Privacy policy
This is the whole of what we collect, why, where it lives and how long it stays. Where our retention is not simply “delete everything”, that is stated plainly in section 4 rather than buried.
1. Two kinds of people, two different relationships
The distinction is legal, and it decides who answers a deletion request.
| Merchant | Shopper | |
|---|---|---|
| Who | The Shopify store owner who installs StockWait | Someone who joins a waitlist on that store |
| Our role | Controller | Processor, acting on the merchant’s instructions |
| Governing terms | Our terms of service | The merchant’s own privacy policy |
| Who answers a deletion request | Us | The merchant, through Shopify’s compliance webhooks |
If you are a shopper and you email us asking to be deleted, we will point you to the store you signed up with and action it ourselves. Arguing about controllership with someone exercising a right is not a good use of anyone’s time.
2. Shopper data
| What | Why | How long |
|---|---|---|
| Email address | To send the one alert they asked for | Until unsubscribe, redaction, or 24 months of inactivity |
| Phone number | SMS alerts, only where separately consented | As above |
| SHA-256 hash of the address | Suppression list and consent record | Kept after deletion — see section 4 |
| Product and variant ID | Knowing what they are waiting for | With the subscription |
| Price at signup | So later repricing does not distort demand figures | With the subscription |
| Locale | Sending the alert in their language | With the subscription |
| Consent record (source, timestamp, IP, copy version) | Proof the person asked to be contacted | Kept after deletion, minus the IP — section 4 |
| Delivery log (sent, opened, clicked, bounced) | Deliverability and the recovered-revenue figure | 24 months |
| Click and conversion records | Attribution | 24 months |
Not collected: names, postal addresses, browsing history, cross-site identifiers, or storefront cookies. The widget sets no cookie and reads none. It makes exactly two requests: one to read the merchant’s widget configuration, one to submit a signup.
3. Merchant data
| What | Why | How long |
|---|---|---|
| Shop domain, name, contact email, currency, timezone | Running the app | Life of the install + 60 days |
| Shopify access token | Reading inventory and products | Encrypted with AES-GCM; deleted at uninstall |
| Settings, templates, plan | The app’s configuration | Life of the install + 60 days |
| Product and variant catalogue cache | Mapping inventory webhooks to variants | Life of the install + 60 days |
| Order email address and line items | Matching a purchase back to the alert that caused it | 24 months; the address is hashed on arrival and the raw value is never stored |
4. The one place we do not delete everything
When a shopper is deleted, we keep two things: a hash of their address, and the fact that they consented.
This is deliberate, and here is the reasoning in full:
- The consent record is the merchant’s entire defence if they are ever accused of spamming, and it cannot be reconstructed after the fact. Discarding it would leave that accusation unanswerable.
- The suppression list is what stops an unsubscribed or bounced address being mailed again. An address removed from it would start receiving mail on the next restock — worse for the person than the retention.
What survives redaction: the address hash, consent timestamp, consent source, consent copy version, and the subscription’s status. What is destroyed: the address itself, the phone number, and the consent IP.
A SHA-256 hash is not reversible, and we hold no lookup table — but a hash of a known address can be checked against. So this is honest pseudonymisation rather than anonymisation, and we describe it that way here, in our DPA, and to merchants, rather than claiming more than it does.
5. Retention is enforced by a job, not by this page
A nightly task deletes on a deadline set the moment an uninstall arrives — 60 days out. It does not wait for Shopify’s follow-up redaction webhook, which fires 48 hours after uninstall and which, like any webhook, can be dropped.
A policy that promises 24 months while the database still holds everything since launch is worse than no policy at all. The job is what makes this section true.
6. Subprocessors
| Who | What they process | Where |
|---|---|---|
| Cloudflare | Compute, database, queues, storage — all shopper and merchant data | Global edge; database primary region configurable |
| Resend | Transactional email delivery: recipient address and message content | US / EU |
| Twilio (only when SMS is enabled) | SMS delivery: recipient number and message content | US |
| Shopify | The platform itself; source of product, inventory and order data | The merchant’s own Shopify region |
Merchants are notified 30 days before a subprocessor is added or changed.
7. Your rights
| Right | How it is served |
|---|---|
| Access | A data request assembles everything held and is answered within 30 days |
| Erasure | Immediate, real deletion, subject to section 4 |
| Withdraw consent | One-click unsubscribe in every email; STOP for SMS, honoured within seconds |
| Portability | CSV export, via the merchant |
| Object | Unsubscribe |
All three Shopify compliance webhooks complete the work before returning a success response, so a success is a genuine confirmation rather than an acknowledgement of intent.
8. Security
- Access tokens encrypted at rest with AES-GCM; keys held in Cloudflare Secrets Store, never in configuration or environment variables.
- Webhook signatures verified over raw bytes, compared in constant time, before anything is parsed.
- Session tokens verified with the audience pinned to our own client ID.
- Unsubscribe and click links are signed and opaque; neither can be guessed or enumerated.
- No query in the application spans two merchants — enforced by an automated test, not by a code-review habit — so a bug cannot leak one store’s data into another’s response.
- Every read that hands out shopper contact details is recorded: who, what, and how many people. For a lookup of a single person we record a hash, never the address — an audit log holding the data it guards would simply be a second copy of it.
9. Cookies and storefront tracking
None. The widget sets no cookies, uses no local storage, loads no analytics, and does not fingerprint. Our bot protection runs invisibly and without a cookie. This site sets no cookies either.
We state this explicitly because merchants get asked about third-party trackers during their own compliance reviews, and “the back-in-stock app adds none” is a short answer they can give.
10. International transfers
Data is processed on Cloudflare’s global network. Where personal data is transferred out of the EEA or UK, the transfer relies on the European Commission’s Standard Contractual Clauses, incorporated by reference in our data processing agreement.
11. Changes
Material changes are announced to merchants by email at least 30 days before they take effect. The date at the top of this page is the last revision.
12. Contact
Privacy questions and data requests: privacy@stockwait.com. Security reports: security@stockwait.com. We acknowledge security reports within one working day.