Privacy Policy

This Privacy Policy applies to:

• Business customers who subscribe to Stockedin (“Customers”).
• Individual users (employees, managers, staff) who access Stockedin under a Customer account (“Users”).
• Visitors to our website.

If you are a User accessing Stockedin through your employer’s account, your employer (the Customer) is primarily responsible for your data under our agreement with them. This Policy describes how we handle data on their behalf.

2.1 Information Customers and Users Provide

• Business contact information: business name, address, phone number, email address.
• Account login credentials: the email address and password used by an account owner to sign in. Passwords are hashed by our authentication provider (Supabase) and are not stored in readable form by us.
• Staff access PINs: short numeric PINs that a Customer assigns to its employees (staff, manager, owner) to control which in-app screens each person can open and to attribute activity. These PINs gate in-app access only; they are not account-login credentials and are not stored as cryptographic secrets.
• Inventory and product data: product names, SKUs, UPC/barcode data, product categories, pricing, vendor names, reorder (par) levels, and stock counts.
• Vendor and supplier information provided by Customer.
• Uploaded documents: vendor invoices, price sheets, and catalog files (including PDFs, spreadsheets, and photos) that you submit for scanning. Uploaded invoice images may be stored so you can review the original source document (see Section 5).
• Payment information: billing name, billing address. Note: credit card and ACH details are processed directly by Stripe and are not stored on our servers.
• Communications: emails, support messages, feedback, text messages you send to the assistant, and other communications you send us.

2.2 Information We Collect Automatically

• Log data: IP address, access times, and error logs generated when you use the Platform.
• Cookies and similar technologies used to keep you signed in and remember preferences (see Section 7 below).

We do not currently use third-party product-analytics tools that track individual clicks, page-by-page navigation, or time spent in the Platform.

2.3 Information We Receive from Third Parties

• Payment information from Stripe (transaction confirmations, billing status).
• UPC and barcode data from publicly available product databases used for catalog matching.
• Point-of-sale (POS) data from a Customer-connected POS system (for example, Toast or Focus/Shift4), as described in Section 3.1.

We use collected information to:

• Provide, operate, and improve the Stockedin Platform.
• Set up and configure Customer accounts and inventory data.
• Process payments and manage billing.
• Send transactional communications (receipts, invoices, account alerts, low-stock notifications).
• Power AI features such as invoice and catalog scanning, reorder and par-level suggestions (see Section 3.2).
• Respond to support requests and communications.
• Diagnose technical issues and improve Platform stability.
• Comply with applicable laws and legal obligations.
• Protect the security and integrity of the Platform.

We do NOT sell your personal information or Customer Data to third parties.
We do NOT use your Customer Data to market products or services to your customers or competitors.

3.1 Point-of-Sale (POS) Data

If a Customer chooses to connect a point-of-sale system (for example, Toast or Focus/Shift4), the Platform reads data from that POS to keep inventory and reporting current. Depending on the POS, this may include:

• Menu items and their categories and prices.
• Item-level sales activity: quantities sold, line prices, voids, and revenue, used to deplete inventory and produce cost and sales reports.
• Employee labor information used for the nightly tip-split, including employee names, hours worked, shift (job) role, clock-in times, and the sales rung in while each employee was on the clock.

We use POS data to automatically reduce inventory as items are sold, to generate cost, sales, and variance reports, and to pre-fill the nightly tip-split. We do not receive guest or customer payment-card numbers or guest personal information from the POS; the Platform reads sale amounts, tip amounts, and payment type (such as cash or card) for reconciliation, but not cardholder data.

Ownership. POS data, including employee labor information, belongs to the Customer (the business). Stockedin processes it only to provide the Platform to that Customer. Where a Customer connects a POS, the Customer is responsible for having an appropriate basis to share its employees’ labor information with us for this purpose.

