StockRelay is a Shopify app that automates inventory transfer orders between store locations. This policy explains what data we collect, how we use it, and your rights under GDPR and applicable privacy laws.
2. Data we collect
Shop data: your Shopify store domain, email address, and OAuth access token — necessary to authenticate and operate the app on your behalf.
Session data: short-lived session tokens stored in our database to maintain your authenticated session inside the Shopify admin.
Transfer rules: the inventory rules you configure (product, locations, min/max levels) — stored so the nightly engine can execute them.
Transfer logs: a history of every transfer attempt (product, quantity, locations, outcome) — used to display your activity history inside the app.
We do not collect or store any customer PII (names, emails, addresses, payment data). StockRelay operates entirely on inventory and location data, not on your customers' personal information.
3. How we use your data
To authenticate your Shopify store and maintain your session.
To execute the nightly transfer engine: reading inventory levels and creating inventory transfer orders via the Shopify API.
To send you email notifications about transfer outcomes.
To display your transfer history within the app.
We do not sell, rent, or share your data with third parties for marketing.
4. Data retention
Shop and session data is retained while your app installation is active. When you uninstall StockRelay, your shop record is marked as inactive. Transfer logs are retained for your historical reference. You may request complete deletion at any time (see section 6).
5. Third-party services
Shopify: all inventory and store operations are performed via the Shopify API under your store's OAuth grant.
Resend: used to deliver transactional email notifications. Only your store's admin email address is passed to Resend.
Railway: our hosting provider. Data is stored in a PostgreSQL database hosted on Railway's infrastructure.
6. Your rights (GDPR)
If you are located in the European Economic Area, you have the right to access, correct, or request deletion of your data. To exercise any of these rights, contact us at the email below. We will respond within 30 days.