Publisher: Shams Factory · SIRET 88889743600026 · 43 Rue Talma, 94400 Vitry-sur-Seine

Privacy policy

Last updated: October 28, 2026 · Contact: legal@cartia.fr

1. Who are we?

This policy describes how the publisher of the Service identified at the top of the page (“Cartia”, “we”) processes personal data in connection with the digital loyalty SaaS service available at cartia.fr and through the associated applications (including Cartia Counter).

Rationalab is, like Cartia, a name and a business of Shams Factory. It is not a separate company: same legal entity, same SIRET. The data controller for merchant accounts, and the data processor for loyalty program members, is Shams Factory.

Data protection / legal contact: legal@cartia.fr.

2. Scope and roles

Cartia processes data in two main contexts:

• Merchant accounts (SaaS Customers) - Cartia is the data controller for account creation, authentication, subscription billing, support and platform security.
• End Members of loyalty programs - the merchant determines the purposes of its program (enrollment, balances, rewards, communications). In this context, the merchant is in principle the data controller; Cartia acts as a technical data processor to host and operate the Service.

At sign-up, a single box covers acceptance of the terms and of this policy, and agreement to receive the merchant’s Wallet notifications and marketing emails. The “program enrollment” and “marketing” consents are recorded separately.

3. Data collected

3.1 Merchants and teams

• identity and contact details (name, email, possibly phone number);
• organization and shop information (name, displayed address, settings);
• account data and technical logs (login, security actions);
• billing and subscription data (Free, Pro or Business Plan, status, history of payment events) - card payment is processed by Stripe;
• exchanges with support;
• trade name, shop sign and logo, when they are published as commercial references.

Commercial references. Cartia may publish a merchant’s trade name, shop sign or logo in order to present the merchant as a user of the Service, under the conditions of article 10 of the terms of use. Where these elements make it possible to identify a natural person carrying on a professional activity, they constitute personal data.

3.2 End Members (the merchant’s customers)

• enrollment data (first name, last name, date of birth, gender, email and/or phone number);
• balances / progress (stamps, points), history of EARN / REDEEM operations;
• consents (program, marketing) and associated timestamps;
• technical identifiers linked to the digital card / QR (enrollment tokens, card references);
• where applicable, data needed to display the card on a phone.

Apple / Google Wallet. Customers can add their card to Apple Wallet and Google Wallet. Technical pass identifiers (serial number, authentication tokens, balance) are then processed through the Apple and/or Google services needed to display and update the card on the End Member’s device.

Wallet notifications - important distinction (GDPR). Updates to the balance or status of the card (e.g. points earned after a scan) are transactional notifications tied to the performance of the program: they do not require a separate marketing opt-in, subject to clear information at enrollment. Cartia also relies on Wallet notifications and marketing emails to send the merchant’s offers and campaigns. These messages are based on the box ticked at sign-up. To stop receiving Wallet notifications, remove the merchant’s card from your Apple Wallet or Google Wallet. To stop receiving marketing emails, use the “Unsubscribe” link in each marketing email: it also ends the offers sent to the card. The user can also turn off notifications at the level of the pass or of the Wallet app.

3.3 Technical data and audience measurement

• cookies and storage strictly necessary for operation (session, security, essential preferences);
• first-party analytics (audience and usage measurements carried out on Cartia’s behalf, without placing third-party advertising cookies of the ad-network type) - intended to improve the Service and its reliability;
• usage log of the merchant area (dashboard, counter, setup wizard), tied to the account: screens viewed, display time, actions that modify the account or that fail - intended to support the setup of the Service and to fix blocking points in the Service.

