How LaterCart handles your data

LaterCart is a wishlist-style web app and browser extension for products you almost bought. You save a product reference instead of buying it, let it wait, and decide later. LaterCart is not a shop. It does not sell products, place orders, or process store payments.

This policy describes what personal data LaterCart collects, why, and what rights you have. We try to collect only what the product needs to work.

LaterCart is operated by Jon Kevin Wong Gutierrez as an individual in Switzerland. For the first stage of the project, LaterCart does not operate through a separate company.

For privacy questions and requests, contact hello@getlatercart.com.

Account data. Your email address and authentication identifiers. If you sign in with Google, we also receive the name and profile picture connected to your Google account.

Saved product data. The items you choose to save: product title, product URL, shop or domain name, image URL, price and currency, category label, wishlist name, personal notes, want level, saved date, waiting time and decision date, status, and notification settings.

Price tracking data. If you turn on price tracking for an item, we store the prices we observe on that item's public product page over time.

Email data. Whether decision reminders and price-drop emails are enabled, and delivery information such as whether an alert was claimed, retried, or sent. For a price alert, a restricted delivery record freezes the recipient and exact email content before sending so a technical retry cannot change or duplicate the message.

Technical data. IP address, browser and device information, request logs, error information, and similar data generated when you use the website, app, or extension. We use this to keep the service running and secure.

Payment data. If you buy a paid plan, our payment provider processes your payment details directly. See the Payments section below.

The extension can detect product information on shopping pages you visit, such as the product title, image, and price. Nothing is saved to your LaterCart account until you confirm the save. You can review and edit detected details before saving.

The extension only uses the browser permissions it needs to read product-page information and save items to your account. It does not intentionally collect your unrelated browsing history, and it does not read payment details, passwords, or form input on shop pages.

The extension may store a small amount of data locally in your browser, such as your connection state, recent save status, and per-site preferences like a dismissed or disabled nudge. This local data stays in your browser unless you save an item.

• To create your account and let you sign in.
• To provide the service: saving, showing, organizing, updating, and archiving wishlist items.
• To calculate waiting times and decision dates.
• To send decision reminder and price-drop emails when each preference is enabled.
• To check prices for items you track, where the shop page allows it.
• To handle billing for paid plans.
• To keep the service secure, prevent abuse, and debug errors.
• To respond to support requests.
• To comply with legal obligations that apply to us.

If we add product analytics or error monitoring tools in the future, we will name them in this policy before they are used. We are preparing to use Google AdSense to fund the free version of LaterCart; the advertising disclosures below apply once ads are enabled.

Where the GDPR or similar laws apply, we rely on the following legal bases:

• Performance of a contract: providing your account, wishlists, reminders, price tracking, and paid plans.
• Legitimate interests: keeping the service secure, preventing abuse, maintaining logs, and improving reliability.
• Consent: where we ask for it, for example optional features that need it. You can withdraw consent at any time.
• Legal obligations: bookkeeping, tax, and responding to lawful requests.

LaterCart may email you when a saved item is ready to revisit. If you explicitly enable price-drop emails and keep Price Watch active for an item, LaterCart may also email you after a meaningful confirmed price decrease. These emails relate only to items you saved. You can control decision reminders and price-drop emails separately in account settings. Transactional account emails may still be sent where necessary, for example about billing or security.

Paid plans are processed by Stripe. Your card details go directly to the payment provider; LaterCart does not receive or store full card numbers. We receive information needed to manage your plan, such as your subscription status and billing tier.

We use a small number of service providers to run LaterCart. They process data on our behalf and only as needed to provide their service:

• Vercel: website and app hosting, serverless functions, and scheduled jobs.
• Supabase: authentication and database.
• Google: sign-in with Google, if you choose that login method, and Google AdSense advertising once ads are enabled.
• Resend: sending reminder, price-drop, and transactional emails.
• Stripe: payment processing for paid plans.
• No standalone analytics provider is currently used. This policy will be updated before one is added.

When AdSense is enabled, Google may process device and browser information, IP address, page and ad interactions, cookie or similar identifiers, and consent signals to select, deliver, limit, secure, and measure advertising. Depending on your region and choices, ads may be personalized, non-personalized, or limited. LaterCart does not give Google your private wishlist notes or account credentials for advertising.

A current list of processors and their documentation can be requested via the contact email below.

LaterCart separates cookies and similar storage into three categories:

Essential. Always on, because they are needed for login, security, and core app features such as your saved products. This includes authentication cookies and the local storage the app and browser extension need to work. Your consent choice itself is stored locally so we do not ask again.

Analytics (optional). Off unless you turn it on. Used to understand how LaterCart is used, in aggregated form, so we can improve the product. No analytics vendor is connected today; if one is added, it will only run with your consent and will be named in this policy.

Marketing and advertising (optional). Used for optional attribution and, once enabled, advertising. Where consent is required, Google advertising choices are collected through a Google-certified consent platform. You may be offered personalized, non-personalized, or limited ads depending on your location and choice. The LaterCart marketing toggle remains off by default and controls LaterCart's own optional marketing storage; Google's advertising choices are shown separately when applicable.

LaterCart may use aggregated, non-identifying shopping insights, such as overall trends across many users, to understand usage and improve the service. We do not sell your personal wishlist data by default, and we do not build individual shopping profiles for sale. Any change to this would require an update to this policy and, where required, your consent.

You can change your choices at any time via the Cookie settings link in the footer of every page.

Our service providers may process data outside Switzerland and the EU/EEA, including in the United States. Where that happens, we rely on recognized safeguards such as adequacy decisions or standard contractual clauses offered by the provider.

We do not sell your personal data, and we do not sell your saved product lists, wishlist names, notes, or category labels. We share data only with the processors listed above, or where required by law, legal process, or to protect the security of the service and its users.

Account and wishlist data are kept while your account exists. We aim to retain routine technical and security logs for no longer than 30 days, unless a longer period is needed to investigate an incident or comply with law.

Account deletion is currently handled by request at the contact email below. We aim to delete or anonymize account and saved product data within 30 days of verifying the request. Encrypted backups may retain the data for up to 90 days, and we may retain billing records where required by law.

Depending on where you live, you have rights under the Swiss FADP, the GDPR, or similar laws, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data.
• Receive a copy of your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Complain to a supervisory authority, such as the Swiss FDPIC or your local data protection authority.

To exercise any of these rights, or to request account deletion, email hello@getlatercart.com from the address connected to your account. We may need to verify your identity before acting on a request.

We use account-based access controls, encrypted connections, server-side secrets, and database row-level access rules to keep each user's saved items private. Access to production data is limited to what is needed to operate the service.

No online service can guarantee perfect security. Please use a strong password and do not send passwords or payment details through support messages.

LaterCart is not directed at children. You must be at least 16 years old to use LaterCart, or older where your local law requires it. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as LaterCart changes. If a change is significant, we will make it visible in the app or by email. The effective date at the top shows the latest version.

Jon Kevin Wong Gutierrez operates LaterCart as an individual in Switzerland. For privacy questions and requests, contact hello@getlatercart.com.