Privacy Policy

This policy explains what Up Stock collects, why we collect it, and what you can do about it. It applies to the Up Stock web application and mobile app.

1. Information We Collect

• Account Data: your email address, your name, and the sign-in method you choose. You can sign in either with your Google account or with a one-time code sent to your email address.
• Business Data: the records you enter into the app, including stores, inventory items, categories, variants, suppliers, customers, purchase orders, sales orders, transactions, and credit payments.
• Team Data: the email addresses of people you invite to your workspace, and the role you assign them.
• Billing Data: your subscription plan, billing cycle, payment status, and payment expiry date. Card payments are handled by our payment processor - we never receive or store your full card number.
• Feedback: the rating and message you send us if you choose to submit feedback.
• Technical Data: standard server log information such as IP address, browser, and device type, recorded by our hosting and authentication providers to keep the Service secure and available.

2. What We Do Not Collect: Up Stock contains no third-party analytics, advertising, or tracking SDKs. We do not build advertising profiles, we do not track you across other apps or websites, and we do not sell or share your personal or business data with third parties for advertising purposes.

3. How We Use Your Information: We use the collected data to:

• Create your account and keep you signed in.
• Store your inventory records and sync them across your devices.
• Provide customer support when you contact us.
• Process subscription payments and issue renewal reminders.
• Send essential service email, such as team invitations, security alerts, and billing notices.
• Keep the Service secure, diagnose faults, and improve reliability.

4. Cookies: We use only the cookies the app needs to function - a session cookie that keeps you signed in, and a cookie that records whether you accepted our cookie notice so we do not ask again. We do not use advertising or tracking cookies.

5. Data Storage & Security: Your data is stored in a PostgreSQL database hosted by Supabase. Traffic between your device and our servers is encrypted in transit, and data is encrypted at rest by our database provider. Each workspace is isolated at the database level using row-level security, so one customer's records cannot be read by another. Access to production data is restricted to the personnel who need it to operate the Service.

6. Third-Party Services: We share data with these providers only to the extent needed to run the Service:

• Supabase - authentication, database hosting, and delivery of one-time sign-in codes.
• Google - if, and only if, you choose to sign in with your Google account. We receive your email address and basic profile information; we never receive your Google password.
• Paddle - payment processing for card subscriptions. Paddle acts as merchant of record and handles your card details directly under its own privacy policy.
• Upstash - temporary caching of application data to keep the app responsive.
• Our email provider - delivery of transactional email such as invitations and payment reminders.
• Vercel - hosting of the application itself.

7. Your Rights: Depending on your location, you may have the right to:

• Access: request a copy of the data we hold about you.
• Correction: update any inaccurate information.
• Export: download your inventory records at any time using the built-in PDF and Excel export.
• Deletion: delete your account and all associated data yourself, using the "Delete My Account" button in your account settings, or by contacting us. Our Account Deletion page lists exactly what is removed and what is kept.

8. Data Retention: We retain your information for as long as your account is active. Deleting your account removes your personal and business data from our active databases immediately, not after a waiting period. The one exception is our payment event log, which records the payment processor's event references so a payment cannot be applied twice and a disputed charge can be investigated; deletion severs the link between those entries and you, and each entry is erased automatically one year after it was recorded. Copies may persist in our hosting provider's encrypted backups until those are rotated in the normal cycle, and we keep anything the law requires us to keep for as long as that obligation lasts. Our Account Deletion page sets this out in full.

9. Children: Up Stock is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18.

10. Changes to This Policy: We may update this policy from time to time. We will notify you of significant changes by email or through an in-app notification, and we will update the date at the top of this page.

11. Contact Us: If you have questions about this policy or want to exercise any of the rights above, contact us at support@ethiotechsolutions.com.