Zásady ochrany osobních údajů služby StockSense. Dokument je v angličtině.
Privacy Policy
This Privacy Policy explains how Wipora s.r.o., with its registered seat at Jičínská 226/17, Žižkov, 130 00 Praha 3, Czech Republic, company ID (IČO) 07326963, VAT ID (DIČ) CZ07326963 (“we”, “us”, the “Provider”), processes personal data in connection with the StockSense add-on (the “Service”) made available through the Shoptet add-on marketplace.
1. Who is responsible for your data
The way we act depends on the type of data:
- As a data controller for the account and contact data of the e-shop operator who installs and uses the Service.
- As a data processor for any personal data contained in your Shoptet store data (in particular order data, which may include data about your end customers). For that data, the e-shop operator is the controller and we process it solely to provide the Service, on the operator's instructions. A separate Data Processing Agreement may be entered into on request.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Account & authentication data | E-shop ID, e-shop URL, contact e-mail, Shoptet OAuth/API access tokens, webhook signature keys, session tokens, store currency, installation status and timestamps | Provided by Shoptet during installation / generated by the Service |
| Store catalogue data | Products and variants, SKUs/codes, prices, stock levels, categories, brands; warehouse stock movements (product code, quantity change, warehouse, time and the origin category of the change: customer order, administration or API integration — without the identity of the person who made the change) | Retrieved from your store via the Shoptet API |
| Order data | Orders and order items, amounts, dates and related fields. Depending on your store configuration this may include personal data of your customers (e.g. names, contact details, addresses). | Retrieved from your store via the Shoptet API |
| Support / feedback data | E-mail address and message content if you contact us through the in-app feedback form | Provided by you |
| Technical data | IP address and request metadata (for rate limiting and security), server logs | Generated automatically |
3. How we obtain the data
When you install StockSense from the Shoptet marketplace, Shoptet provides us with an OAuth authorization that lets the Service read your store data through the official Shoptet API. We periodically synchronise products, stock and orders so we can generate the reports and predictions you see in the app.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service (reporting, stock prediction, dashboards, exports) | Performance of a contract (Art. 6(1)(b)); for end-customer data we act as processor under Art. 28 |
| Authentication, security, abuse and rate-limit protection | Legitimate interests (Art. 6(1)(f)) |
| Operational notifications (e.g. install/uninstall alerts) | Legitimate interests (Art. 6(1)(f)) |
| Responding to support requests | Legitimate interests / performance of a contract |
5. Data retention
- Synchronised store data (products, orders, stock movements, stock snapshots) is kept while the Service is installed. Stock history snapshots and stock movements are automatically deleted after 90 days.
- Session tokens expire and are deleted within 24 hours.
- Access tokens are deleted immediately upon uninstallation. All remaining synchronised store data is automatically deleted within 30 days of uninstallation (the short window allows your data and history to survive an accidental uninstall or a reinstall).
- Server logs (IP addresses, request metadata) are rotated and deleted after 14 days.
- Support / feedback messages are kept for as long as needed to handle the request.
- Backups are retained on a short rolling basis (most recent backups only) and are encrypted.
6. How we protect your data
- Shoptet OAuth/API tokens and webhook signature keys are encrypted at rest (AES-256-GCM).
- Database backups are encrypted (GPG, AES-256).
- All traffic is served over TLS/HTTPS.
- The database is not exposed to the public internet; access is restricted and rate-limited.
7. Recipients and sub-processors
We do not sell your data. We share it only with service providers that help us operate the Service:
| Recipient | Purpose |
|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Server and database hosting |
| Shoptet | Source platform and API authorization |
| Slack | Internal operational alerts (e.g. install notifications) |
8. International transfers
We aim to store and process data within the EU/EEA. Where any sub-processor processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards (e.g. Standard Contractual Clauses).
9. Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and objection, as well as the right to lodge a complaint with your supervisory authority (in the Czech Republic, the Office for Personal Data Protection / Úřad pro ochranu osobních údajů). Where we act as processor for your store data, please direct individual requests to the relevant e-shop operator (controller); we will assist them as required.
10. Cookies and local storage
The Service stores a session token (per e-shop), your selected language and the shop identifier in your browser's local storage to keep you signed in and remember your preferences. These are strictly necessary for the Service to function and are not used for advertising or cross-site tracking. Payments for the Service are handled entirely by the Shoptet marketplace — we never receive your payment card or billing details.
11. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date above reflects the latest version.
12. Contact
For privacy questions or to exercise your rights, contact us at info@wipora.cz.
See also our Terms of Service.