Legal
Privacy Policy
Last updated: August 20, 2026 · Effective: August 20, 2026
This Privacy Policy explains how Antal Botond-Csaba (“Restock”, “we”, “us”) collects, uses, shares and protects personal data when you visit our website, ask us for the Stocky data-export checklist, or install and use the Restock app for Shopify (the “App”).
We are the data controller for personal data collected through our website and its email form. When you install the App on your Shopify store, you (the merchant) are the controller of your customers’ personal data, and we act as your data processor.
1. Information we collect
Information you give us
- Checklist request: your email address, and which form you submitted it from.
- Support and enquiries: your email address and the contents of your message.
Information we receive from Shopify (when you install the App)
With the permissions you approve at install, the App accesses store data needed to run inventory workflows:
- Store and account details: shop domain, store name, contact email, billing country, plan, locations.
- Product and inventory data: products, variants, SKUs, barcodes, costs, stock levels by location.
- Operational data: purchase orders, suppliers, stocktakes, transfers and receiving history you create in the App.
- Staff accounts: the name, email and role of staff you grant App access to.
- Order data: where required to reconcile stock movements. We do not require, and do not use, your customers’ names, addresses or payment details for marketing.
We do not receive or store payment card numbers. Billing is handled by Shopify.
Information collected automatically
- Log data: IP address, browser type, pages viewed, and timestamps, recorded by our hosting provider for security and reliability.
- Local storage: after you ask for the checklist we store a flag and the address you entered in your browser (
restock_checklist_requested,restock_checklist_email) so we don’t show you the form again. Both stay on your device and we cannot read them remotely.
We do not use advertising cookies, third-party trackers, or cross-site profiling.
2. How we use information
- To provide, operate and support the App and its inventory workflows.
- To send you the Stocky data-export checklist, if you asked for it.
- To respond to support requests.
- To secure our service, prevent abuse, and debug faults.
- To comply with legal obligations.
We do not sell personal data, and we do not share it with advertisers.
3. Legal bases (UK/EU GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the App to a merchant | Performance of a contract |
| Sending the checklist you requested | Consent (withdraw any time) |
| Security, fraud prevention, debugging | Legitimate interests |
| Processing merchant customer data | Processing on the merchant’s documented instructions |
| Tax, accounting and legal records | Legal obligation |
4. Who we share data with
We share data only with service providers (“subprocessors”) who help us run Restock, under contracts that require them to protect it:
| Provider | Purpose | Data |
|---|---|---|
| Shopify Inc. | App platform and billing | Store, product, inventory and order data |
| Vercel Inc. | Website hosting | Log data, IP address |
| Formspree Inc. | Email form delivery | Email address you submit |
| Resend | Sending purchase-order, checklist and support email | Email address; purchase orders sent to your suppliers |
| Functional Software, Inc. (Sentry) | Error monitoring, so we can fix faults | Error details and your shop domain. We strip the request body, cookies and headers before an error leaves the App |
| PostHog, Inc. | Product analytics — which features are used | Your shop domain and a handful of milestone events (installed, first purchase order, first receive, first stocktake). No personal data, no customer data |
We may also disclose data if required by law, or as part of a merger or acquisition — in which case we will notify you before your data becomes subject to a different privacy policy.
5. International transfers
Our providers may process data outside your country, including in the United States. Where data leaves the UK/EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
6. How long we keep data
- Checklist requests: until you unsubscribe, and no later than 24 months after you asked for it.
- Store and App data: for as long as the App is installed. If you uninstall, we delete or anonymise your store’s data within 90 days, unless we must keep records to meet a legal obligation.
- Support email: up to 24 months.
- Server logs: up to 30 days.
7. Shopify merchant and customer data
As required by Shopify, the App responds to the mandatory GDPR/privacy webhooks:
customers/data_request— we provide the merchant with any personal data we hold about the named customer.customers/redact— we erase personal data we hold about the named customer.shop/redact— 48 hours after uninstall, Shopify notifies us and we erase the store’s data on our systems.
Merchants can also contact us directly to request access, export or deletion at any time.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data (“right to erasure”);
- restrict or object to processing, including direct marketing;
- data portability;
- withdraw consent at any time — every email we send you includes a one-click unsubscribe link;
- lodge a complaint with your data protection authority (in the UK, the ICO).
California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.
To exercise any right, email hello@restockpos.com. We respond within 30 days.
9. Security
We protect data with encryption in transit (TLS), encryption at rest, least-privilege access controls, and regular patching. Access to production data is limited to staff who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant regulator as required by law.
10. Children
Restock is a business tool and is not directed at children under 16. We do not knowingly collect their personal data.
11. Changes to this policy
We may update this policy as the App evolves. We will change the “Last updated” date above and, for material changes, notify you by email or in the App before they take effect.
12. Contact
Antal Botond-Csaba
Aurel Vlaicu 3, Ap. 1, Cluj-Napoca, Romania
Email: hello@restockpos.com
We are established in Romania, so our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro). If you have concerns we have not resolved, you may complain to them, or to the data protection authority in your own country.