Privacy and cookie policy

Who we are

This website is operated by Shopping Cart Holdings, Inc., trading as Monotote, 530 7th Avenue, New York, NY 10018, United States (“Monotote”, “we”, “us”). For the personal data described in this policy, we are the controller: we decide why and how it is processed.

Privacy questions and requests: privacy@monotote.com. General contact: hello@monotote.com or +1 646-576-7005.

This policy covers monotote.com. The Monotote partner dashboard and our products embedded on publisher websites are governed by our agreements with those customers; see Monotote as a processor below.

In short

• You can browse this site without giving us any personal data. We do not require an account.
• We only collect what you type into the contact form, plus the technical data every web server receives.
• Analytics and marketing cookies (Google Analytics, Meta Pixel and Leadinfo, all loaded through Google Tag Manager) are set only after you accept them in the cookie banner. Choosing “Only necessary” means nothing is loaded from Google, Meta or Leadinfo.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• You can change your cookie choice at any time via “Cookie settings” in the footer.

What we collect and why

Contact and demo requests

Data: the details you enter in the contact form: name, work email address, company, website, role, the products you are interested in and your message. We also record the time of the submission, your IP address, browser type and the page the form was sent from.

Purpose: to answer your request, arrange a demo and follow up on it, and to protect the form against spam and abuse.

Legal basis (GDPR): taking steps at your request before entering into a contract (Article 6(1)(b)) and our legitimate interest in handling business enquiries and keeping the form secure (Article 6(1)(f)). Where you tick the consent box, you also consent to this processing (Article 6(1)(a)); you can withdraw that consent at any time.

How it travels: the submission is sent to our inbox as an email through our email delivery provider (see sharing). We do not store form submissions in a database on this website.

Technical and security data

Data: like every website, our server receives your IP address, the date and time of the request, the pages you request, the referring page and your browser and device type (user agent). Our hosting provider may keep these in server logs. If we enable Cloudflare Turnstile to filter automated form submissions, Cloudflare processes connection data for that purpose.

Purpose: delivering the site, keeping it secure, detecting abuse and troubleshooting.

Legal basis: our legitimate interest in running a secure, reliable website (Article 6(1)(f)).

Analytics and marketing (only with your consent)

Data: if you accept analytics cookies, Google Analytics 4 collects pseudonymous usage data: pages viewed, time on page, approximate location derived from your IP address (Google Analytics 4 does not store IP addresses), device and browser type, the site that referred you, and a random identifier stored in a cookie so that repeat visits can be counted. If you accept marketing cookies, two further tools run: the Meta Pixel (Facebook and Instagram advertising) records that you visited this site so we can measure the effect of our Meta campaigns and reach people who already showed interest, and Leadinfo identifies the company a visit comes from, based on the IP address and public business data, so our sales team can follow up with businesses that visited, together with the pages viewed. Google tags may also measure whether a Google advertisement brought you to the site.

Purpose: understanding how the site is used so we can improve it, and measuring the effect of our marketing.

Legal basis: your consent (Article 6(1)(a) GDPR and the ePrivacy rules on cookies). Until you consent, no analytics or marketing script is loaded and no such cookie is set. You can withdraw consent at any time via “Cookie settings”.

Email and other correspondence

If you email or call us, we process the contact details and content you provide to handle the conversation, on the basis of our legitimate interest in communicating with you or, where relevant, to perform a contract with your company.

What we do not do

• We do not sell or rent personal data.
• We do not use personal data from this website for automated decision-making with legal or similarly significant effects.
• This website is not directed at children under 16 and we do not knowingly collect their data.

Cookies

Cookies are small text files that a website stores in your browser. We use one strictly necessary cookie, and, only with your consent, cookies set by Google for analytics and by Meta and Leadinfo for marketing. Similar technologies such as local storage are covered by this section as well.

Your choices

• Cookie banner. On your first visit you can “Accept all”, choose “Only necessary”, or open “Manage” to pick categories. Your choice is remembered for 6 months, after which we ask again.
• Change your mind. Open Cookie settings at any time (also in the footer of every page). Withdrawing consent removes the Google, Meta and Leadinfo cookies set on our domain and stops further collection; it does not delete data those providers have already received.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, marketing cookies are unticked by default in the banner.
• Browser settings. You can block or delete cookies in your browser. Blocking the necessary cookie means we cannot remember your choice and will show the banner again. Google also offers a browser add-on to opt out of Google Analytics.

Cookies we use

Google Tag Manager itself does not set cookies; it is the container that loads the tags above and is loaded only after consent. Providers: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (privacy policy, how Google uses data from partner sites); Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, Ireland, for the Meta Pixel (Meta privacy policy; for the collection of pixel data Meta and Monotote act as joint controllers under Meta’s business tools terms); Leadinfo B.V., Rotterdam, the Netherlands (Leadinfo privacy policy). If we enable Cloudflare Turnstile on the contact form, Cloudflare may set a short-lived security cookie; it is strictly necessary and does not track you across sites.

Links to partner websites, the Monotote partner dashboard and social networks lead to sites with their own cookie and privacy policies.

