Stockify — Privacy Notice

Last updated: 2026-06-24

This privacy notice applies to the Shopify app Stockify and describes which personal data is processed, for what purpose, on what legal basis, for how long, and with whom it is shared. It is kept in sync with the code — changes to the data model or to the sub-processor stack trigger an update to this file.

Timing and form of the information (Art. 13 GDPR). Pursuant to Art. 13(1) GDPR, this notice is provided to the merchant at the time the data is collected, i.e. at the latest when the app is installed:

1. Shopify App Store listing: The public app listing references this URL (https://stockify.amassimo.com/privacy) as the "Privacy Policy". It is visible before the install click.
2. Install flow: The Shopify OAuth consent screen links to the privacy URL stored in the app listing before the merchant confirms the app permissions.

This notice is also publicly accessible at any time at https://stockify.amassimo.com/privacy. Later updates are documented via the "Last updated" line above and via section 12. Change history. Material changes to the scope of processing are additionally communicated by email to the shop's stored email_address.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

Antoine Massimo Grünebaumstraße 13 33098 Paderborn Germany

Email: [email protected]

Stockify is operated as a solo project. A data protection officer is not required under Art. 37 GDPR.

2. What data is processed

Stockify only stores shop-related configuration and inventory metrics in its own PostgreSQL database on the Stockify server. No identifying customer data (customer IDs, names, email addresses, shipping addresses, payment data) of the shop's end customers is stored. For the reorder forecast, Stockify reads historical orders using the read_orders scope, but persists from them only a net sales quantity aggregated per variant and per calendar day (units sold minus units refunded) — no order ID, no order value, no buyer reference. This data minimisation is deliberate: the aggregates cannot be attributed to any individual end customer.

2.1 What is not stored

• No identifying customer data of the shop's end customers (customer IDs, names, emails, shipping/billing addresses, payment data). Orders are read for the forecast (read_orders) but not stored as orders — only the net sales quantity aggregated per variant and day is persisted (see forecast_sales_daily above), which cannot be attributed to any individual end customer
• No raw order data — order IDs, order values, line-item prices, buyer references are never persisted; they are processed in memory during the nightly aggregation and immediately discarded
• Stock levels are queried live via the Shopify GraphQL API on demand for display. For the forecast, Stockify additionally keeps a daily stock snapshot per variant (forecast_inventory_snapshots) in order to exclude sold-out days from the sales estimate. On goods receipt, Stockify credits the delivery quantity booked by the merchant to the variant's available stock via the Shopify Admin API (scope write_inventory) — only upon an explicit merchant action, no automatic write access
• No payment data — payments are handled exclusively via Shopify Billing; Stockify only stores the non-sensitive subscription_id (Shopify GID)
• No tracking, analytics or telemetry data

2.2 Consent for voluntary inputs (Art. 6(1)(a))

The data marked with (a) in the table above (pricing_feedback.*, feature_requests.message) is processed solely on the basis of the merchant's voluntary consent:

• Voluntariness: Both inputs are not a prerequisite for using the app. All core functions (minimum stock, reports, alerts) are fully usable without providing this feedback.
• Act of consent: Consent is given by actively filling in the respective field and clicking the submit button. The UI hint right at the form states the voluntary nature and the right of withdrawal.
• Documentation (Art. 7(1) GDPR): Each entry automatically receives a created_at timestamp; together with the shop domain this evidences the when and who of the consent.
• Withdrawal (Art. 7(3) GDPR): Consent can be withdrawn at any time with effect for the future — most easily directly in the app under Settings (button "Withdraw entry" for the price feedback or "Delete my wishes" for the wish field), alternatively informally by email to [email protected]. The entries are associated exclusively via the shop domain (no email address, no name stored); to locate and process your entries I therefore need you to state your *.myshopify.com domain (identity verification under Art. 12(6) GDPR). Upon request, the affected entries are promptly deleted or anonymised (removing the shop association; after that the remaining, purely statistical values are no longer personal data, Recital 26). Withdrawal does not affect the lawfulness of processing carried out up to that point. On app uninstall, these entries are additionally deleted automatically via the Shopify shop/redact webhook (48 h after uninstall).

2.3 Data flow

• Incoming (Shopify → Stockify): OAuth token on installation; product and inventory data queried live (not persisted); for the forecast, orders queried nightly (read_orders) and immediately condensed into daily/variant aggregates (raw order data is not persisted); webhook notifications (inventory_levels/update, app/uninstalled, app_subscriptions/update, GDPR webhooks).
• Outgoing (Stockify → recipients): Weekly inventory reports and instant alerts to the channels configured by the shop (email / Discord / Slack). Content: list of the respective shop's critical products (title, SKU, stock, minimum stock).
• Outgoing to owner: On wish submits (feature_requests), Stockify sends a content-free trigger ping without shop identification or free-text content to an owner Discord webhook. Content: only "a new entry exists". The owner reads the actual content in the local database.

3. Retention

GDPR webhook bodies and inventory_levels/update payloads are generally not written to logs (see section 6).

3.1 Residual data in backups and logs

After the live database is deleted via shop/redact or the defense-in-depth cleanup job, shop-related data may, for technical reasons, still be present in backups and logs for the respective rotation period:

• Postgres backups: up to 30 days — both in the local backup copy and in the encrypted off-site copy at Cloudflare R2 (see section 8) —, overwritten by the rotation script thereafter.
• Server logs: up to 30 days, overwritten by Logrotate thereafter.

This residual retention is technically required to ensure recoverability and error diagnosis (Art. 32 GDPR — integrity and availability as an aspect of security of processing) and ends automatically through the rotations mentioned, without any further action. Selective deletion of individual shop data from backup snapshots is not technically practicable; targeted restoration of deleted data from backups does not take place.

Upon a justified access request under Art. 15 GDPR, the existence of such residual backup/log content is transparently named; the specific deletion date follows from the respective rotation period.

4. GDPR webhooks (mandatory Shopify implementation)

Stockify implements all three GDPR webhooks required by Shopify:

• customers/data_request: Responds with 200 OK. No data attributable to an end customer is stored — the sales quantities derived for the forecast are aggregated per variant and day and carry no buyer reference, so they cannot be attributed to any individual customer. There is therefore no personal data to disclose. The request body is not logged.
• customers/redact: Responds with 200 OK. No data attributable to an end customer exists for deletion (the aggregated sales quantities carry no buyer reference). The request body is not logged.
• shop/redact: Deletes all data belonging to the shop from sessions, product_settings, alert_state, pricing_feedback, feature_requests, suppliers, purchase_orders, purchase_order_lines, purchase_order_receipts, forecast_sales_daily, forecast_inventory_snapshots, forecasts, forecast_seasonality, location_settings, stock_transfers, stock_transfer_lines and shops. Technically, a single DELETE FROM shops suffices — all shop-related tables hang off shops via FOREIGN KEY … ON DELETE CASCADE (order lines cascade transitively via their order), so the supplier contact details and forecast aggregates are structurally deleted along with them.

In addition:

• app/uninstalled: Marks the shop as uninstalled (uninstalled_at timestamp) and deletes all sessions immediately.
• Defense-in-depth cleanup: A daily background job (02:30 Europe/Berlin) deletes all shop data whose uninstalled_at is older than 90 days — in case shop/redact never arrives.

5. Encryption

• At rest: shops.smtp_pass is encrypted with AES-256-GCM; the key resides in an environment variable (ENCRYPTION_KEY), not in the database. The forecast aggregates derived from read_orders (forecast_sales_daily, forecast_inventory_snapshots) are not personal data (Recital 26 — no end-customer reference) and are stored without additional application-level encryption; access to the database is restricted to the controller (solo operation, see section 1).
• In transit: All communication with Shopify and processors runs over HTTPS / TLS 1.2+. The SMTP connection to the mail server (Brevo or the shop's own server) uses STARTTLS (port 587) or TLS (port 465).
• Ingress: The Stockify server is reachable exclusively via a Cloudflare tunnel; there is no open port on the host. Cloudflare terminates TLS at the edge and forwards traffic encrypted to the origin.

6. Logs

Logs (structured via pino) contain no personal data:

• GDPR webhook bodies are not logged
• inventory_levels/update payloads are not logged (the shop's trade secret)
• OAuth tokens are never emitted (only their existence is noted in debug logs)
• Free-text content of wishlist entries is not logged

7. Cookies and client-side storage (§ 25 TTDSG)

Stockify sets no cookies. The app interface runs embedded in the Shopify admin and uses only sessionStorage for the duration of the respective browser session:

These storage operations are strictly necessary for operating the app in the Shopify admin and are therefore exempt under § 25(2) No. 2 TTDSG — no consent is required. There is no tracking, no profiling and no disclosure to third parties.

localStorage is not used.

