Privacy Notice
Short version
We collect the minimum needed to run your account. We do not sell your data, we do not use your stock data to train models, and you can take everything with you or have it deleted whenever you want.
Who is responsible
[Controller name, address and ICO registration number to be inserted. Registration with the Information Commissioner's Office is legally required and costs GBP 40 a year - there is no sole-trader exemption.]
What we collect and why
- Account details - your name, email and business name, so we can identify you and contact you about the service. Lawful basis: performance of a contract.
- Your stock data - products, quantities, counts and the history of changes. Lawful basis: performance of a contract.
- Payment details - handled entirely by our payment provider. We never see or store your card number.
- Usage and error logs - which pages were used and what went wrong, to keep the service working. Lawful basis: legitimate interests. Logs are pseudonymised and kept for 90 days.
Who we share it with
Only the suppliers needed to run the service: hosting and database, the payment provider, transactional email, and error monitoring. Each is bound by a data processing agreement. We do not share your data with anyone else, and we never sell it.
Where it is held
[Region to be confirmed at deployment - UK or EU where available. Any transfer outside the UK will rely on an adequacy decision or the International Data Transfer Addendum.]
How long we keep it
- While your account is open, and for 90 days after you close it, so an accidental cancellation is recoverable.
- Delete on request removes it sooner, including from backups within 35 days.
- Invoices are kept for six years because tax law requires it.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. Email us and we will respond within one month. You can also complain to the ICO at ico.org.uk.
Cookies
We use a single essential cookie to keep you signed in. We do not use advertising or tracking cookies, so there is no consent banner - under PECR, consent is only needed for non-essential ones.
Security
Data is encrypted in transit and at rest. Each business's records are isolated at the database level rather than by application code. Access to production data is limited and logged. If a breach occurs that risks your rights, we will notify the ICO within 72 hours and tell you where required.