Privacy policy

Who is responsible

The controller of your personal data is Inventify, 6000 Castelo Branco, Portugal. Questions and requests: contact@inventify.net.

For the data your team puts into a workshop (for example names of colleagues or customers in notes), the workshop owner decides how it is used, and we process it on their behalf.

What we keep

• Account: your name, email address, password (stored only as a secure hash), passkeys and two-factor settings if you turn them on, and the language you choose.
• Workshops: the workshops you belong to, your role, and the materials, stock, projects and runs you and your team record, including who made each change.
• Billing: for paid plans, the plan, subscription status and the last four digits and brand of the card, received from Stripe. Card details themselves are handled by Stripe only.
• Technical: your IP address and browser in session records and security logs, used to keep your account safe.
• Emails we send you: email verification, invitations, low-stock alerts, weekly summaries (if you turn them on) and password resets. Payment receipts come from Stripe.

Why, and on what basis

• To provide Stocky and your subscription: performance of our contract with you.
• To keep the service secure, prevent abuse and fix problems: our legitimate interest in running a safe service.
• To keep invoices and tax records: our legal obligation.

We do not sell your data, show ads, or use your workshop data to train anything.

Who helps us

• Stripe processes payments and invoices.
• RackNerd hosts the application and database.
• Inventify sends our emails.

Each works under a data processing agreement. Where data leaves the European Economic Area, it is protected by the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

• Account and workshop data: while your account exists. When you delete your account, your personal data is deleted, and so are the workshops where you were the only member. (An owner of a workshop with other members hands it over first.)
• Invoices and payment records: as long as tax law requires (in Portugal, up to 10 years).
• Server logs: for a limited time, and no longer than 14 days.

Your rights

You can ask to see, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw any consent you gave. Much of this you can do yourself: edit your profile and download your data in Settings, or delete your account there. For anything else, write to contact@inventify.net. You can also complain to the Portuguese data protection authority (CNPD) or the authority where you live.

Security

Connections are encrypted, passwords are hashed, two-factor sign-in and passkeys are available, and each workshop’s data is kept separate from every other workshop’s.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app. Cookies are covered in the cookie policy.