Privacy Policy

1. Information We Collect

When you install and use StockrHub, we access and store certain data from your Shopify store, including:

• Store information (shop name, domain, currency, timezone)
• Product and variant data (titles, SKUs, prices, images)
• Inventory levels and location data
• Order information (order numbers, line items, fulfillment status, prices, discounts, transactions, refunds, and fees)
• Staff account identifiers associated with the app installation
• Supplier contacts, account settings, API credentials, purchase orders, invoices, and submission history
• Contact details and information you provide when requesting access or support

Order and invoice workflows can process customer names, email addresses, telephone numbers, billing and shipping addresses, and customer or order identifiers. Delivery details can appear on purchase orders, line items, supplier requests, documents, and operational history. We use these details to arrange fulfillment and maintain the records associated with your orders.

StockrHub does not ask you to enter a complete customer payment card number or security code. Supplier payment settings can include card labels, the last four digits, and account or payment references provided by you or the supplier. Payment and transaction records can include masked payment details.

2. How We Use Your Data

We use the data we collect to operate and improve the App and website:

• Generating and managing purchase orders
• Tracking inventory levels across locations
• Processing stock transfers between locations
• Running demand forecasting and reorder analysis
• Sending low-stock alerts and notifications
• Managing supplier information and contacts
• Understanding website traffic and loading performance

3. Data Storage & Security

Your data is stored on Cloudflare's global edge network using Cloudflare Workers, D1 (SQLite), and KV storage, with uploaded assets in Cloudflare R2. Shopify access tokens and secret fields in saved supplier API settings (API keys, passwords, and client secrets) are encrypted using AES-256-GCM before storage. This protection does not mean that every operational record or supplier response is separately encrypted by the App.

Connections to StockrHub and Shopify use HTTPS. The current IMC / Parts Authority integration uses a legacy HTTP endpoint, including credentials in its request. That supplier connection is not encrypted in transit. Merchants should consider this limitation before enabling that integration; contact us to discuss its current status.

The App verifies Shopify session tokens and signed webhook requests and scopes store records to the authenticated installation. Each store enters and retains its own supplier credentials. Matching supplier credentials can share background request limits without granting access to another store's credentials, orders, or settings.

4. Third-Party Services

StockrHub exchanges data with Shopify and the suppliers you configure, including Turn 14, Motor State, and IMC / Parts Authority. Supplier requests can include account credentials, order details, and delivery contacts or addresses. Configured imports can also retrieve records from Stocky.

Cloudflare provides hosting, storage, and delivery infrastructure. Resend processes transactional email when email features are used, including recipients, message content, and purchase order attachments. Supplier and email recipients receive the information needed for the action you initiate or configure. We do not sell or rent personal information.

Our website (stockrhub.com) is hosted on Cloudflare Pages. Hosting providers can process request information such as IP addresses and browser information for delivery and security. See ourCookie Policyfor details.

The website uses Cloudflare Web Analytics to measure visits and page performance. Its browser beacon sends measurement data to Cloudflare, such as page paths, referring pages, loading times, and page responsiveness. Reports can be grouped by browser, device type, operating system, and country to help us understand traffic and improve the website.

Cloudflare describes this service as privacy-first measurement that does not use cookies or local storage for analytics and does not fingerprint individuals. These analytics practices are separate from Cloudflare's hosting and security processing described above. SeeCloudflare Web Analyticsand its measurement documentationfor more information.

5. Data Retention

We retain operational store records while the App is installed. When a verified uninstall is processed, StockrHub removes the store's ordinary operational data, saved credentials, uploaded assets, and caches. Cleanup begins at uninstall processing; there is no 30-day restoration period. Export records you need before uninstalling. Reinstalling starts a new installation.

Minimal installation and supplier-reference records remain to prevent old events or reused order references from affecting a later installation. Records already delivered to Shopify, suppliers, or email recipients are also subject to those services' retention practices. Infrastructure recovery copies and logs are managed separately from the App's active records.

We receive Shopify customer data and deletion requests. The current automated deletion handler removes the shipping-address field on matching dropship purchase orders; other copies in documents, line items, or history require review. Contact us for a complete access or deletion request. A webhook acknowledgement alone is not confirmation that a complete export or deletion has been delivered.

6. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have the following rights regarding your data:

• Access - Request a copy of the data we hold about your store.
• Deletion - Request that we delete all data associated with your store.
• Portability - Request your data in a machine-readable format.
• Correction - Request correction of inaccurate data.
• Opt-out of sale - We do not sell personal information. There is nothing to opt out of.

To exercise any of these rights, use ourcontact page. We will respond within 30 days.

7. Children's Privacy

StockrHub is a business-to-business application and is not directed at children under the age of 13. We do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page with a revised effective date. Continued use of the App after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

StockrHub
Contact StockrHub