Privacy and data

This page explains what data Stockpace reads, what it keeps, who processes it and how it is deleted.

Shopify permissions

Stockpace asks Shopify for permission to read your products, inventory, locations and orders. It changes your store only when you press a button that says so and confirm — for example Add N unit(s) to Shopify stock, Create / link in Shopify… or Yes, update Shopify.

What Stockpace reads from Shopify

Data	What is read	Why
Store	Store name, billing address, locations and their addresses	Printed on purchase orders; stock locations
Products	Titles, vendor (brand), SKU, barcode, status, price, compare-at price, cost, created date, image, collections, whether stock is tracked, and market price lists	Recommendations, POs, reports, Costs & RRP
Inventory	Available and incoming quantities at your locations	Stock, out-of-stock days, receiving
Orders	Order date, cancellation, test flag, tags, sales channel and source, discount codes, Point of Sale location, where each order was fulfilled from, and line items (product, SKU, name, quantity and prices)	Sales history for the forecast, channels, wholesale, per-location planning

Stockpace does not read or store customers' names, email addresses, phone numbers or street addresses from your orders.

Customer data

Stockpace needs no customer data to work. The only way a customer's details can reach it is if a customer emails a PDF or spreadsheet to the mailbox or forwarding address you connected for supplier documents. Such an email may appear in Settings → Supplier documents → Not recognised, with the sender's address, name, subject and a stored copy of the file, for up to 60 days.

If you connected a mailbox, Stockpace also keeps purchase-order emails and shipping notices (PO threads, supplier dispatch emails, carrier notices) for up to 180 days to show the supplier status and tracking on your purchase orders. Your own mail to customers is not kept.

When Shopify sends a customer data request, Stockpace checks both for entries involving that customer's email address. When Shopify sends a request to delete a customer's data, those entries and their stored copies are deleted.

What Stockpace stores

the Shopify data above, as needed for the forecast and reports;
your settings, vendors, purchase orders and receipts;
supplier documents it reads (a stored copy of the file) and what was read from them;
for a connected mailbox: the address, server and an app password, stored encrypted; and the supplier emails it keeps as documents;
for a connected Dropbox: your account name, the chosen folder and an access token, stored encrypted;
for a connected Xero organisation: the organisation, access tokens (stored encrypted) and the accounts you chose; and the Xero bills and payments it reads.

Stockpace only reads your mailbox and Dropbox folder. It never sends, moves or deletes your mail or files.

Where data is hosted

Stockpace runs on Fly.io in the London region (United Kingdom), with its data in a PostgreSQL database. Each store's data is kept separate from every other store's at the database level.

Sub-processors

Provider	What it does	When
Fly.io	Hosts the app and its database	Always
Anthropic	Reads the content of supplier documents (invoices, price lists, order confirmations) to extract lines, prices, totals and payment terms	When Stockpace reads a supplier document
Postmark	Receives emails sent to your forwarding address	Only if you use the forwarding address
Dropbox	Gives Stockpace read access to the folder you choose	Only if you connect Dropbox
Xero	Your accounting system — Stockpace reads it and creates drafts when you ask	Only if you connect Xero

Stockpace also looks up:

daily exchange rates from the European Central Bank's published rates (no store data is sent);
carrier tracking pages for tracking numbers found in supplier emails, to show delivery status.

When you press Request this to ask for an import or accounting system we do not support yet, your store's domain, the system name and your note are sent to the Stockpace team.

Deletion

Uninstalling. Stockpace's access to your store ends at once. Your data is kept for a short time in case you reinstall, then deleted — when Shopify asks for it (normally 48 hours after you uninstall), and in any case within 7 days.
Disconnecting. Disconnect on the mailbox, Dropbox or Xero card stops Stockpace using that connection.
Customer deletion requests from Shopify are handled as described above.

Data in Shopify and Xero that Stockpace created at your request — stock you received, products you created, draft bills and purchase orders — stays there.

Still stuck? Email support@stockpace.app — we reply within one working day.