Privacy Policy

StockBeat ("we", "our", or "the App") is a Shopify application developed by Noema Works that helps merchants monitor inventory levels, detect stockout risks, and recover cash tied in stagnant stock.

This Privacy Policy describes how we collect, use, and protect information when you install and use StockBeat, submit a message through the in-app Support page, or submit your contact information through the StockBeat early access page.

1. Information We Collect

When you install StockBeat, we access the following Shopify data through authorized API scopes:

Store & Product Data

• Product catalog (titles, variants, SKUs, prices)
• Inventory levels and locations
• Order history (order IDs, line items, quantities, revenue amounts, dates)

Authentication Data

• Shopify store domain
• OAuth access tokens (required to communicate with the Shopify API on your behalf)

Merchant Identity

• Store owner name and email (provided by Shopify during app installation)

Pre-Launch Contact Requests

• Email address submitted through the StockBeat early access page
• Optional Shopify store URL or store domain that you choose to share with us

Support & Feedback Data

• Messages you choose to send through the in-app Support page
• Optional one-to-five ratings for ease of use, features, and likelihood to recommend
• The Shopify user ID and email available for the signed-in administrator who submits the message

What We Do NOT Collect

• End-customer personally identifiable information (names, emails, phone numbers, or addresses)
• Payment or credit card information
• Customer browsing or behavioral data

2. How We Use Your Data

We use the collected data exclusively to:

• Inventory Monitoring: Track stock levels across your locations and variants.
• Stockout Risk Detection: Calculate sales velocity and predict when products may go out of stock.
• Cash Recovery Analysis: Identify stagnant inventory tying up capital.
• Dashboard & Reporting: Display insights, metrics, and recommendations within the App.
• Notifications: Send opt-in, plan-aware inventory alert notifications to the merchant email address based on enabled preferences.
• Support: Respond to messages you submit, review optional product feedback, and notify our support team.
• Early Access & Launch Updates: Review expressions of interest, follow up about potential early access, and notify interested merchants when StockBeat launches publicly.
• Billing: Process subscription charges through Shopify's billing API.

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

3. Data Storage & Security

• Infrastructure: Data is stored in a PostgreSQL database hosted on Supabase, with servers located in secure data centers.
• Encryption in Transit: All data transmitted between your browser, Shopify, and our servers is encrypted using TLS/HTTPS with HSTS enforcement.
• Encryption at Rest: Database storage is encrypted at the disk level by our infrastructure provider.
• Access Control: API access is restricted via bearer token authentication with timing-safe cryptographic comparison.
• Isolation: Each store's data is logically isolated by shop ID. No store can access another store's data.

4. Data Retention

• Active stores: We retain the operational data required to provide StockBeat for as long as the App remains installed on your store.
• After uninstallation: Operational store data (products, inventory, orders, credentials, sessions, refresh metadata, alert-notification data, and support messages and ratings) is permanently deleted immediately upon app uninstallation.
• Legal and audit records: We may retain the minimum records needed to evidence your acceptance of the StockBeat Terms of Use and acknowledgement of this Privacy Policy, including document versions, timestamps, shop identity, and related audit metadata. These records are retained only as needed to exercise or defend legal rights and are not used to operate the App after uninstallation.
• GDPR shop redaction: Shopify sends a final redaction request 48 hours after uninstallation. We process this request and confirm operational store data has been purged, while preserving legal/audit records where retention is legally required or justified.
• Exceptional orphaned records: If a technical failure prevents the normal uninstall purge flow, our operational policy is to remove orphaned tenant data within 30 days.

5. Data Sharing

We use the following third-party services to operate the App:

We do not share data with any other third parties, except as required to deliver the service or comply with legal obligations.

6. Your Rights

As a merchant, you have the right to:

• Access: Request a copy of the data we store about your shop.
• Deletion: Uninstall the App at any time to trigger immediate deletion of operational app data.
• Legal records: Legal/audit records may be retained after deletion of operational app data when necessary to exercise or defend legal rights.
• Portability: Request an export of your data in a machine-readable format.
• Correction: Contact us to correct any inaccurate data.

End-Customer Rights (GDPR / CCPA)

StockBeat does not store end-customer personally identifiable information. We process Shopify's mandatory GDPR webhooks:

• Customer Data Request: We acknowledge and confirm no customer PII is stored.
• Customer Redaction: We acknowledge and confirm no customer PII needs redaction.
• Shop Redaction: We permanently delete operational store data, subject to legally required or justified retention of legal/audit records.

If an end-customer contacts you regarding their data, please note that StockBeat only stores aggregated order-line data (product, quantity, revenue) and does not retain any information that could identify individual customers.

7. Cookies & Tracking

StockBeat is an embedded Shopify app and does not use cookies, tracking pixels, or third-party analytics on your storefront. The App operates entirely within the Shopify Admin interface.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Each published version has a unique version identifier and effective date so StockBeat can record which version was acknowledged when you accept the App's legal terms.

If we make material changes, we will notify you through the App or via email and may require a new acknowledgement before continued use of StockBeat.

9. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

10. Shopify App Store

This App is distributed through the Shopify App Store and complies with Shopify's API Terms of Service and Shopify's Partner Program Agreement.