StockRunway

StockRunway: Privacy Policy

Last updated: October 23, 2026

1. Data controller

The data controller is David D'Andreagiovanni, a sole proprietor (Italian VAT no. IT02105030494), Livorno, Italy. Contact: support@getstockrunway.com.

No Data Protection Officer (DPO) has been appointed: the app does not carry out systematic, large-scale processing of special categories of data. For any privacy-related request, write to the address above.

2. Data we read from your Shopify store

StockRunway accesses, read-only (no writes), via the read_products, read_orders, read_all_orders scopes:

  • Products: title, vendor, SKU (only for products to reorder), total inventory per variant, and lowest variant price (to estimate sales at risk and sales lost while a product was out of stock).
  • Orders: date and quantities sold per product, in aggregate form, for up to the last 2 years (this is why we need read_all_orders: without it, Shopify only exposes the last 60 days). The orders query only requests the order date and, for each line item, quantity, SKU, product ID and variant ID; only if you grant the optional inventory or locations permissions, a separate query also reads the location each line was sold or shipped from (for sales by location). Another separate query reads, for each order, only the sales channel (Shopify, Amazon, eBay, Walmart or other) and the line quantities, for sales by channel. We never request or receive the name, email, address, or any other identifying data of your store's end customers.

This data is used exclusively to calculate historical sales velocity and generate the stockout-risk alerts shown on the dashboard. It is necessary for the app to work: without access to products and orders, StockRunway cannot generate alerts.

Optional permissions (advanced features): only if you turn them on in Settings, the app also reads, read-only, via read_inventory, read_locations, read_inventory_purchase_orders, read_inventory_transfers and read_inventory_shipments: ID and name of your locations (warehouses and stores), stock per location and per variant, purchase orders (supplier, products, quantities ordered and received), and the quantities already received (accepted, rejected or canceled) in the transfers and shipments linked to purchase orders, so only units not yet received count as on the way. They are used to show stock and alerts per location and per variant and to take stock already on order into account. We keep sales per location for 35 days; everything else is read live from Shopify at each calculation, without storing it. You can revoke these permissions at any time in Settings: the app keeps working with the required permissions only.

3. Legal basis for processing

Processing is based on the performance of a contract to which you are a party (Art. 6(1)(b) GDPR): by installing the app you accept the Terms of Service, and the data described above is necessary to provide the requested service.

4. Data we store in our database

For each installed store we only keep:

  • the Shopify session (OAuth token, store domain);
  • daily totals of units sold per product (no customer data), used for sales history and forecasts; we also save the same totals per variant (size, color) and per sales channel;
  • the stock quantity of monitored products and their variants, saved once a day (product or variant ID, day and quantity), to work out the days on which a product or one of its variants (e.g. a size) was out of stock; we keep it for 400 days and delete it on uninstall;
  • the notification settings you configure (Slack webhook, destination email address) and any referral code entered. If you don't enter a destination email, we fill it in once with the store email Shopify provides: you can change or delete it in Settings. The destination email receives:
    • alerts;
    • at most once every 30 days, an invitation to review the app when a critical alert is resolved;
    • once, in the first days after installation, a welcome email;
    • once, about 14 days after installation, your referral code;
    • if you have no subscription, two emails about the end of the launch promo (one in the last week before it ends, one within 14 days after).
    On the Pro plan you can add up to 4 more email addresses and 4 more Slack webhooks: they only receive alerts (the review invitation, referral code and promo emails only go to the first address); if you switch to another plan they stay saved but unused until you delete them in Settings;
  • for Shopify's official in-app review request: how many times we asked, how many times Shopify showed it, and the date and outcome of the last request, so we don't ask too often;
  • the products you mark as ordered or snooze from the dashboard (product or variant ID, stock at that moment and the pause end date), so we don't send you alerts about them in the meantime;
  • the products already included in the last email or Slack alert and their level (product or variant ID, critical or warning) and the day of the last Monday summary, so we only write when something changes, and the IDs of the products or variants that were critical at the last daily run, to ask you for a review when one is resolved;
  • the latest list of products to reorder calculated by the daily run and when you open the alerts page (product ID and name and, for a variant, its ID and name, level, days left, order-by date, suggested quantity and the reason), overwritten at each new calculation, to answer Shopify Sidekick, and the IDs of the critical products or variants already sent to Shopify Flow, so they are not sent twice (only on plans that include these features);
  • the settings and status we need to run the app:
    • the supplier lead time and alert sensitivity you set in Settings (and the lead time, units per pack, minimum order, and supplier of individual products, if you set them on the alerts page or import them from a CSV file: the file is read only to match the values to your products by SKU and is not kept);
    • which first steps you have completed (lead time saved, test notification delivered) and whether you closed that list;
    • whether you closed the end-of-promo banner;
    • the date our email provider started rejecting each destination address (to warn you in Settings; cleared on the next successful delivery or when you change the address);
    • the date we first saw the app installed and the dates of the welcome, referral code, and end-of-promo emails;
    • the date we filled in the destination email with the store email;
    • whether you subscribed before the launch promo ended and whether your free trial has already been extended (so we can extend your free trial to the first promo charge, only once);
  • suppliers: the supplier you choose for a product and, for each supplier, the lead time and email address you enter in Settings. The supplier's email is third-party data you provide to us: we only use it to prepare the "Email supplier" message and, on the Pro plan, to send them the reorder list when you ask by pressing "Send to supplier" (never automatically, at most 20 sends a day; we only keep the number of sends of the day). Make sure you may share it with us for this purpose;

