Privacy policy

The controller of the personal data described below is Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Nothing below is bought, sold or used for advertising. We run no advertising or analytics trackers.

Your name, email address and a hash of your password

To sign you in; reorder alerts are emailed to this address from the moment you connect a store, until you change or switch off email alerts in Settings > Alerts

Your store's .myshopify.com domain, a Shopify Admin API access token (granted at install or pasted from your custom app) and that app's API secret key

To read products, inventory levels and orders from your store, and to verify the webhook deliveries Shopify signs with the secret key; both are stored server-side and never shown in the app

Sync bookkeeping: when your store last synced, whether its stock came from Shopify or sample data, how much of your catalogue it read, and any sync error

So a stalled or partial sync can be seen and fixed rather than quietly showing you stale stock. No product or order content beyond what is listed above

Tracked SKUs: title, your own SKU code, Shopify variant id, current stock, lead time and computed reorder point

To work out days of inventory remaining and when each SKU crosses its reorder point

Sales quantities and dates per SKU, with the Shopify order reference

To calculate sales velocity over your chosen window. No customer names, addresses or payment details are stored

Your alert settings: the email address reorder alerts go to (your account email until you change it) and a Slack webhook URL, if you set one

To deliver reorder alerts where you asked

Which setup steps your account has reached (account created, store connected, first sync, first lead time saved) and when it reached each

So a setup that stalls can be found and fixed instead of looking like a store that lost interest

Your plan tier, trial end date and the state of your Shopify subscription charge

To know what your plan allows and whether the trial is still running; payment details stay with Shopify and never reach us

When you last used the app (at most once an hour) and which core actions you completed, such as a lead time saved or a report exported

To see whether Restoc is used and improve it. First-party only, in our own database; no third-party analytics or session replay; only totals leave the product; events older than 16 weeks are deleted

Your customers are not our concern: no customer names, addresses or payment details are read from your store or stored here.

A session cookie keeps you signed in, and one more cookie remembers the plan you picked before your store was connected. Your light or dark theme choice is kept in your browser and never sent to us. There are no third-party cookies.

Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront; the Postgres database stays in its region.

These are the only services your data reaches, each for the one job named beside it.

Shopify

The source of your products, inventory and orders; bills your subscription on your Shopify invoice

Amazon Web Services

Hosts the app and its Postgres database, and sends reorder alert and account emails through Amazon SES; switch email alerts off in Settings > Alerts

Slack

Receives reorder alerts at a webhook you configure, if you enable Slack alerts

Your subscription is charged by Shopify, on your Shopify invoice. Card details never reach Restoc: we store only your plan, your trial end date and the state of the charge Shopify holds.

Kept while your account is open: sales history feeds the velocity calculation for as long as you use the product. Usage events are deleted after 16 weeks. Deleting your account removes everything at once; there is no separate archive of your data.

Settings > Account in the app exports a JSON file of everything held about your account and store, and deletes the account and everything stored about your store at once: the Shopify connection and its access token, every SKU, sales record, alert and report. You type your account email to confirm, and any active Shopify charge is cancelled. Uninstalling from your Shopify admin also ends billing.

Delete your account whenever you want. You can also ask us to do it, and to send you a copy of what we hold first.

A security page that names its gaps is worth more than one that implies there are none. These are not in place:

• An independent security audit or a certification such as SOC 2 or ISO 27001
• Single sign-on (SSO); sign-in is email and password
• Two-factor authentication
• A standing data processing agreement; ask if you need one signed
• A choice of data region

The current wording is always on this page, with the date it took effect at the top. If a change alters what we store, where it is kept or who processes it, the new wording is published here before it applies to you.

Restoc is operated by Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Write to support@restocapp.com with any question about this document, a request to see or correct what we hold, or a complaint. We answer in writing.