StockpacePrivacy policy
Who we are
Stockpace is provided by ORGANIC BOUTIQUE LTD, company number 15467284, registered office 22 The Elms, Thicket Road, Houghton, Huntingdon, PE28 2FQ, United Kingdom (“we”, “us”). Contact: support@stockpace.app.
This policy covers the Stockpace app for Shopify and the website stockpace.app.
Our role
For the data in your Shopify store and in the supplier documents you connect, the merchant who installs Stockpace is the controller and we act as their processor: we use that data only to provide Stockpace to them, under our data processing addendum. For merchants’ own account details (store name, contact email, plan, support messages) we are the controller.
What we collect and why
| Data | Where it comes from | Why |
|---|---|---|
| Store details: name, domain, contact email, currency, time zone, address, locations | Shopify, at install and daily | Set up the app, print purchase orders, bill through Shopify |
| Products and variants: titles, SKUs, barcodes, vendors, prices, costs, images | Shopify | Forecasts, purchase orders, costs |
| Inventory levels per location | Shopify | Stock, reorder suggestions, stock history |
| Order lines: product, quantity, price, discount codes, date, sales channel, order tags, the location that shipped it | Shopify (up to about two years back) | Sales history for forecasts and reports |
| Supplier emails with documents (sender, recipients, subject, text, attachments), forwarded emails and files in the Dropbox folder you choose | Your mailbox, your forwarding address, Dropbox, uploads | Read invoices, price lists and order confirmations; update costs and due dates; match invoices to purchase orders |
| Purchase-order emails and shipping notices (PO threads, supplier dispatch emails, carrier notices) | Your connected mailbox | Supplier status, carrier, tracking and delivery date on your purchase orders |
| Supplier details you enter: names, emails, terms, minimums | You | Purchase orders and supplier contact |
| Names of your staff who make changes | You | Change history |
| Connection credentials: mailbox app password, Dropbox and Xero access tokens | You | Reach the services you connect |
| Support emails and requests you send from the app | You | Answer you and improve the app |
What we do not collect
We do not read or store your customers’ names, email addresses, postal addresses or phone numbers: orders are read without any customer field. Two narrow exceptions can contain a person’s email address:
- if someone emails a document to the mailbox you connect and it is not recognised as a supplier document, its sender and subject are listed for you for up to 60 days so you can teach Stockpace;
- purchase-order emails and shipping notices are kept for up to 180 days to show delivery status.
Both are searched and deleted automatically when Shopify sends us a customer data request or deletion request for that person.
Legal basis
As processor we act on the merchant’s instructions. As controller we rely on performance of our contract with the merchant, and on our legitimate interest in keeping the service secure, supporting merchants and improving the app.
Who processes data for us
The current list, with locations, is on our sub-processors page. In short: Fly.io hosts the app and database in London; Anthropic reads supplier documents; Postmark receives forwarded emails; Shopify provides the platform and billing. Dropbox and Xero are used only if you connect them. We do not sell data and do not use it for advertising.
Supplier documents sent to Anthropic for reading are processed under Anthropic’s commercial terms, which do not allow them to train models on this data.
International transfers
Your store data is stored in the United Kingdom. Some providers process data in the United States; those transfers are covered by the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Security
Every store’s data is separated in the database by row-level security, so one store can never read another’s. Mailbox passwords and access tokens are encrypted. All traffic uses HTTPS. Access to production systems is limited to the people who run the service.
How long we keep data
- While the app is installed: as long as it is needed for the features you use (orders up to about two years back).
- Unrecognised emails: 60 days. Purchase-order emails and shipping notices: 180 days.
- After you uninstall: Shopify sends a deletion request 48 hours later and we delete all your store’s data then — in any case within 7 days of the uninstall. Database backups are overwritten within 14 days after that.
- Support emails: up to 2 years, then deleted.
Your rights
You can ask to access, correct, export or delete your data, to restrict or object to processing, or complain to the Information Commissioner’s Office (ico.org.uk). Email support@stockpace.app. Requests from a merchant’s customers reach us through Shopify and are handled automatically, as described above.
This website
stockpace.app sets no cookies and loads nothing from third parties. See cookies.
Changes
We will post changes here and update the date at the top. If a change is material, we will email the contact address of each store using Stockpace before it takes effect.