1. Who We Are
This Privacy Policy explains how James Brown trading as StockPropel ("StockPropel", "we", "us", or "our") collects, uses, stores, and protects data in connection with the StockPropel Shopify application (the "App").
We are the data controller in respect of the data described in this policy. We are committed to handling data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have questions about this policy or wish to exercise your data rights, please contact us at: hello@stockpropel.com
2. Who This Policy Applies To
This policy applies to:
- Merchants who install and use the StockPropel App ("Merchants");
- Visitors to Merchant storefronts on which the StockPropel tracking script is active ("Storefront Visitors").
StockPropel does not have a direct relationship with Storefront Visitors. Merchants are responsible for ensuring their own privacy notices accurately reflect the tracking activities described in Section 5 of this policy.
3. Data We Collect From Merchants
When a Merchant installs and uses the App, we access and store the following categories of data from their Shopify store via Shopify's official API:
3.1 Product and Inventory Data
- Product titles, variant names, and SKU identifiers;
- Current inventory levels, per location;
- Product images (used for display within the App interface only);
- Product creation dates and status (active, archived, draft);
- Current prices and compare-at prices.
3.2 Sales and Order Data
We access aggregated transactional data only. Specifically:
- Units sold per variant, per time period;
- Revenue generated per variant, per time period;
- Order line item data sufficient to calculate sales velocity.
We do not access, store, or process any end-customer personally identifiable information (PII) — including customer names, email addresses, postal addresses, payment details, or any other data that identifies individual customers. Order data is consumed in aggregate form only.
3.3 Store Configuration Data
- Shopify location names and IDs (used for inventory scoping);
- Merchant-configured settings within the App (analysis period, selected locations, subscription plan).
3.4 Activity and Audit Data
- Timestamps and outcomes of data sync events;
- Merchant-initiated settings changes, recorded in the in-App Activity Log.
4. Data We Collect From Merchant Accounts (App Usage)
We collect standard technical and usage data in connection with the operation of the App, including:
- The Shopify store domain and shop identifier;
- API access tokens issued by Shopify (stored securely and used solely to retrieve data on the Merchant's behalf);
- Error logs and diagnostic information to support service reliability.
5. Storefront Tracking Script
Merchants on the Insights plan have a lightweight JavaScript tracking script active on their Shopify storefront. This script collects:
- Product page view events (which product page was viewed);
- Timestamps of those view events.
This script does not collect:
- Any personally identifiable information about storefront visitors;
- Cookies or persistent identifiers linked to individual users;
- Browsing history, device fingerprints, or behavioural tracking data beyond the specific page view events described above.
The purpose of this data is solely to calculate a Views/Day metric per product variant within the App. View counts are stored in aggregate form in our database.
Merchants are responsible for disclosing this tracking activity in their own storefront privacy notices and, where required by applicable law (including UK GDPR and the Privacy and Electronic Communications Regulations), obtaining appropriate consent from their storefront visitors.
6. How We Use the Data
We use the data described above for the following purposes:
- To classify product variants into commercial groups (Top Performer, Revenue Driver, Volume Driver, Slow Mover, Dead Stock) using sales velocity and inventory analysis;
- To calculate Days of Stock, At-Risk Value, and portfolio-level metrics displayed in the App;
- To write StockPropel classification values to Shopify metafields on the Merchant's products and variants;
- To operate, maintain, and improve the App and its underlying infrastructure;
- To respond to Merchant support enquiries;
- To fulfil our contractual obligations to Merchants under our Terms of Service.
We do not use Merchant data for advertising, profiling, or any purpose beyond operating the App as described above. We do not sell Merchant data to third parties.
7. Legal Basis for Processing (UK GDPR)
Our legal bases for processing data are:
- Contract performance (Article 6(1)(b)): processing necessary to provide the App services to Merchants under our Terms of Service;
- Legitimate interests (Article 6(1)(f)): processing necessary to operate, secure, and improve the App, where those interests are not overridden by Merchant rights;
- Legal obligation (Article 6(1)(c)): where we are required to process data to comply with applicable law.
8. Data Storage and Security
Merchant store data is stored in our cloud database, provided by Supabase, Inc. Data is hosted in the European Economic Area (EEA). We implement appropriate technical and organisational security measures, including encryption in transit (TLS) and at rest, access controls, and regular security reviews.
Shopify API access tokens are stored securely and are used only to retrieve store data on the Merchant's behalf. They are never shared with third parties.
9. Data Retention
We retain Merchant data for as long as the App is installed on the Merchant's Shopify store. Following uninstallation:
- We will delete or anonymise Merchant store data within 30 days of uninstallation;
- Activity logs and diagnostic data may be retained for up to 90 days for operational and security purposes;
- We may retain records necessary to fulfil legal obligations for longer periods where required by law.
10. Data Sharing and Sub-Processors
We do not sell, rent, or share Merchant data with third parties for commercial purposes. We use the following sub-processors to deliver the App:
- Supabase, Inc. — cloud database infrastructure (data storage and retrieval);
- Vercel, Inc. — application hosting and deployment infrastructure;
- Shopify Inc. — the platform through which we access Merchant store data via their Partner API.
Each sub-processor is contractually required to handle data securely and only for the purposes for which it was shared. Where sub-processors are located outside the UK or EEA, we ensure appropriate transfer safeguards are in place (such as the UK International Data Transfer Agreement or equivalent mechanisms).
11. Merchant Rights Under UK GDPR
As a data controller, we respect your rights under UK GDPR. In relation to data we hold about your business and store, you have the right to:
- Access — request a copy of the data we hold about your store;
- Rectification — request correction of inaccurate data;
- Erasure — request deletion of your data, subject to our legal retention obligations;
- Restriction — request that we restrict processing of your data in certain circumstances;
- Portability — request your data in a machine-readable format where applicable;
- Object — object to processing based on legitimate interests.
To exercise any of these rights, please contact us at: hello@stockpropel.com. We will respond within 30 days.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk
12. Note on Storefront Visitor Rights
Individuals who visit Merchant storefronts on which the StockPropel tracking script is active should direct any data rights requests to the Merchant directly, as the Merchant is the data controller in respect of their storefront visitors. StockPropel does not hold personally identifiable information about individual storefront visitors and cannot respond to individual visitor rights requests.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify Merchants via the App or by email. The effective date at the top of this document will always reflect the most recent version.
14. Contact
For any privacy-related queries, requests, or complaints, please contact:
James Brown trading as StockPropel
Email: hello@stockpropel.com
For general enquiries: hello@stockpropel.com
James Brown trading as StockPropel — Sole Trader