Privacy Policy
Last updated: 2026-07-01
This Privacy Policy explains how Youngnae Son, an individual based in Japan ("we", "us", "our"), collects, uses, and protects your personal information when you use CartOrCarry (the "Service") at https://cartorcarry.com.
By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
1. Who is responsible for your data
The operator of CartOrCarry is responsible for personal data processed through the Service.
- Operator: Youngnae Son (individual, Japan)
- Contact: siverse2025@gmail.com
For payment transactions, our reseller Paddle acts as Merchant of Record and is an independent controller of the data it processes for billing and tax (see Section 6).
2. What we collect
a) Information you provide
- Account information: your email address (used to create and verify your account).
- Support messages: any information you include when you contact us.
b) Images you submit for scanning
- When you use the scan feature, the image you capture or upload (for example, a photo of a price tag or a screenshot) is processed to recognize the price and product name. See Section 4 for how images are handled.
c) Usage and technical information
- Basic technical data such as approximate device/browser type, and a record of actions needed to run the Service — for example, your scan/credit balance, purchase records, and counts used to apply free allowances, rate limits, and abuse prevention (which may include device or network identifiers).
d) Payment information
- When you buy credits or a pass, your payment details (such as card information) are collected and processed by Paddle, not by us. We receive only limited confirmation data (such as that a purchase succeeded and which product was bought). See Section 6.
We do not intentionally collect special-category (sensitive) personal data. Please do not submit images that contain sensitive personal information.
3. How we use your information
We use personal information to:
- create, verify, and secure your account;
- provide the scan, comparison, and currency-conversion features;
- track and apply your credits, passes, and free allowances;
- apply rate limits and prevent fraud and abuse (for example, detecting multiple accounts created to obtain extra free scans);
- confirm purchases and deliver credits after payment;
- respond to your support requests;
- maintain, troubleshoot, and improve the Service;
- comply with legal obligations.
4. How images are processed
To recognize prices and product names, images you submit are sent to automated recognition services, which currently include Google Cloud / Gemini (Google LLC) for optical character recognition and AI vision. This processing is necessary to provide the scan feature you request.
- Images are processed to return a recognition result (such as a price and product name).
- We do not use your images to build advertising profiles, and we do not sell your images.
- Retention of images is limited to what is needed to operate and troubleshoot the feature (see Section 7). Where technically possible, images are not stored longer than necessary.
Your use of this feature is also subject to the relevant provider's terms and privacy practices.
5. Legal bases (where applicable, e.g. for EU/UK users)
Where data-protection law requires a legal basis, we rely on:
- Performance of a contract — to provide the Service you sign up for and purchase;
- Legitimate interests — to secure the Service, prevent abuse, and improve features;
- Legal obligation — to meet record-keeping and other legal requirements;
- Consent — where we ask for it (you can withdraw consent at any time).
6. Payments and Merchant of Record (Paddle)
Purchases are processed by Paddle.com as Merchant of Record. When you pay, Paddle collects and processes your payment and billing information under Paddle's own privacy policy, as an independent controller, including for tax and fraud-prevention purposes. We receive transaction confirmation data needed to deliver your credits and keep records, but not your full card details.
7. Sharing and sub-processors
We do not sell your personal information. We share it only with service providers that help us run the Service, including (currently):
- Paddle — payments, billing, tax, refunds (Merchant of Record);
- Google Cloud / Gemini (Google LLC) — image recognition (OCR/AI);
- Render — application hosting;
- exchange-rate data provider(s) — to convert currencies;
- email and infrastructure providers used to operate the Service.
These providers may process data in countries outside your own, including outside the EU/UK and outside Japan. Where required, we take steps to ensure appropriate safeguards for such transfers. We may also disclose information where required by law or to protect our legal rights.
8. Data retention
We keep personal information only as long as needed for the purposes above — for example, to maintain your account and balances, meet legal and accounting requirements, and resolve disputes. When information is no longer needed, we delete or anonymize it. You can ask us to delete your account (see Section 9).
9. Your rights
Depending on where you live, you may have rights to:
- access the personal information we hold about you;
- correct inaccurate information;
- delete your information ("right to erasure");
- object to or restrict certain processing;
- request a copy of certain data in a portable format;
- withdraw consent where processing is based on consent.
To exercise any of these, email siverse2025@gmail.com. We will respond within the time required by applicable law. You also have the right to complain to your local data-protection authority.
10. Security
We take reasonable technical and organizational measures to protect your information, including HTTPS encryption in transit and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children
The Service is not directed at children under the age required for consent in your country. We do not knowingly collect personal information from such children. If you believe a child has provided us with personal information, contact us and we will delete it.
12. International users
The Service is operated from Japan and made available to users in selected countries, including Korea, the United States, and Japan. By using the Service, you understand that your information may be processed in Japan and in the countries where our providers operate.
13. Changes to this Policy
We may update this Policy from time to time. We will post the updated version here and change the "Last updated" date. Significant changes will be notified by reasonable means.
14. Contact
Questions about privacy, or to exercise your rights, contact us at siverse2025@gmail.com.
This Policy is available in other languages for convenience. If there is any conflict between versions, the English version prevails.