Privacy Policy

1. Scope and roles

This draft applies to information handled through the Services. It does not govern a merchant's own privacy practices, Shopify or another sales channel, or any third-party website or service linked from StockTruth.

StockTruth determines why and how it handles account, authentication, support, security, audit, and website information. For inventory and other business data submitted by a participating merchant, StockTruth generally processes that data to provide the Services on the merchant's instructions. A separate data processing agreement may be required; this public policy does not replace one.

2. Information we collect

Information you and your organization provide

• Account and contact information: name, business email address, profile details, organization, workspace, role, and invitation information.
• Authentication information: password credential material managed through our authentication system, session information, and single sign-on identifiers if enabled.
• Support and communications: messages, feedback, issue reports, and information you include when contacting us.

Merchant and channel information

• Inventory operations: SKUs, barcodes, quantities, reservations, adjustments, safety buffers, mappings, and synchronization results.
• Connection information: shop, product, inventory item, and location identifiers, channel authorization details, and encrypted channel credentials.
• Operational evidence: authorization decisions, audit records, idempotency records, failures, retries, and manual recovery actions.

The current Shopify pilot is intended to use narrow product, inventory, and location access. If StockTruth later enables order or customer data, we will review the additional platform, privacy, security, and notice requirements before opening that scope.

Information collected automatically

When you use the Services, systems that operate and protect them may record IP address, browser and device type, timestamps, requested pages, session identifiers, diagnostic data, and security events. We may receive similar technical records from hosting, authentication, logging, and infrastructure providers.

3. How we use information

We use information only as reasonably necessary to:

• create and administer accounts, workspaces, invitations, and authenticated sessions;
• maintain the sellable inventory ledger, reserve stock, project quantities to authorized channels, and show synchronization results;
• provide support, investigate failures, and enable controlled manual recovery;
• secure the Services, prevent abuse, enforce permissions, and preserve audit evidence;
• communicate about the pilot, service changes, security, privacy, and legal matters;
• improve reliability and usability using appropriately limited operational feedback; and
• comply with law, enforce agreements, and establish or defend legal claims.

We do not use Shopify Merchant Data to train general-purpose artificial intelligence or machine-learning models. We will not materially expand a use of personal information merely by editing this policy; where required, we will provide notice and obtain fresh consent.

4. How we disclose information

We may disclose information to the following limited categories of recipients:

• Service providers: hosting, database, authentication, security, logging, email, support, and other vendors that process information for us under appropriate restrictions.
• Connected channels: Shopify or another channel when an authorized merchant asks StockTruth to read or update information through that connection.
• Your organization: authorized workspace owners, administrators, and members according to their roles.
• Legal and safety recipients: regulators, courts, advisers, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a dispute.
• Corporate transaction recipients: advisers and a successor in a financing, reorganization, acquisition, or sale, subject to appropriate confidentiality and notice requirements.

The proposed pilot configuration does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Before this draft becomes operative, StockTruth must verify that statement against every deployed analytics, hosting, support, and logging provider. We will update this disclosure before introducing an advertising practice that changes it.

5. Cookies and tracking

The proposed public marketing site and pilot configuration do not include advertising trackers. The application may use cookies or similar storage that are necessary for authentication, session continuity, security, preferences, and core operation. Disabling essential storage may prevent login or other parts of the Services from working. This configuration must be re-verified before the policy receives an effective date.

The proposed pilot does not respond to browser "Do Not Track" signals because it does not engage in cross-site behavioral advertising. We do not authorize our service providers to collect information about a user's activities over time across unaffiliated websites for their own advertising purposes. Connected channels may separately collect activity when a user visits or uses their services under their own policies; StockTruth does not control those practices.

6. Retention and deletion

We retain account and business information while it is needed to provide and secure the Services. After termination or a verified deletion request, we plan to delete or deidentify applicable live-service data within 30 days, unless a longer period is required or permitted for security, fraud prevention, legal obligations, or claims.

Data in encrypted backups may remain until the backup expires, for up to 90 days, and will not be restored for ordinary business use. Security, contract, consent, audit, and dispute records may be retained only for as long as reasonably necessary for the purpose for which they were created or to meet legal obligations.

Subject to legally permitted exceptions, Shopify Merchant Data will be deleted within 30 days after an app is uninstalled, the data is no longer needed to provide the authorized service, or StockTruth receives a valid enforceable deletion request.

7. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information and the pilot, including access controls, protected credentials, audit evidence, and measures intended to protect information in transit and at rest. No method of transmission, storage, or operation is completely secure, and this policy is not a guarantee that incidents will never occur.

Please report an actual or suspected security issue promptly tolegal@stocktruth.io. We will investigate and provide notices to affected parties, platforms, or authorities as required by applicable law and contract.

8. Privacy choices and rights

Depending on where you live and how you use the Services, applicable law may give you rights to request access, correction, deletion, portability, restriction, or information about processing, or to appeal a denied request. StockTruth will honor verified requests to the extent required by applicable law and may voluntarily assist with other reasonable requests.

Send a request to privacy@stocktruth.io. Describe the account and request without sending passwords or channel credentials. We may need to verify your identity and authority, and an organization's administrator may need to handle requests concerning merchant-controlled data. An authorized agent may submit a request where applicable law allows it, subject to verification.

We will not unlawfully discriminate against you for exercising an applicable privacy right. Because StockTruth does not sell personal information or share it for cross-context behavioral advertising, it does not currently offer a sale or targeted-advertising opt-out link.

9. Other important information

Business users and children

The Services are intended for authorized business operators who are at least 18 years old. They are not directed to children, and we do not knowingly collect personal information from children through the Services. Contact us if you believe a child provided information to us.

International use

The pilot is prepared for participating businesses in the United States. If information is accessed from another country, it may be processed in the United States or another place where a service provider operates, subject to applicable safeguards. Expansion outside the approved pilot requires a separate jurisdiction and transfer review.

Third-party services

Connected channels and linked third-party services are governed by their own agreements and privacy policies. StockTruth is not an official partner or representative of a channel unless we expressly say so based on written authorization.

10. Changes and contact

Before this draft becomes operative, it will receive a stated effective date and may change after legal and operational review. After adoption, material changes will be posted here and communicated through an appropriate additional method when required. Earlier versions will be retained when needed to show what terms were presented.