Privacy Policy

This policy explains what BTG Space Exploration and Cattle LLC (“we”, “us”) does with personal data in CartOS. We are the controller of the account data below. For the records you put into CartOS, you are the controller and we are your processor — we handle them on your instructions.

1. What we collect, and why

• Account data — your name, email address, password (stored only as a hash), company name and timezone. We need it to create your account, sign you in and contact you. Legal basis: performance of our contract with you.
• Billing data — your subscription and payment status. Card details go directly to our payment processor and are never stored on our servers. Legal basis: contract, and our legal obligation to keep financial records.
• Your business records — the contacts, companies, units, work orders, parts, deals, invoices and files you put into CartOS, which may include personal data about your own customers. We process these only to provide the service to you.
• Technical data — IP address, browser, and server and error logs, kept to keep CartOS secure, available and debuggable. Legal basis: our legitimate interest in operating a secure service.

2. What we don’t do

We do not sell or rent personal data. We do not show ads or run third-party advertising or tracking cookies. We do not use your business records to train machine-learning models. We do not make decisions with legal effects about anyone by automated means.

3. Who we share it with

Only the service providers CartOS runs on, each processing data solely to provide their service to us, under contract:

• Stripe — payments and subscription billing (Ireland and USA)
• Hetzner — hosting for the application, the database and the files you upload (Germany)
• Postmark — sending transactional email such as invoices and password resets (USA)
• Honeybadger — error and performance monitoring (USA)
• PostHog — product analytics and error tracking (USA)

We may also disclose data where the law requires it, or to establish or defend legal claims. If we are ever party to a merger or sale, data may transfer with the business, and this policy continues to apply until replaced by one no less protective. Where a provider processes data outside your country, we rely on the European Commission’s standard contractual clauses or an equivalent safeguard.

4. How it’s protected

Traffic to and from CartOS is encrypted in transit (TLS), and data at rest sits on encrypted storage. Passwords are stored only as salted hashes, and we cannot read them. Every record is scoped to one account at the application’s data layer, so one customer cannot read another’s. Access by us is limited to what is needed to operate CartOS and to support you. No system is perfectly secure, but we will notify you without undue delay if a breach affects your data, and within any period the law requires.

5. How long we keep it

We keep your data for as long as your account is open. Closing your account schedules deletion: you can reverse the closure until the scheduled date, and on that date the account’s data is permanently deleted from our live systems. Copies held in backups are removed as those backups age out of their retention cycle, and we keep the invoicing records tax law requires us to keep. Export anything you want to keep before the scheduled date — CartOS has a one-click export in Settings.

6. Your rights

Depending on where you live — including under the GDPR and the CCPA/CPRA — you may have the right to access, correct, delete, port or restrict the personal data we hold about you, to object to processing based on legitimate interests, and to withdraw consent. We do not sell or share personal data for cross-context behavioural advertising, and we will never discriminate against you for exercising a right.

Email us to exercise a right and we will respond within the time the law allows. If your data is in a customer’s CartOS account, ask that customer first — they control it and we act on their instructions. You may also complain to your local data protection authority.

7. Cookies

CartOS uses only the cookies it needs to work: one to keep you signed in and one to remember preferences such as light or dark mode. There are no advertising or third-party tracking cookies, so there is no consent banner to click.

8. Children

CartOS is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16; if we learn we have, we delete it.

9. Changes and contact

If this policy changes in a way that materially affects you, we will email account admins before it takes effect. Questions, requests, or anything else: mail@betterthangood.xyz.