On this page
1. Data processing roles
Under the GDPR, the merchant is the data controller for their store's data, and StockUrgify acts as a data processor, processing data only to provide the Service on the merchant's instructions. For our own account and billing records, StockUrgify is the controller. This page complements our Privacy Policy and Terms of Service.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Shop identity | Shop domain, name, owner name, store and contact email, phone, business address, plan, country, currency, timezone | Shopify OAuth & Admin API |
| Catalog & inventory | Product titles, variants, IDs, images, stock levels | Shopify Admin API |
| App configuration | Thresholds, messages, colors, rules, alert channels | Merchant input |
| Badge telemetry | Anonymous impression/click events, product, timestamp | Storefront script |
| Recent sales | Order ID, product purchased, time of purchase (no customer fields) | Shopify orders/create webhook & Admin API |
| Live viewers | Random per-page-view ID, product, last-seen time | Storefront script |
| Back-in-stock sign-ups | Shopper email, product and variant, page language, sign-up and notification time | Shopper input on the storefront (Premium) |
The only shopper personal data we store is the email address a shopper chooses to enter in a back-in-stock form. We do not collect shoppers' names, postal addresses or payment data, and we do not store customer details from orders. Badge, viewer and sales-popup data is not tied to a shopper's identity.
3. Shopify Protected Customer Data
StockUrgify requests the read_orders scope so the recent sales popup can show real purchases. Orders are Protected Customer Data, so we keep the access to the minimum: from each order we store only the order ID, the product and the purchase time, and we never store the customer's name, email, address or payment details. We do not request any customer PII scopes.
Back-in-stock emails are not read from Shopify. A shopper types their email into the storefront form themselves, and we use it only to send them one notification for that product on the merchant's behalf.
We follow Shopify's Protected Customer Data requirements: minimizing data access, encrypting data in transit and at rest, limiting retention, and maintaining staff data-handling practices.
4. Legal bases (GDPR)
- Contract — to deliver the Service you installed and to bill for it.
- Legitimate interests — to secure, maintain, and improve the Service and prevent abuse, balanced against your rights.
- Legal obligation — to comply with Shopify's mandatory webhooks and applicable law.
- Consent — where required, e.g. non-essential communications.
5. Your rights (GDPR & CCPA)
Subject to applicable law, you may have the right to:
- Access the personal data we hold and receive a copy (portability).
- Correct inaccurate data and complete incomplete data.
- Delete your data ("right to be forgotten").
- Restrict or object to certain processing.
- Withdraw consent at any time, without affecting prior processing.
- (CCPA) Know what is collected, request deletion, and not be discriminated against for exercising rights. We do not sell personal information.
To exercise a right, email privacy@stockurgify.com. We respond within the timeframes required by law (generally 30 days under GDPR, 45 days under CCPA).
6. Mandatory privacy webhooks
As required for all Shopify apps, StockUrgify implements the three GDPR/privacy webhooks. Shopify sends these and we act on them automatically:
| Webhook | What we do |
|---|---|
customers/data_request | We look up any back-in-stock sign-ups for the customer's email (the products they asked about and when) and provide them to the merchant on request. We hold no other customer data. |
customers/redact | We delete every back-in-stock sign-up for the customer's email in that store. |
shop/redact | Sent ~48 hours after uninstall. We erase the shop's settings, cached products, and telemetry from our systems. |
7. Requesting deletion
The fastest way to delete your data is to uninstall StockUrgify from your Shopify admin — this triggers Shopify's shop/redact webhook and your data is erased (typically within 48 hours, and no later than 30 days). To request deletion without uninstalling, or to confirm erasure, email privacy@stockurgify.com.
8. Subprocessors
We use a small set of vetted subprocessors under data protection agreements:
| Subprocessor | Purpose | Location |
|---|---|---|
| Shopify | Platform, OAuth, billing, webhooks, Admin API | Global |
| Cloud hosting | Application servers & database | EU / US |
| Email provider | Transactional & digest email, back-in-stock notifications to shoppers | EU / US |
| Slack / Discord | Optional alert delivery (merchant-configured) | US |
We provide notice of material changes to this list. Request the current version at privacy@stockurgify.com.
9. International transfers
Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms offered by our subprocessors.
10. Cookies
The embedded admin uses only the session tokens needed for Shopify authentication. The storefront script does not set advertising or cross-site tracking cookies; impression and click events are anonymous and used solely for merchant analytics. It uses session storage only to remember, for the current browsing session, that a shopper closed the recent sales popup.
11. Data Processing Agreement
For merchants who require a signed Data Processing Agreement (DPA), we offer one incorporating the GDPR Article 28 terms and the Standard Contractual Clauses. Request a copy at privacy@stockurgify.com.
12. Contact & DPO
For any data protection or GDPR/CCPA matter, contact our privacy team at privacy@stockurgify.com. You also have the right to lodge a complaint with your local supervisory authority. See our Privacy Policy and Terms of Service for related information.