Stockset Privacy Policy

1. Who We Are

Stockset is a Shopify inventory management app that helps merchants track stock levels, calculate reorder suggestions, and manage purchase orders. We are operated by the Stockset team.

Contact: support@stockset.app

2. Merchant Data We Collect

When you install Stockset, we collect and store the following data necessary to operate the app:

• Shop domain — your Shopify store identifier (e.g. your-store.myshopify.com)
• Access token — encrypted with AES-256-GCM; used to communicate with your store via Shopify's API
• Merchant email — optionally provided for notification delivery
• App settings — configuration such as default reorder thresholds, lead time, and digest preferences
• Synced catalog data — product titles, variant SKUs, inventory levels, supplier information, and location names synced from your Shopify store
• Purchase order records — purchase orders and line items you create within the app
• Uploaded migration files — Stocky CSV files you provide for done-for-you migration (concierge), stored temporarily in encrypted object storage until the migration completes

3. Customer Personal Data

Stockset does not collect, store, or process any customer personally identifiable information (PII).

To power velocity-based reorder suggestions, Stockset reads order line items from your Shopify store. Only the following non-personal data points are retained:

• Variant ID
• Quantity ordered
• Order date
• Shopify order and line-item identifiers (internal reference IDs; not customer-identifying)

No customer names, email addresses, shipping addresses, phone numbers, or any other personal information is stored. Customer data fields are never read from the Shopify API.

4. How Data Is Used

Your data is used exclusively to provide Stockset's services:

• Inventory tracking — syncing stock levels across your locations to display current availability
• Reorder suggestions — calculating demand signals based on historical sales velocity to recommend when and how much to reorder
• Purchase order management — creating, sending, and tracking purchase orders with your suppliers
• Notifications — sending reorder alert digests to your configured email address

We do not sell, share, or transfer your data to third parties for marketing or advertising purposes.

5. Sub-processors

Stockset uses the following sub-processors to deliver the service:

6. Data Retention

Stockset applies the following retention schedule to order data:

7. Security

• Shopify access tokens are encrypted at rest using AES-256-GCM with a 256-bit key
• All traffic between the app and Shopify is transmitted over HTTPS
• The application and database are hosted on Fly.io with infrastructure-level encryption and access controls
• Access to production systems is restricted to authorized team members

8. Data-Subject & GDPR Requests

Stockset handles the following Shopify compliance webhooks:

• customers/data_request — Completed immediately. No customer PII is held by Stockset.
• customers/redact — Completed immediately. No customer PII exists to delete.
• shop/redact — All shop data (products, variants, inventory levels, orders, daily sales, reorder alerts, purchase orders, suppliers, locations, sessions, and authentication tokens) is permanently deleted.

For direct inquiries, contact us at support@stockset.app.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected by an updated effective date at the top of this page. Continued use of Stockset after changes constitutes acceptance of the revised policy.

Current version: June 26, 2026