BoxCart
Legal

Privacy Policy

How we handle your data and protect your privacy.

Last updated: 27th October 2026.

Who We Are

BoxCart is a click & collect ordering plugin for WordPress. This policy covers the website at boxcart.dev and the BoxCart plugin itself (both the free build on WordPress.org and the paid Pro build sold through our website). BoxCart is made by Norwich Website Design Ltd, registered in England and Wales (company no. 17355394), which is responsible for your data under this policy.

What Data We Collect and Why

Website Forms

Our website uses Gravity Forms to collect contact, support, feature-suggestion, and custom-development enquiries. When you submit a form we collect the information you provide — typically your name, email address, website URL (if relevant), and message. This is used solely to respond to your enquiry.

Some of our forms include an optional checkbox to subscribe to our newsletter. If you tick it, your email address and name are sent to MailerLite (see below) so we can email you product updates. If you don’t tick it, nothing is sent to MailerLite.

Enquiries through Facebook and Instagram

If you ask for a free mock-up of your shop through a form on Facebook or Instagram, Meta passes us the details you give in it: usually your name, shop name, email address, phone number, website or social media page, and how you take orders now. We use them only to make your mock-up and contact you about it, and we don’t add you to our newsletter unless you ask. We keep them for as long as we need to follow up your request, usually no longer than 12 months.

Purchases & Licences

When you buy BoxCart Pro or start a free trial, checkout is handled by Freemius, our payment and licensing provider. Freemius collects the information needed to process your order (name, email, billing address, payment details) and issues you a licence key and invoices. We receive your name, email, and licence/plan information from Freemius so we can provide support and send product emails.

Payment card details are handled by Freemius’s payment processor (Stripe or PayPal, depending on your choice at checkout) and never touch our servers.

Plugin Diagnostics (Opt-In)

The BoxCart plugin uses the Freemius SDK to handle licensing and, if you opt in, to send anonymous usage diagnostics (WordPress version, PHP version, plugin version, site URL, admin email). You are offered a clear choice to skip this during activation, and you can disable it at any time from the plugin’s Account screen. We never collect your customers’ data or the contents of your store.

Links in Our Emails

When we email a food business about our Click & Collect Websites service, the link to that page carries a short code for the business. When someone follows that link, the page notes the code and the time as it opens. That tells us the business has had a look, so we can follow up sensibly, or leave them alone.

Noting the click doesn’t use cookies, tracking pixels or anything stored on your device, and we don’t record your IP address with it. We don’t track whether our emails are opened. Clicks are seen only by us and deleted automatically after 12 months. We do this on the basis of our legitimate interest in following up our own business emails; you can object at any time, and if you reply “no thanks” to the email we won’t contact you again. There’s more on how we contact businesses in the Norwich Website Design privacy policy.

Cookies

Our website uses a minimal number of cookies:

  • Consent cookies — set by our cookie banner (Complianz) to remember your cookie preferences, so we only load optional cookies you have agreed to. No personal information.
  • Roadmap voting cookie — remembers which roadmap features you voted for so you can’t vote twice. Feature IDs only, expires after 30 days.
  • Gravity Forms cookies — Gravity Forms may set short-lived cookies to prevent duplicate submissions and to preserve partial form data. No personal information beyond what you’ve typed into the form.
  • Cloudflare Turnstile — used on our contact and enquiry forms and our newsletter sign-up to tell real people from automated spam. It checks signals such as your IP address and browser details to decide whether a submission comes from a person, and may use a strictly necessary cookie or browser storage to complete that check. It is not used for advertising or to profile you for marketing. See the Cloudflare Turnstile privacy notice.
  • Cloudflare security cookie (__cf_bm) — set by the security network our host uses, on any visit to boxcart.dev, to tell people from bots. Strictly necessary, expires after 30 minutes, and not used to track you.
  • WordPress session cookies — set when administrators log in. Essential for site functionality, expire when you close your browser or after 14 days with “Remember Me”.
  • Google Analytics cookies (optional) — set only if you consent to analytics in our cookie banner. Google Analytics helps us see how many people visit and which pages are useful, so we can improve them. IP addresses are anonymised and the data is never used for advertising. These cookies expire after up to 2 years, and you can withdraw consent at any time.