8. Processors and third-country transfer

Stockify uses the following external service providers as processors under Art. 28 GDPR:

8.1 Notes on the processors

• Brevo is used exclusively for transactional mail delivery — no marketing, tracking or profiling function. Shops that configure their own SMTP server in the Stockify settings bypass Brevo entirely — in that case the recipient and mail content are neither transmitted to nor processed by Brevo.
• Cloudflare naturally sees the TLS-terminated data stream between edge and origin. All Stockify traffic runs over a Cloudflare tunnel; there is no alternative in the current setup. For the owner mailbox [email protected], Cloudflare Email Routing is additionally used — mail to this address is forwarded to the controller's personal mailbox. Cloudflare processes these mails only for delivery and does not store them beyond the forwarding.
• Cloudflare R2 (off-site backups): The nightly database backups are synced to Cloudflare R2 as an additional off-site copy. The backups are encrypted client-side before upload (rclone crypt); the decryption key remains exclusively with the controller and is not made accessible to Cloudflare. Cloudflare therefore stores only a ciphertext that is unreadable in content to it and acts as a mere storage location.
• Obligations of the processors: All of the above processors are contractually obliged to comply with the GDPR, may only process the data on instructions, and are subject to confidentiality and security requirements under Art. 28(3) GDPR.

8.2 Recipients designated by the merchant (Discord / Slack)

If a shop stores a Discord or Slack webhook in the Stockify settings, Stockify transmits the report and alert content (shop domain, product titles, SKU, stock levels) to the webhook endpoint chosen by that shop.

This transmission does not take place as processing on behalf of Stockify: the recipient and the channel are determined and configured solely by the merchant; Discord or Slack act in this respect as third-party recipients designated by the merchant of the merchant's own communication service. Stockify is here a mere transmission tool acting on the merchant's instructions. The controller within the meaning of Art. 4(7) GDPR for these data flows is the respective merchant, not Stockify; in particular, the merchant bears responsibility for any of its own data processing agreements with Discord (USA, EU-US Data Privacy Framework) or Salesforce/Slack (USA, EU-US Data Privacy Framework).

The recipient URL is stored in the Stockify database as the shop's technical configuration (see the table in section 2) and used exclusively to send the reports and alerts activated by the merchant.

8.3 Owner trigger pings to Discord (internal, no personal reference)

On a new entry in the wishlist/feature requests, Stockify sends a content-free trigger ping to a private Discord webhook of the controller. The payload is a hard-coded constant text:

• Wishlist: "A new wish was submitted. Review it in the Stockify database." + timestamp

No shop identifiers, no free-text content, no recipient mails and no other personal data are transmitted to Discord. The controller reads the actual content of the wishlist entries manually in the local Stockify database.

Since no personal data is processed with these pings, there is no application of Art. 28 GDPR in this respect; Discord is here not a processor but a technical communication channel for the controller's internal operational organisation.

9. Data subject rights

You have the right at any time to:

• Access the data stored about you (Art. 15 GDPR)

• Rectification of inaccurate data (Art. 16 GDPR)

• Erasure of your data (Art. 17 GDPR) — "right to be forgotten"

• Restriction of processing (Art. 18 GDPR)

• Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR)

• Object to processing (Art. 21 GDPR)

• Withdraw consent given with effect for the future (Art. 7(3) GDPR) — applies above all to the voluntary entries in pricing feedback and wishlist

• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Competent for the controller:

  State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) Kavalleriestraße 2–4 40213 Düsseldorf, Germany https://www.ldi.nrw.de

  You may also contact the supervisory authority of your habitual residence.

Please address requests concerning your rights informally to [email protected]. For shop data, the Shopify-native customers/data_request / customers/redact / shop/redact mechanism is also available (see section 4).

10. Transfer to third countries

Within Stockify's sphere of responsibility, a transfer to third countries takes place exclusively to the processors named in section 8. Specifically:

• Cloudflare, Inc. (USA) — ingress, email routing and encrypted off-site backup storage (R2; unreadable in content to Cloudflare). Legal basis: Art. 45 GDPR in conjunction with the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023), supplemented by EU Standard Contractual Clauses (SCC) of the EU Commission of 4 June 2021 as a fallback.
• Shopify (Canada portion) — group DPA with SCC.

Brevo processes exclusively within the EU. A list of certified US recipients is available at https://www.dataprivacyframework.gov/.

If the merchant additionally designates its own recipients in the USA (Discord webhook, Slack webhook — see section 8.2), the transfer there takes place within the merchant's sphere of responsibility. Stockify merely executes this transfer technically on the merchant's instructions.

11. Complaint and breach notification

Should a data breach (Art. 33 GDPR) occur despite all technical and organisational measures, it will be reported to the LDI NRW within 72 hours of becoming aware of it. Affected shops will — where there is a high risk (Art. 34 GDPR) — be notified via the stored email_address.

12. Change history

This privacy notice is kept in sync with the code: changes to the data model or to the sub-processor stack trigger an immediate update of this file. The state of the most recent change is noted at the top under "Last updated".