Overview

Stocked is an operations platform. Businesses use it to track stock, raise purchase orders, take payments and understand what sold. That means we hold two quite different kinds of information, and it is worth separating them up front.

The first is information about you as a Stocked customer — your account, your billing details, how you use the product. The second is information you put into Stocked about your own business: your products, your suppliers, your staff and your customers. We treat the second kind as yours. You decide what goes in, you decide when it comes out, and we only handle it to run the service for you.

What we collect

We collect the following categories of information:

Account details — your name, work email address, business name, and the password hash used to sign you in.
Billing details — your plan, billing address and tax identifiers. Card numbers are handled by our payment processor and never reach our servers.
Business records — the products, stock levels, locations, purchase orders, sales, customers and team members you enter or import.
Usage data — which pages you open, which features you use, and diagnostic events such as errors and slow requests.
Device and connection data — IP address, browser and operating system, collected from ordinary web request logs.

We do not collect special categories of personal data, and we ask that you do not put them into Stocked either. The product is not designed to hold health records, biometric identifiers or government identity numbers.

Why we use it

We use the information above to provide the service, and for no unrelated purpose. In practice that means:

Running the product — storing your records, syncing stock between locations, producing your reports.
Supporting you — answering your questions, which sometimes requires looking at your account with your permission.
Keeping the service safe — detecting abuse, investigating suspicious sign-ins, and preventing fraud.
Billing you — calculating what you owe, applying the right tax treatment for your region, and taking payment.
Improving the product — understanding in aggregate which features get used so we know where to invest.

We do not sell your information. We do not share your business records with advertisers, data brokers or any other third party for their own purposes.

Legal bases

Where data protection law requires us to identify a legal basis for processing, we rely on the following: performance of our contract with you, for everything needed to deliver the service you have signed up for; our legitimate interests, for security, fraud prevention and product improvement, weighed against your rights; compliance with a legal obligation, for tax and accounting records; and your consent, for optional marketing communications, which you can withdraw at any time.

Who we share it with

We use a small number of processors to run Stocked. Each is bound by contract to handle your information only on our instructions, and each is reviewed before we onboard it:

Cloud hosting and database providers, who store the data at rest.
Payment processors, who handle card details and subscription billing.
Email delivery providers, who send transactional messages such as password resets and order confirmations.
Error monitoring and analytics providers, who receive diagnostic events.

We may also disclose information where we are legally required to — for example in response to a valid court order. Where we are permitted to tell you about such a request, we will.

If Stocked is ever acquired or merged, your information may transfer to the acquirer. We will tell you before that happens, and the commitments in this policy will continue to apply until it is replaced with one you have been notified of.

How long we keep it

We keep your business records for as long as your account is open. If you close your account, we delete or irreversibly anonymise them within 90 days, except where we are required to retain something longer — invoices and tax records are the usual example, and those are kept for the period our accounting obligations demand.

Backups are retained on a rolling 35-day cycle. A record you delete disappears from the live service immediately and ages out of backups within that window.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, and receive a portable copy. You can exercise most of these from your account settings without asking us — your business records can be exported at any time from the reports area.

For anything you cannot do yourself, write to privacy@stocked.com and we will respond within 30 days. If you are unhappy with our response, you have the right to complain to your local data protection authority.

International transfers

Stocked is operated from Nigeria and hosted in data centres in the European Union and the United States. Where we move personal data across borders, we rely on the transfer mechanisms recognised by the relevant law — standard contractual clauses, adequacy decisions, or your explicit consent.

Cookies

We use a session cookie to keep you signed in, and a preference cookie to remember your theme and currency. Neither is used for advertising and neither is shared with third parties. We use a small amount of first-party analytics to understand product usage; you can opt out of it from your account settings.

Changes to this policy

We will update this policy as the product changes. When a change is material we will email account owners at least 30 days before it takes effect. The date at the top of this page always reflects the current version.

Privacy Policy