Analytics cookies are optional and load only after you agree to them in our cookie banner. You can change or withdraw your choice at any time using the cookie settings link in the site footer. We do not use advertising or cross-site tracking cookies.

Embedded Content

Pages on this site may include embedded content (e.g. videos, images). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content.

Who We Share Your Data With

We use the following trusted third-party processors. Each handles your data under its own privacy policy, which we’ve linked for your reference:

  • Freemius — payment processing, licence issuance, customer invoices, and subscription management for BoxCart Pro. See the Freemius privacy policy.
  • Stripe / PayPal — payment card processors used by Freemius at checkout. Card data goes directly to them and is never seen or stored by us.
  • MailerLite — email marketing for our newsletter, when you opt in. See the MailerLite privacy policy.
  • Meta (Facebook and Instagram) — runs Facebook and Instagram, where our adverts and our mock-up request form appear. If you send us your details through that form, Meta passes them to us. See the Meta privacy policy.
  • Google (Google Analytics) — consent-gated website analytics that show us how the site is used, with IP anonymisation enabled and no advertising use. Loaded only if you agree to analytics cookies. See the Google privacy policy.
  • Cloudflare (Turnstile) — spam protection on our forms. Receives your IP address and browser details in order to check whether a submission is human. Applied on the pages that carry a form. See the Cloudflare Turnstile privacy notice.
  • Our hosting provider — OnRocket (UK/EU) hosts our website. They process your data only to deliver the site to you.
  • WordPress.org — when you install or update the free BoxCart plugin from the WordPress.org repository, your WordPress site communicates with WordPress.org for update checks. Anonymous aggregate install stats are visible on the plugin’s wp.org page. See the WordPress.org privacy policy.

We do not sell your personal data, and we do not share it with anyone outside this list.

How Long We Retain Your Data

  • Website form submissions — kept in our email system for as long as needed to resolve your enquiry, typically no longer than 12 months.
  • Mock-up requests from Facebook or Instagram — kept for as long as needed to follow up your request, typically no longer than 12 months.
  • Email link clicks — deleted automatically after 12 months.
  • Newsletter subscribers — kept in MailerLite until you unsubscribe (every email we send includes an unsubscribe link).
  • Customer & licence records — retained in Freemius for as long as you hold an active licence with us, plus the period we’re legally required to keep records of the transaction (typically 6 years under UK tax law).

Your Rights Over Your Data

Under UK GDPR you have the right to:

  • Ask what personal data we hold about you.
  • Ask us to correct inaccurate data.
  • Ask us to delete your data (subject to any legal retention obligations such as tax records).
  • Ask us to export your data in a portable format.
  • Withdraw consent for marketing emails or analytics at any time.

To exercise any of these rights, contact us through the support page. You can also lodge a complaint with the UK regulator, the Information Commission’s Office (ICO), at ico.org.uk, if you’re unhappy with how we’ve handled your data.

Where Your Data Is Sent

Our website is hosted in the United Kingdom / European Economic Area. Freemius is headquartered in Israel and operates globally. MailerLite operates globally with primary infrastructure in Europe and the United States. Transfers outside the UK/EEA are covered by each provider’s Standard Contractual Clauses or equivalent safeguards, as set out in their privacy policies linked above. If you consent to analytics, Google Analytics data may be processed by Google on servers in the United States; Google is certified under the EU-US Data Privacy Framework and also relies on Standard Contractual Clauses for such transfers. Cloudflare, which runs the spam check on our forms, operates globally and covers transfers with Standard Contractual Clauses and the EU-US Data Privacy Framework.

Security

We use HTTPS across our website and select processors that meet industry security standards. No internet transmission can be guaranteed 100% secure, but we take reasonable steps to protect your data.

Contact

For any privacy-related question or request, please use the contact form on our support page. We respond within 7 days.