3.2 How We Use AI

Some Platform features are powered by a third-party artificial-intelligence provider, Anthropic (the maker of Claude). To deliver these features, we send relevant business data to Anthropic’s API for processing. This includes:

• Images and files of vendor invoices, price sheets, and catalogs you upload for scanning.
• Product names, brands, categories, vendor names, inventory counts, par levels, cost figures, and related inventory activity, when you use AI features such as insights, par suggestions, reorder review, waste analysis, recipe drafting, voice-assisted counting, or the “ask” assistant.

We do not send payment-card data, ACH details, or account passwords to the AI provider. Data sent to Anthropic is processed under Anthropic’s commercial terms. We rely on those commercial terms governing how the provider may use data submitted through its API. We encourage Customers to review Anthropic’s privacy and usage terms for additional detail.

We may share information with:

4.1 Service Providers (Sub-Processors)

We work with trusted third-party service providers (sub-processors) who process data on our behalf to operate the Platform. These currently include:

• Stripe — payment and subscription processing.
• Supabase — database hosting, account authentication, and storage.
• Vercel — application hosting and infrastructure.
• Anthropic — AI processing that powers invoice/catalog scanning and suggestions (see Section 3.2).
• Vercel Blob — storage of uploaded documents, such as scanned invoice images.
• Upstash — rate-limiting (abuse prevention).

All service providers are contractually required to handle data securely and only for the purposes we authorize. We may update this list as our service providers change; the current list is available on request.

4.2 Legal Requirements

We may disclose information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Davis Digital, our customers, or others.

4.3 Business Transfers

If Davis Digital Systems LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify affected customers of any such transfer.

4.4 With Your Consent

We may share information for other purposes with your explicit consent.

5.1 Customer Data Ownership. All inventory data, product catalogs, vendor information, and other business data you upload to the Platform remains your property. We process it solely to provide the Platform services.

5.2 Retention. We retain Customer Data for the duration of the subscription and for thirty (30) days after termination, after which it may be deleted. Customers may request data export prior to account closure.

5.3 POS Data. Point-of-sale data ingested from a connected POS (menu items, sales activity, and nightly tip-split records, including the employee labor information captured with each closed business day) is retained for the duration of the subscription to support historical reporting and variance analysis, and is subject to the same post-termination handling as other Customer Data.

5.4 Uploaded Invoice Images. Invoice and document images uploaded for scanning and stored so you can review the source document are retained for the duration of the subscription and are subject to the same post-termination handling as other Customer Data, unless deleted earlier.

5.5 Aggregated Data. We may retain anonymized, aggregated data derived from usage of the Platform indefinitely for product improvement purposes.

5.6 Account Data. Account information (contact info, billing history) may be retained for up to seven (7) years for legal, tax, and accounting purposes.

Depending on your location and applicable law, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Data Portability: Request a machine-readable export of your Customer Data.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link.
• Restrict Processing: Request that we restrict processing of your information in certain circumstances.

To exercise any of these rights, contact us at: support@stockedin.app or 651-338-1763. We will respond to verified requests within thirty (30) days.

We use cookies and similar technologies to:

• Maintain User login sessions.
• Remember preferences (such as light or dark theme).

You may configure your browser to refuse cookies, but doing so may affect your ability to use certain Platform features, including staying signed in. We do not use third-party advertising cookies, we do not use cookies to build cross-site advertising profiles, and we do not sell cookie data.

We implement commercially reasonable technical, administrative, and physical safeguards to protect your information, including:

• Encrypted data transmission (HTTPS/TLS).
• Access controls limiting employee access to Customer Data.
• Regular security reviews of our infrastructure.

No method of data transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that affects your information, we will notify you as required by applicable law.

9.1 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. To submit a California privacy request, contact us at: support@stockedin.app.

9.2 Other State Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws may have similar rights. We will honor verified requests consistent with applicable law. Contact us at the information below for any privacy request.

The Stockedin Platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will notify Customers via email or a notice within the Platform. The updated Policy will include a revised effective date. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For questions, concerns, or requests related to this Privacy Policy, please contact us at: