Last updated: November 5, 2026
Loto Cart (“the App”) provides a slide-out cart drawer, with features such as free shipping and discount progress bars, upsells, free gifts, add-ons, bundles, a wishlist, shipping estimates and shareable carts (“the Service”), to merchants who use Shopify to power their stores. The App is operated by Shopibro LLC, 30 North Gould Street STE R, Sheridan, WY 82801, United States (“we”, “us”, “our”).
This Privacy Policy describes how personal information is collected, used and shared when you install or use the App in connection with your Shopify-supported store, and when shoppers use the cart drawer on your store. In this policy, “you” means the merchant who installs the App, and “your customers” or “shoppers” means the people who visit and buy from your store.
This policy also covers our website, lotocart.com (“the website”), including the contact and early-access forms on it. When we talk about website visitors, “you” also means anyone who visits the website.
When you install the App, it is automatically able to access certain types of information from your Shopify account. The App requests these access scopes:
| Access scope | What the App does with it |
|---|---|
| Read orders | Shows order counts, totals, item names and quantities, and abandoned-checkout counts and totals on your Home and Analytics pages. Looks up the order number, date and total for orders that came from a shared cart. Lets the App receive new-order notifications so it can credit Share Cart orders. The App’s own order queries don’t ask for customer names, emails or addresses. The new-order notifications Shopify sends do include them (see below). |
| Write products | Creates, updates and deletes the products the App manages for the Free Gift and Cart Add-ons features, including uploading an add-on image. Reads your products and collections for the cart preview, upsells and bundles. |
| Read shipping | Reads your delivery profiles so the Free Shipping bar can use your shipping thresholds. |
| Read discounts | Lists your active and scheduled discounts for the Active Deals, Discount Progress and Free Shipping features. |
| Read themes | Lists your themes and reads your theme settings to check whether the cart is switched on and which font it should use. |
| Read and write publications | Lists your sales channels and publishes the gift and add-on products the App creates, so shoppers can add them to the cart. |
| Read inventory | Requested for the inventory settings of the gift and add-on products the App creates. The App doesn’t read your stock levels. |
Order and analytics figures are read from Shopify when you open the page and added up in memory. We don’t copy them to our servers.
When an order is placed, Shopify sends the App a notification that contains the full order, including the customer’s name, email, phone number and billing and shipping addresses. The App uses only the order’s ID, number, total and the Share Cart attribute described below, and doesn’t store the rest.
Cart events. When a shopper opens the cart, starts a new cart, clicks checkout or adds a recommended product, the cart sends us a small event. The event we store contains only:
We don’t store the shopper’s name, email, IP address, browser details or customer ID with these events. They power the Home and Analytics pages in your admin. The cart token is a pseudonymous ID, not an anonymous one: Shopify also keeps it on the order placed from that cart, so in your store an event can be matched to an order. Events reach us through Shopify, which adds the logged-in customer’s Shopify ID (if there is one) to the request, and the request also carries the shopper’s IP address and browser details. We don’t store these with the event, but they can appear in our server logs (see section 4).
Share Cart (only if you turn it on). A shopper can create a link to their cart. The link contains the cart’s items, prices, discount codes, cart note and totals. Depending on your settings, it can also contain:
The link is encoded, not encrypted, so anyone who has it can read what’s in it, including the social network or messaging app it is posted to. When someone orders from the link, the sharer’s email is attached to that order as an order attribute you can see in Shopify. This happens even when the order is placed by someone else. The App then saves the sharer’s email together with the IDs of the orders their link brought in, as app data on your store in Shopify, so you can see sharers and their results in the admin. The order attributes are part of the orders in your store: you are responsible for them, and you can remove them in Shopify.
Logged-in customer email. When a customer is logged in to your store, Loto Cart’s storefront code places their email in the page, on every page, so Share Cart can fill in the sharer email. It isn’t sent to us. It leaves the page only if you turn on sharer emails in “Auto” mode, when it is added to share links as described above.
Data saved in the shopper’s browser. Some features save data on the shopper’s device, such as the wishlist and the address used for a shipping estimate. See section 4.
What the App never collects: shoppers’ payment details or passwords, their browsing outside the cart drawer, or their names and addresses on our servers.
