionate to diagnostic and security needs.
• Cookies / audience measurement: short durations compatible with the purpose (session or limited rolling period for first-party statistics).
• Merchant area usage log: 400 days at most.

8. Cookies and trackers

Cartia uses essential cookies and storage for the operation of the Service (authentication, security, load balancing, strictly necessary preferences). These trackers do not require consent under cookie regulations when they are indispensable to the service requested.

Two first-party preference cookies (12 months) remember your display choices: cartia_locale stores the language you chose, and is set only when you choose a language or follow a link containing ?lang=; cartia_currency stores the currency you chose, and is set only when you choose a currency. If you decline the offer to show prices in your country’s currency, your choice is remembered in your browser’s local storage (cartia_currency_suggestion_dismissed); that country is inferred from your IP address at the time of the visit, using a local database, and is neither stored nor passed on to any third party.

Audience measurement also relies on first-party analytics (technical events on Cartia’s side, with no advertising network for this measurement). Pages of the public site are counted server-side, without any advertising tracker: the IP address is used only, at the moment of the visit, to infer an approximate location (city) and a technical identifier that is renewed every day; it is neither stored nor passed on to any third party.

A first-party audience measurement cookie (30 days) remembers the source of your visit — search engine, social network, AI assistant, shared link — in order to know which content makes Cartia known and to avoid counting the same person several times when they open several links. It contains no personal identifier, does not allow any tracking from one site to another, and is neither shared nor resold.

To find out which pages of the public site are useful, Cartia also measures, page by page, display time, reading depth and the number of clicks on buttons and links, together with the labels of those buttons. These measurements are aggregated, are not associated with any identified person, and never record what you type into a form.

In your merchant area (dashboard, counter, setup wizard), Cartia, by contrast, records, tied to your account, the screens you open, how long they stay displayed and the actions that modify your account or that fail (a refused scan, a camera that does not start, a rejected field). This information is used to help you put your card into service and to fix blocking points in the Service; it is based on Cartia’s legitimate interest. This log never contains what you type, the name or contact details of your customers, or your IP address; it places no additional cookie or storage on your device, and it is kept for 400 days at most. You have the rights described in section 10, including the right to object.

With your explicit consent (the “Cookies and audience measurement” banner), Cartia may activate the Meta pixel (Meta Platforms Ireland) in order to measure the effectiveness of our advertising campaigns on the Meta networks. This tracker is not placed if you decline. You can change your choice at any time via the “Cookies” link in the footer.

9. Security

Cartia implements appropriate technical and organizational measures: authentication, multi-tenant access control (isolation of organizations), encryption in transit via HTTPS/TLS, logging, rate-limiting on certain flows. Data is stored on Hetzner Cloud infrastructure in Germany (EU). As no system is free of risk, we invite you to use strong passwords and to report any suspicious incident to legal@cartia.fr.

10. Your rights (GDPR)

Depending on your situation, you have in particular the following rights:

• access, rectification, erasure;
• restriction and objection;
• portability, where applicable;
• withdrawal of consent, where the processing is based on it;
• complaint to the CNIL (the French data protection authority, cnil.fr).

For End Members: contact first the merchant with whom you enrolled. From the Cartia dashboard, the merchant can export or anonymize a customer record (a flow already available in the product for authorized roles).

For merchants / SaaS users: contact legal@cartia.fr stating your request and the information needed to identify you. We respond within the legal deadlines.

11. Minors

The SaaS Service is intended for professionals. Merchants’ loyalty programs may concern a wide audience; the merchant is responsible for defining an appropriate policy (minimum age, parental information) according to its activity.

12. Changes

This policy may be updated to reflect changes in the Service or in the law. The “last updated” date at the top of the page is authoritative. In the event of a material change, reasonable information will be provided to the users concerned.

13. Contact

For any question about this policy or the exercise of your rights: legal@cartia.fr. Publisher: Shams Factory, SIRET 88889743600026, 43 Rue Talma, 94400 Vitry-sur-Seine.

Legal notice · Terms of use · Data processing agreement (DPA) · Back to home