Privacy Policy

Multichannel Inventory (“we”, “us”) is operated by [company legal name], [company registration number], [registered address].

For account information (your name, email address, password) we decide how the data is used. For the business data an organization brings into the service — such as marketplace orders and the customer details in them — the organization decides what is processed, and we process it on its behalf. [confirm controller / processor roles and whether a data processing agreement is offered]

Account information. Your name, email address and a password. Passwords are stored only as a one-way hash (Argon2id); we cannot read them. We record when your email address was verified and when your password was last changed.

Sign-in sessions. When you sign in we create a session and keep, for security, the time it was created and last used, the IP address and the browser's user-agent string. Only a hash of the session token is stored.

Organization and team information. Organization name and settings (time zone, currency), the members of an organization and their roles, and invitations (the invited email address, role, who invited them and when).

Marketplace credentials. When an organization Owner connects a marketplace account, the API key is encrypted (AES-256-GCM) before it is stored. It is never shown again in the application; only its last characters are displayed.

Marketplace and inventory data. Listings and offers (marketplace SKUs, titles, identifiers, prices and quantities), the products (Main SKUs), stock levels, stock movements, SKU mappings and reconciliation decisions that an organization manages in the service.

Order and customer data. Orders imported from connected marketplaces, which can include the end customer's name, email address, phone number and delivery or billing address, as provided by the marketplace. Roles without the customer-data permission see a masked version.

Activity and audit logs. A record of changes made in an organization (who did what and when, for example a stock adjustment, an order action or a settings change), kept so changes can be traced.

Email delivery records. For each service email we keep its type, a masked recipient (for example “ja***@example.com”), the time and whether delivery succeeded. The content of the email is not stored in this log.

Security counters. Short-lived counters keyed by IP address or email address are used to limit repeated sign-in attempts and emails.

• To create and secure your account, sign you in and keep your session.
• To send service emails: email verification, password reset, password-changed notices and team invitations. We do not send marketing email.
• To provide the service to your organization: importing listings and orders, keeping inventory, reserving stock and — only when the organization enables it — updating stock quantities on connected marketplaces.
• To enforce permissions, keep the audit history and investigate problems or misuse.
• To meet legal obligations. [legal bases for processing, if required in your jurisdiction]

We use only cookies needed for the service to work and to remember display preferences:

• Session cookie (mis_session, or __Host-mis_session on secure connections): keeps you signed in. It is HttpOnly, so page scripts cannot read it.
• Preference cookies (sidebar_collapsed, table_density): remember how you like the application laid out.

We do not use advertising or analytics cookies and do not include third-party trackers.

We do not sell personal data. To run the service we rely on these providers, who process data on our behalf:

• Hosting and infrastructure (application servers, database, cache): [hosting provider and data location].
• Transactional email delivery: [email provider, e.g. Resend — confirm once enabled]. It receives the recipient address and the email content needed to deliver service emails.

Marketplaces you connect (currently B&Q / Kingfisher) exchange data with the service at your organization's direction, using the API key the organization provides; their own privacy terms apply to data they hold.

We may disclose information if required by law or to protect the security of the service and its users. [international data transfers and safeguards, if applicable]

We keep information only as long as it is needed for the purposes above:

• Account information: while the account exists. [period after account closure]
• Organization data (inventory, orders, mappings, audit history): while the organization uses the service. If an organization is deleted, its data is deleted with it. [period and backup retention]
• Sessions end after inactivity (7 days by default) and after at most 30 days; expired session records [deletion period].
• Email verification and password-reset links expire after 24 hours and 1 hour; invitations after 7 days.
• Email delivery records: [retention period].

Self-service account deletion is not available yet; to have an account or organization deleted, contact us at support@stockdaddy.online.

We protect information with measures appropriate to a business application, including:

• Passwords hashed with Argon2id; email and session tokens stored only as hashes.
• Marketplace API keys encrypted at rest and never returned to the browser.
• Strict separation between organizations and role-based permissions checked on every request.
• Rate limiting of sign-in attempts and emails, and an append-only audit history.
• Encrypted connections (HTTPS) in production. [hosting security details, backups]

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict certain processing. You can update your name and password on your profile page. For other requests contact support@stockdaddy.online. [supervisory authority / complaint route, if applicable]

If you are a customer of a seller using the service (for example, you bought something on a marketplace), please contact that seller first: they decide how your order data is used.

The service is intended for businesses and is not directed at children.

We may update this policy as the service changes. We will update the date at the top and, for significant changes, tell account holders by email or in the application.

Questions about privacy: support@stockdaddy.online. You can also use the support page.