We never store payment data: subscription billing runs entirely through Shopify Billing.

If you write to us through the in-app Contact us form, we receive your message and your store's name and email address by email, only to reply to you: the message is not stored in the app's database.

5. Retention and deletion

We keep this data for as long as the app remains installed. Upon uninstall, we automatically delete the store's session, settings and sales history within 48 hours, as required by Shopify's shop/redact compliance webhook. Since the app never stores identifying data about end customers, the customers/data_request and customers/redact webhooks simply confirm the request. The only exception: if the store used a referral code, we keep a one-way hash of its domain and the date of use, nothing else, even after uninstall, so a code can't be reused by reinstalling the app (abuse prevention).

6. Recipients and sub-processors

We only share data with the technical providers strictly necessary:

  • Shopify Sidekick and Shopify Flow (only on plans that include these features, inside your own store): Sidekick receives the list of products to reorder when you ask for it in the admin; when a product or one of its variants becomes critical, Flow receives the product, the variant name, the days left, the suggested quantity and the order-by date, and only runs the workflows you created. Never data about your end customers.
  • Slack (only if you configure a webhook): receives the alert text (product, risk level, suggested reorder quantity, stock, sales pace, and supplier lead time), never your end customers' data.
  • Transactional email provider (only if you configure a destination email): receives the same type of content, never customer data. It also delivers, on the Pro plan, the reorder list to the supplier when you press "Send to supplier" (supplier email, products, SKUs and quantities, store name and email for replies and the copy). It also delivers the messages you send us from the Contact us form (message, store name and domain and, when available, the store's email address).

If you enter a partner code on the Plans page, we check it on our website getstockrunway.com: we send only the code, no other store data. The app's public address /api/partner-count/<code> shows only how many stores arrived with that partner code, without any store data.

We never sell or share data for advertising purposes.

7. International transfers

The app is hosted on Railway (railway.com) in the EU region, in Amsterdam, Netherlands: the app's data therefore stays within the European Economic Area (EEA). Should any provider listed in section 6 process data outside the EEA, that transfer only takes place under adequate safeguards per Art. 44-49 GDPR, typically the European Commission's Standard Contractual Clauses.

8. Data security

We apply appropriate technical and organizational measures: encrypted connections (HTTPS/TLS) for every communication, API credentials and keys managed exclusively via environment variables (never stored in plain text in code or database), database access limited to the controller only.

9. Your rights

As a data subject you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), port (Art. 20) and object to (Art. 21) your data, as well as the right to lodge a complaint with your national data protection authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it); EU residents may also contact their own country's authority. To exercise these rights, write to support@getstockrunway.com: we reply within 30 days.

10. No automated decision-making

We do not carry out profiling or decisions based solely on automated processing under Art. 22 GDPR: the alerts generated are informational suggestions that always require your own evaluation before any reordering action.

11. Shopify compliance webhooks

We handle the mandatory compliance webhooks required by the Shopify App Store: customers/data_request, customers/redact, shop/redact. Since the app never stores identifying data about end customers, the first two simply confirm the request; the third actually deletes the store's session, settings, and sales history from the database within 48 hours of uninstall.

12. Changes to this notice

Any substantial changes will be communicated by email or an in-app notice at least 15 days before they take effect.

13. Contact

For any privacy-related request: support@getstockrunway.com.