Privacy Policy

1. Data controller

Stockfront is the data controller for account, user and operational data related to the service. Privacy enquiries can be sent to the contact address provided in the service.

2. Information we process

• Account: name, email, language, role and security metadata.
• Store connection: Shopify domain, installation status, access scopes and technical tokens.
• Operations: inventory, product, order, supplier and receiving data entered by the user.
• Sales sync: product level, quantity and date. Customer data and full order history are not used for planning.
• Security: events, error codes, IP address and user agent where necessary.

3. Purposes and legal basis

Data is processed to deliver the agreed SaaS service, secure the service, provide support and comply with legal obligations. The legal bases are contract, legitimate interest in secure operations and legal obligation. Marketing requires a separate basis.

4. Data minimization and retention

We retrieve only the Shopify fields we need. Identifiable raw sales rows are kept briefly for sync and reconciliation, for a maximum of 30 days, before being aggregated per day and product. Account and operational data is kept while the agreement is in force and is deleted or anonymized when the purpose ceases, unless the law requires further retention.

5. Subprocessors and transfers

Vercel is used for application hosting, Neon for the PostgreSQL database, Resend for transactional email and Shopify as the integration source. Data processing agreements and a lawful transfer basis must be in place where providers process personal data outside the EEA.

6. Security

Traffic is protected with TLS. Our infrastructure providers offer encryption at rest. Access is controlled with authentication, least privilege, user-scoped queries and auditing of administrative actions. Shopify secrets and tokens are available only on the server and are never logged.

7. Your rights

You may request access, rectification, erasure, restriction, data portability or object to processing. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). Your identity must be verified before data is disclosed or deleted.

8. Shopify privacy requests

Shopify's mandatory privacy webhooks handle data requests and erasure. Stockfront stores the end customer's name from Shopify orders so you can match orders to a person on the Customer Orders screen. The name is not used for purchase planning, profiling or automated decisions, and we do not store end customers' email, phone or address. The name is automatically removed 30 days after the order is processed, or after 90 days if it was never processed. It is also removed on Shopify's customer or shop erasure requests. Access to this data is logged and the logs are kept for 365 days.