Privacy policy

1. Who operates Spellcart

Spellcart is published under XCC and operated by Alexander Laszlo James Barnett, a New Zealand sole trader. The operator's postal contact address is 27A Fourteenth Avenue, Tauranga 3112, New Zealand. Privacy enquiries can be sent to support@spellcart.com.

A participating merchant operates its own store and checkout. Its privacy notice also applies to shopping, delivery, payments and customer accounts with that store.

2. Information we handle

• Merchant accounts: store or business name, email, platform, approved store domains, campaign settings, plan and subscription status. Direct accounts also have a password hash and sign-in sessions; Wix installations use installation and account identifiers for access.
• Shopper reward sessions: a random browser session identifier, store identifier, selected game, game actions and outcomes, timestamps, reward code, expiry, cart reference and claim or redemption status. Spellcart does not require a shopper's name, email or delivery address to play.
• Order attribution: connected-store order events can contain customer and checkout information while being processed. Our attribution records keep the matching order identifier and number, reward reference, amount, currency and payment, refund or cancellation state. We use these to connect rewards to confirmed orders and update revenue figures.
• Billing: payment-provider customer and subscription references, billing status and related event identifiers. Hosted billing providers collect payment details; Spellcart does not collect or store full payment-card numbers.
• Support and technical information: your name if supplied, account email, store context, message, ticket reference and delivery status. Our service and infrastructure providers also process network information such as IP addresses and request or error logs to deliver and protect the service.

3. Why we use it

We use information to create and authenticate accounts, connect stores, run games, issue and apply rewards, prevent repeated or unauthorized claims, maintain subscriptions, calculate merchant analytics, investigate errors and answer support requests. We may also use necessary records to meet legal obligations and resolve disputes.

Playing a reward game is optional. Without the session information needed for a game, we cannot reliably issue or apply a reward. Without required merchant account and billing information, we cannot provide the corresponding account or paid features. Please do not put passwords, full card details, API keys or sensitive identity documents into support messages.

4. Who receives it

• Your participating merchant receives reward and order information and store-level analytics for its own store.
• Wix provides installation, account, billing, coupon, cart and order integration for Wix stores. Store checkout and shopper payment processing remain with the store and its providers.
• Stripe provides hosted subscription checkout and billing management for direct Spellcart accounts where enabled.
• Railway hosts our application and PostgreSQL storage. Resend delivers support-request emails, including the merchant and message context attached to those requests.
• Authorized Spellcart support and administrators can access information needed for their work. We may disclose information when legally required or when necessary to address fraud, security incidents or a legal claim.

Providers may process information outside New Zealand. Their own privacy notices also apply to their services. Ask us if you need information about the providers involved in a particular request.

5. Browser storage and external content

Spellcart uses browser local storage for merchant sign-in tokens and shopper session identifiers, widget authorization and earned rewards. This helps restore a session and prevent repeat claims. Clearing site storage or blocking it can sign you out or interrupt access to a saved reward; it does not erase server records.

Some game effects load a graphics library from Cloudflare's cdnjs service. Loading that content sends ordinary connection information to that provider. The store or platform may use its own cookies and tracking technologies under its own notice.

6. Retention and uninstalling

Our production configuration caps detailed analytics-event retention at 90 days. This cap applies to event records, not automatically to all information held by Spellcart.

Account, subscription, reward, order-attribution and support records are separate. They may be retained to operate the service, resolve support or billing issues, prevent misuse or satisfy legal requirements. Service-provider logs, email copies and backups can have separate retention periods.

Uninstalling the Wix app disables its access and active sessions. Uninstalling does not itself automatically erase all stored records. Contact us to request deletion or to discuss what must remain and why.

7. Your choices and requests

You can ask for access to personal information we hold about you, ask us to correct it, request deletion, or raise a concern about its use. Email support@spellcart.com with enough context for us to locate the relevant account or reward. We may need to verify your identity before responding. Do not send identity documents unless we arrange an appropriate method with you.

For store purchases, delivery details or a store customer account, contact the merchant first. We can help the merchant investigate the Spellcart records involved. Some requests may be limited by legal duties, the rights of others or records needed for a dispute; we will explain any applicable limitation.

If a privacy concern is unresolved, you can contact New Zealand's Office of the Privacy Commissioner.

8. Changes and contact

We will update this notice when our information handling changes and show the revised date. Material changes will be brought to affected merchants' attention through an appropriate service notice.