4. Purposes and legal bases

• Provision of the Service (account, program, QR, scan, dashboard) - performance of the contract (merchant) / legitimate interest or contract, as the case may be (End Members via the merchant).
• Billing and Plan management (Free, Pro, Business) via Stripe - performance of the contract and accounting obligations.
• Security, fraud prevention, rate-limiting - legitimate interest / legal obligation.
• Support and product improvement - legitimate interest; first-party analytics in this context.
• Cartia marketing communications (to merchants) - consent or legitimate interest depending on the channel and status (prospect / customer), with a right to object.
• Commercial references (publication of a merchant’s trade name, shop sign or logo on Cartia’s website and official accounts) - Cartia’s legitimate interest in presenting the Service and its users, with a right to object: the merchant may request removal at any time, with no effect on the subscription, under article 10 of the terms of use. This processing is not carried out in respect of Customers who have not expressly accepted these provisions.
• Merchant marketing to its End Members - under the merchant’s responsibility, based on the consent collected at sign-up where required.
• Responding to rights requests and compliance - legal obligation.

5. Recipients and processors

Data may be disclosed, to the extent necessary, to:

• authorized Cartia staff (support, operations, billing);
• Stripe for payment of paid Plans (Pro, Business);
• Hetzner Online GmbH - hosting provider of the Service (servers and database located in Germany, European Union);
• o2switch - storage of encrypted backup copies in France, European Union; the private decryption key is not entrusted to this provider;
• where applicable, competent authorities upon legal request, or advisers (lawyer, accountant) under confidentiality.

When Cartia publishes a commercial reference, the trade name, shop sign or logo become visible to the public on cartia.fr and, where applicable, on Cartia’s official accounts (Instagram, Facebook, LinkedIn, TikTok). Those platforms then process that content under their own terms.

Cartia does not sell personal data. Transfers to Apple and/or Google related to adding and updating Wallet passes are limited to the technical data necessary for the card to work on the End Member’s device.

For the processing of End Members on behalf of the merchant, see also the data processing agreement (DPA).

6. Transfers outside the EU

Application hosting and the database are located in Germany (Hetzner Cloud), and therefore within the European Union. Certain providers (notably Stripe, Apple, Google) may carry out processing involving transfers governed by appropriate safeguards (standard contractual clauses / recognized mechanisms). For any question: legal@cartia.fr.

7. Retention periods

• Active merchant account: for the duration of the contractual relationship, then archiving limited to what is necessary (billing, evidence) in accordance with statutory periods (notably accounting obligations, up to 10 years for certain documents).
• Inactive / closed account: deletion or anonymization of data that is not necessary within a reasonable time after closure, except where retention obligations apply.
• End Members: for the duration of the program and of the merchant–member relationship, then according to the merchant’s instructions and the reference framework of the CNIL (the French data protection authority) applicable to commercial activities (current management, then intermediate archiving).
• Anonymization: when an End Member record is anonymized through the product, personal identifiers are removed / replaced; the operational history may be kept in non-identifying form to preserve the integrity of the ledger.
• Technical / security logs: limited duration, proportionate to diagnostic and security needs.
• Cookies / audience measurement: short durations compatible with the purpose (session or limited rolling period for first-party statistics).
• Merchant area usage log: 400 days at most.
• Commercial references: for the duration of the contractual relationship, until a request for removal (removal within ten (10) business days from media controlled by Cartia) or until definitive termination. Copies, shares or archives already taken up by third parties cannot be guaranteed.

Backup copies are used for recovery after an incident, with access restricted to authorized people. Dumps are kept for 14 days on the Hetzner VPS and 30 days at o2switch. An additional backup copy is kept on physical media. If an older backup is restored, subsequent deletions and anonymizations must be reapplied before the service resumes.

8. Cookies and trackers

Cartia uses essential cookies and storage for the operation of the Service (authentication, security, load balancing, strictly necessary preferences). These trackers do not require consent under cookie regulations when they are indispensable to the service requested.

Two first-party preference cookies (12 months) remember your display choices: cartia_locale stores the language you chose, and is set only when you choose a language or follow a link containing ?lang=; cartia_currency stores the currency you chose, and is set only when you choose a currency. If you decline the offer to show prices in your country’s currency, your choice is remembered in your browser’s local storage (cartia_currency_suggestion_dismissed); that country is inferred from your IP address at the time of the visit, using a local database, and is neither stored nor passed on to any third party.