We collect information through Shopify’s API and notifications, directly from the cart drawer on your store, and with the technologies below.
To keep the cart fast and remember choices between visits, the cart saves data in the shopper’s own browser using local storage and session storage. Apart from the cart events in section 3, this data stays on the shopper’s device and isn’t sent to us. There are two exceptions: the shipping-estimate address is entered into your store’s Shopify checkout to get shipping rates, and Share Cart can put it in a share link (see section 3).
| Feature | What’s saved | How long |
|---|---|---|
| Wishlist | Up to 50 saved products (name, image, price and when it was added) | Until cleared |
| Shipping estimates | The address entered for a shipping estimate (country, region and postcode, and, if entered, name, street address, city and phone) and the chosen shipping method. An address from a shared cart link can also be saved here. To get rates, the cart enters this address (name, street address, city, region, country and postcode) into your store’s Shopify checkout in the background. It also does this when the cart is first opened on a later visit, so rates are ready. Shopify keeps the address with that checkout. | Until cleared |
| Cart expiry | When the current cart’s timer ends, and the number of items in the cart | Until cleared |
| Analytics | The cart token for which an event was already sent, so each event is counted once per cart | Until cleared |
| Speed and display | Product and collection details from your store, kept to load faster, and which bundles are collapsed | About 10 minutes for product details; until cleared for the rest |
| Discounts and gifts | Small flags such as a discount code already applied or a gift prompt dismissed | Until the tab is closed |
On your store, the cart sets no cookies. It reads Shopify’s own discount-code cookie so a code applied by a discount link shows in the cart.
In the Loto Cart admin, we set three functional cookies, kept for up to one year. They remember your admin language, the theme you last selected, and whether you dismissed the language banner. Shopify sets its own cookies to sign you in.
In the App (the cart drawer and the Loto Cart admin), we don’t use advertising, tracking or analytics cookies, web beacons, tags or tracking pixels.
On our website, lotocart.com, we use:
_ga), which measure visits and are kept for up to 2 years._fbp), which measure visits and help us show and measure ads for Loto Cart on Facebook and Instagram. They are kept for up to 90 days.Google Analytics and the Meta Pixel load a few seconds after the page opens, or when you first scroll or click. To learn more about cookies, visit allaboutcookies.org.
Blocking cookies and storage. You and your shoppers can block or delete cookies and site data in the browser’s settings. If you do, the App still works, but choices such as the wishlist or your admin language won’t be remembered. Our website also works without them.
Our server records technical logs to keep the App running and fix problems. They can include your store’s domain, the type of notification Shopify sent, the Shopify customer ID in a privacy request, order numbers and amounts for usage-based charges, and error messages. They can also include requests relayed from your store, which Shopify tags with the logged-in customer’s Shopify ID when there is one, and the addresses of admin pages, which can include a sharer’s email. Our hosting providers also keep standard request logs for the App and the website, such as IP addresses, browser details and request times.
We use the information described above to provide the Service and operate the App, specifically to:
We use your customers’ information only to provide the Service to you. We don’t sell it, use it for advertising, or build profiles of shoppers.
We don’t use information from the App, about you or your customers, for targeted advertising, behavioural advertising or remarketing. The App doesn’t load advertising pixels or tracking scripts on your store or in the admin.
On our website, we use the Meta Pixel and Google Analytics to understand visits and to show you targeted ads for Loto Cart on other websites and apps. For more about how targeted advertising works, see the Network Advertising Initiative’s guide. You can opt out here:
If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) or similar laws give you rights over your personal information.
For information about you and your store, and about visitors to our website, we are the controller: we decide how it is used and are responsible for it. For information about your customers, you are the controller and we act as your processor. We handle it only to provide the features you turn on.
To use these rights, contact us (see section 20). We respond within one month, or within the time the law that applies to you requires.
Shoppers should contact the store they bought from. Shopify sends us privacy requests on your behalf, and we handle them as follows:
Your information may be transferred outside Europe, including to Canada and the United States, where Shopify processes data, and to the countries where our hosting provider’s servers are located. Where the law requires it, we rely on safeguards such as adequacy decisions or the European Commission’s Standard Contractual Clauses.
