Privacy

What StockApp reads from your store, what it keeps, what it deliberately never collects, and when all of it is destroyed.

LAST UPDATED 15 OCTOBER 2026

01Who this is from

StockApp is operated by Cleo Wangayi, 3 3rd Street, Westview, Kadoma, Zimbabwe. Questions about anything on this page go to dev@watacle.com.

This policy covers the StockApp Shopify application. Where the app processes personal data belonging to your customers, you are the data controller and we are your processor. Where it processes your own account details, we are the controller.

02What the app reads from Shopify

StockApp requests the narrowest set of permissions that lets it do its job. These are the only ones, and Shopify shows them to you before you install:

read_products

Product and variant names, SKUs, barcodes, prices and unit costs.

read_inventory

On-hand and available quantities per variant per location.

write_inventory

Used only to record a delivery you have received against a purchase order, and to apply a stocktake you have approved. Nothing writes to your inventory without you pressing a button.

read_orders

Order line items, to work out how much of each product sold, where, and on what date.

read_locations

Your locations and their names.

03What the app never asks for

StockApp does not request the read_customers permission, and has no way to read your customer list.

This is a design decision rather than an oversight. A demand forecast needs a quantity, a place and a date. It has no use for a person. Asking for customer access would make this app subject to a higher tier of Shopify's protected customer data requirements in exchange for nothing it could use.

04What happens to your order data

This is the part most inventory apps are vague about, so: we read your orders and we do not keep them.

Each order line is reduced to a single number (how many units of one variant sold at one location on one date) and added to a running daily total. The order itself is never written to our database. There is no table in StockApp that holds an order, an order number, an order total, or anything that could be linked back to the person who placed it.

What survives is a row saying, in effect: eleven units of SKU GAC-HB-237 sold at Carlton on 14 March, and the product was buyable for 22 of those 24 hours. That is the entire input to the forecast.

05Personal data we do hold

Three kinds, and none of them belong to your customers.

Your staff account

When a member of your staff opens the app, Shopify gives us their name and email address as part of the session. We use it to identify who is signed in and for nothing else. It is deleted the moment the app is uninstalled.

Your supplier contacts

Names, email addresses and phone numbers you type in yourself when setting up suppliers. These are business contacts you chose to record. We never email them; purchase orders are yours to send.

Your shop record

Your shop's domain, name, currency, timezone and plan, and an encrypted Shopify access token.

06What we never do

We do not sell your data, or your customers' data, to anyone, ever, under any circumstances.
We do not share your data with other merchants. Every query in the app is scoped to your shop, and that is verified by an automated test suite that builds two stores with deliberately colliding SKUs, supplier names and purchase order references and proves neither can see the other.
We do not use your data to train models that serve other merchants. Your forecast is fitted on your history alone.
We do not send marketing to your customers, or to your suppliers.
We do not use tracking cookies, advertising pixels or third-party analytics on the app screens.

07Customer data requests

Shopify sends us a notification when one of your customers asks what data an app holds about them, or asks for it to be erased. We handle both automatically.

In both cases the answer is that we hold nothing. There is no column anywhere in StockApp that can be joined back to a person, so there is nothing to disclose and nothing to erase. This is a consequence of section 3 rather than a separate promise.

08How long we keep things

Your orders

Never stored. Aggregated on arrival, as described in section 4.

Staff session

Deleted immediately when you uninstall the app. The access token it holds is dead at that moment anyway.

Everything else

Deleted in full 48 hours after uninstall, when Shopify sends the shop redaction notification. That includes your demand history, suppliers, purchase orders, stocktakes and forecasts. It is not recoverable afterwards, which is the point.

The 48 hour gap is Shopify's, not ours, and it exists so that a merchant who uninstalls by accident and reinstalls the same day gets their history back. Your in-stock hours record cannot be rebuilt from Shopify after the fact, so throwing it away early would cost you something you could never recover. After the 48 hours it goes.

If you want your data deleted sooner than that, email dev@watacle.com and we will do it.

09Security

All traffic is over HTTPS.
Your Shopify access token is encrypted with AES-256-GCM in our database, on top of whatever disk encryption the database provider offers. A stolen database backup is not a set of working credentials for your store.
The database is hosted in a managed environment with encryption at rest.
Access to production is limited to the people who operate the service. If we ever become aware of a breach affecting your data we will tell you without undue delay, and in any case within 72 hours of becoming aware of it.

10Where your data lives, and who else touches it

StockApp runs in the eastern United States. These are the only third parties that can reach your data, and each is bound by its own data protection terms:

Vercel Inc.

Application hosting and scheduled jobs · United States (Washington, D.C.)

Neon (a Databricks company)

Managed PostgreSQL · United States (Northern Virginia)

Shopify itself is not on this list because Shopify is where your data already is. We read from it; we do not send it anything it did not already have, other than the inventory adjustments you ask us to make.

StockApp is operated from Zimbabwe and your data is stored in the United States, so using the app means your data is transferred there. It is held only by the providers above, under their data protection terms, and is never moved anywhere else.

We will update this page before adding a new sub-processor, not after.

11Your rights

Depending on where you are, you may have the right to access, correct, export or delete personal data we hold about you, to object to processing, or to complain to a data protection authority. We are subject to Zimbabwe’s Cyber and Data Protection Act, whose authority is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ); you may also complain to the authority where you are. Email dev@watacle.com and we will respond within 30 days.

For personal data belonging to your customers, you are the controller and the request should come through you. We will assist with any such request, though as set out above the honest answer is usually that we hold nothing.

12Changes

If this policy changes in a way that affects what we collect or what we do with it, we will tell you inside the app before the change takes effect. Cosmetic changes we will just make.

Privacy · Terms · Pricing