Audience measurement also relies on first-party analytics (technical events on Cartia’s side, with no advertising network for this measurement). Pages of the public site are counted server-side, without any advertising tracker: the IP address is used only, at the moment of the visit, to infer an approximate location (city) and a technical identifier that is renewed every day; it is neither stored nor passed on to any third party.

A first-party audience measurement cookie (30 days) remembers the source of your visit — search engine, social network, AI assistant, shared link — in order to know which content makes Cartia known and to avoid counting the same person several times when they open several links. It contains no personal identifier, does not allow any tracking from one site to another, and is neither shared nor resold.

To find out which pages of the public site are useful, Cartia also measures, page by page, display time, reading depth and the number of clicks on buttons and links, together with the labels of those buttons. These measurements are aggregated, are not associated with any identified person, and never record what you type into a form.

In your merchant area (dashboard, counter, setup wizard), Cartia, by contrast, records, tied to your account, the screens you open, how long they stay displayed and the actions that modify your account or that fail (a refused scan, a camera that does not start, a rejected field). This information is used to help you put your card into service and to fix blocking points in the Service; it is based on Cartia’s legitimate interest. This log never contains what you type, the name or contact details of your customers, or your IP address; it places no additional cookie or storage on your device, and it is kept for 400 days at most. You have the rights described in section 10, including the right to object.

With your explicit consent (the “Cookies and audience measurement” banner), Cartia may activate the Meta pixel (Meta Platforms Ireland) in order to measure the effectiveness of our advertising campaigns on the Meta networks. This tracker is not placed if you decline. You can change your choice at any time via the “Cookies” link in the footer.

9. Security

Cartia implements appropriate technical and organizational measures: authentication, multi-tenant access control (isolation of organizations), encryption in transit via HTTPS/TLS, logging, rate-limiting on certain flows. Data is stored on Hetzner Cloud infrastructure in Germany (EU). As no system is free of risk, we invite you to use strong passwords and to report any suspicious incident to legal@cartia.fr.

Cartia keeps backups on its VPS in Germany, an encrypted copy at o2switch datacenters in Clermont-Ferrand, France, and an additional copy on physical media. Dumps are created every 6 hours. Configured retention is 14 days on the VPS and 30 days at o2switch. VPS monitoring alerts if no successful transfer to o2switch has been recorded for 8 hours.

If Cartia plans to permanently shut down, we commit to notifying each merchant and emailing them an export of their customer records and available loyalty balances before closure, regardless of their plan. Delivery is made to the account owner’s address after verifying the recipient, through an encrypted file or a secure link.

10. Your rights (GDPR)

Depending on your situation, you have in particular the following rights:

• access, rectification, erasure;
• restriction and objection;
• portability, where applicable;
• withdrawal of consent, where the processing is based on it;
• complaint to the CNIL (the French data protection authority, cnil.fr).

For End Members: contact first the merchant with whom you enrolled. From the Cartia dashboard, the merchant can export or anonymize a customer record (a flow already available in the product for authorized roles).

For merchants / SaaS users: contact legal@cartia.fr stating your request and the information needed to identify you. We respond within the legal deadlines.

Commercial references. You may object to the publication of your trade name, shop sign or logo, or request their removal, at any time and without justification, by writing to legal@cartia.fr. Removal has no effect on your subscription. See article 10 of the terms of use.

11. Minors

The SaaS Service is intended for professionals. Merchants’ loyalty programs may concern a wide audience; the merchant is responsible for defining an appropriate policy (minimum age, parental information) according to its activity.

12. Changes

This policy may be updated to reflect changes in the Service or in the law. The “last updated” date at the top of the page is authoritative. In the event of a material change, reasonable information will be provided to the users concerned.

13. Contact

For any question about this policy or the exercise of your rights: legal@cartia.fr. Publisher: Shams Factory, SIRET 88889743600026, 43 Rue Talma, 94400 Vitry-sur-Seine.

Legal notice · Terms of use · Data processing agreement (DPA) · Back to home