If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you these rights:
The categories of personal information we collect are described in section 3: identifiers (such as your store’s domain, your name and email from our website forms, a sharer’s email, cart tokens and cookie IDs), commercial information (such as Share Cart order IDs and cart events) and internet activity (within the cart drawer, and on our website). We don’t collect sensitive personal information. You can make a request yourself or through an authorized agent. We’ll verify the request and respond within 45 days. Shoppers should send requests to the store they bought from, and we’ll help the store respond.
The App doesn’t track you or your customers across third-party websites, so it doesn’t respond differently to “Do Not Track” signals, and we don’t allow third parties to collect personal information through the App for that purpose. On our website, Google Analytics and the Meta Pixel can collect information about your visits over time and across other websites. The website doesn’t respond to “Do Not Track” signals, but you can opt out as described in section 7. This policy is linked from our website, and you can review and correct your information by contacting us.
We keep information only as long as we need it to provide the Service, unless and until you ask us to delete it.
| Data | Kept until |
|---|---|
| Store connection (domain, access and refresh tokens, access scopes) | You uninstall the App. Deleted again when Shopify sends the store deletion request. |
| Cart events | You uninstall the App |
| Settings, plan status and Share Cart records (app data in Shopify) | You uninstall the App, when Shopify removes the app data with it. A single sharer’s record is deleted earlier when that customer asks for deletion. |
| Usage-based billing records (only for plans with usage fees) | About 48 hours after you uninstall, when Shopify asks us to erase your store’s data |
| Products the App created for Free Gift and Cart Add-ons (including add-on images) | You delete them in Shopify. They stay in your store after you uninstall. |
| Share Cart order attributes on orders in your store | You remove them in Shopify |
| Server logs | Up to 30 days |
| Website forms (contact and early-access requests) | Up to 2 years after our last contact with you, or earlier if you ask us to delete them |
| Website analytics and advertising cookies | As shown in section 4, or until you delete them |
| Data in the shopper’s browser | The shopper clears it, or it expires as shown in section 4 |
When you uninstall, your theme’s original cart is back right away. We delete your store connection and cart events as soon as Shopify tells us about the uninstall. About 48 hours later, Shopify asks us to erase your store’s data, and we delete the store data still on our servers. Server logs are deleted on the schedule above. Products the App created stay in your store until you delete them, because the App can no longer reach your store once it is uninstalled.
We take reasonable steps to protect your information. Traffic between Shopify, your store and the App is encrypted with HTTPS. We verify Shopify’s signature on every notification and on every event relayed from your store, and we keep only the information described in this policy. No method of transmission or storage is completely secure, so we can’t guarantee absolute security. If we learn of a breach that affects your information, we’ll notify you as the law requires.
The App is a business tool for merchants and isn’t directed at children. We don’t knowingly collect personal information from children under 13, or under 16 in the European Economic Area and the United Kingdom. If you believe a child has given us personal information, contact us and we’ll delete it.
You’re responsible for your store’s own privacy policy and cookie notice. If you use Loto Cart, mention that:
If we sell, merge or transfer all or part of our business or assets, or in the unlikely event of insolvency, your information may be transferred to the new owner. We’ll only do this if the new owner agrees to follow this policy, and we’ll let you know in the App or by email before your information becomes subject to a different policy.
The App and this website can contain links to other websites and services, such as Shopify, Google Fonts or the social networks shoppers can share a cart to. We’re not responsible for their content or their privacy practices. Their own privacy policies apply when you use them, so please read them.
This policy is governed by the laws of the United States and the State of Wyoming, where Shopibro LLC is registered, without regard to their conflict-of-law rules. This doesn’t take away any rights you have under the mandatory data protection laws of the place where you live.
By installing or using the App, or using our website, you confirm that you have read this policy and agree to how we handle information as it describes. Where the law requires a specific legal basis, we rely on the bases listed in section 8.
We may update this policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. When we do, we’ll update this page and the date at the top. We’ll announce important changes inside the App before they take effect.
For more information about our privacy practices, if you have questions, or if you would like to make a request or a complaint, email stephen@adsgun.com or write to Shopibro LLC, 30 North Gould Street STE R, Sheridan, WY 82801, United States.
Loto CartThanks! We'll email you the install link as soon as Loto Cart is live on the Shopify App Store.
Thanks for reaching out. We'll get back to you by email.