Who we share data with

We share personal data only with service providers who process it on our behalf and under our instructions (processors), and where the law requires it.

• Email delivery: Mailgun (Sinch Email), United States, which transmits contact form submissions to our inbox.
• Hosting: our hosting provider, delta.blue, which runs the server that serves this website and keeps its logs.
• Analytics and tags (with consent): Google LLC, United States, for Google Tag Manager and Google Analytics 4; Meta Platforms Ireland Ltd for the Meta Pixel; Leadinfo B.V., the Netherlands, for company identification.
• Bot protection (if enabled): Cloudflare, Inc., United States, for Turnstile.
• Business tools: the email, calendar and CRM tools we use internally to answer your request and schedule a demo.
• Legal: authorities, courts or advisers where we are legally required to disclose data or to protect our rights, and a successor in the event of a merger or acquisition.

International transfers

Monotote is based in the United States, so personal data from visitors in the European Economic Area, the United Kingdom and Switzerland is transferred to the United States. Where our providers are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), we rely on that certification; otherwise we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) together with additional safeguards, or on your explicit consent where you have given it. You can ask us at privacy@monotote.com for a copy of the safeguards in place.

How long we keep data

• Contact and demo requests: for as long as needed to handle your request and the business relationship that may follow, and no longer than 24 months after our last contact unless a contract or legal obligation requires us to keep it.
• Server and security logs: for a limited period needed for security and troubleshooting, in line with our hosting provider’s retention settings.
• Analytics data: Google Analytics 4 user-level data is retained for 14 months; aggregated reports may be kept longer.
• Marketing data: Meta retains pixel data under its own policy (typically up to 180 days for website custom audiences). Leadinfo company visit records are kept in our Leadinfo account for as long as we use the service, and at most 24 months.
• Cookie choice: 6 months, in the mt_consent cookie; we keep no server-side record of it.

Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access: to know whether we process your data and receive a copy.
• Rectification: to have inaccurate data corrected.
• Erasure: to have your data deleted where there is no longer a reason to keep it.
• Restriction and objection: to limit how we use your data, and to object to processing based on legitimate interests or for direct marketing.
• Portability: to receive the data you gave us in a structured, machine-readable format.
• Withdraw consent: at any time, without affecting processing that took place before withdrawal.
• Complain: to your local data protection authority in the EEA, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.

Residents of California and other U.S. states with privacy laws have comparable rights to know, access, correct and delete, and to opt out of the sale or sharing of personal data. We do not sell personal data or share it for cross-context behavioural advertising, and we do not discriminate against you for exercising your rights.

To exercise any right, email privacy@monotote.com. We will verify your identity where necessary and respond within one month (or the shorter period your local law requires). You may use an authorised agent where your local law allows it.

Security

The website is served over HTTPS only, with security headers that prevent it from being embedded in other sites and restrict which scripts can run. The contact form checks every submission on the server and delivers it over an encrypted connection. Access to the inbox that receives requests is limited to the people who handle them.

Monotote as a processor under the GDPR

Beyond this website, Monotote provides products (Smart Product Walls, APIs and webhooks, notifications, search) that publishers and retailers embed in their own websites and services. For the personal data processed through those products, our customers are the controllers and Monotote is the processor. This section outlines how that works; we encourage you to share it, together with the documents mentioned below, with your privacy team.

Controllers and processors

As a publisher or retailer using Monotote, you act as the controller. You are responsible for ensuring the personal data you collect is processed lawfully and that you use processors, such as Monotote, that handle it in a compliant manner.

Monotote acts as the processor: we process personal data on your documented instructions, and we rely on you to ensure there is a lawful basis for the processing. Processors may use other third parties to help provide the service, commonly called sub-processors. Monotote uses cloud infrastructure and service providers such as Google, Slack and Zendesk.

How Monotote uses personal data in its products

Our tools are contextual and privacy-first: products are matched to the content on the page, not to tracked users. Where a shopper signs up for a notification about a specific product, we process the contact details they provide to deliver that notification on behalf of the publisher or retailer. Read more on our Technology page.

We keep data only as long as necessary to provide our services. Where possible, we use mechanisms that automatically remove data once it is no longer needed. See our data retention policy (PDF).

Data subject requests

Under the GDPR, individuals have the right to have their personal data accessed, corrected, removed and exported. Unless the law requires otherwise, when Monotote receives such a request about data we process on behalf of a customer, we will engage that customer within 30 days so the controller can respond.

Data processing agreement

Our data processing agreement sets out these commitments in specific legal language, including sub-processors, security measures and international transfers. To obtain a copy, email privacy@monotote.com with the subject “Data Processing Agreement”.

Changes to this policy and contact

We may update this policy when our website, providers or the law change. The date at the top shows the latest version; material changes will be announced on this page. Questions, requests and complaints: privacy@monotote.com, or write to Shopping Cart Holdings, Inc., 530 7th Avenue, New York, NY 10018, USA.

Shopping Cart Holdings, Inc. · 530 7th Avenue, New York, NY 10018, USA