Privacy Policy

This policy explains what data StockTrack collects, why we collect it, where we keep it, and what rights you have over it. We've tried to write it in plain English. If anything is unclear, email info@stocktrack.work and we'll explain.

1. Who we are

"StockTrack", "we", "us" and "our" refer to the team that operates the StockTrack app and website (stocktrack.work). StockTrack is run from Slough, United Kingdom. For any privacy question, the contact is info@stocktrack.work.

For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for personal data you give us directly (such as your name and email when you sign up). For workshop content you upload (stock items, alerts, photos), we act as a data processor on behalf of your workshop.

2. What data we collect

Account information

When you or a colleague creates a StockTrack account, we collect:

• Your name
• Your email address
• Your role (admin, manager, or user)
• The workshop you belong to
• Optionally, your phone number (if you choose to add it)

Workshop content

When you use the app to track stock, we store:

• The categories you create (e.g. "Engine oils", "Wiper blades")
• The stock items inside each category
• Photos you attach to a stock item (optional)
• Alerts raised against an item ("Low" / "Out"), including when, by whom, and any notes
• Alert history — including who resolved an alert and when
• Your team list and roles inside the workshop

Device information for push notifications

So we can send you the "stock is low" notification on the right phone, we store a Firebase Cloud Messaging (FCM) token for each device that's signed into your account. This is a random identifier — not your phone number, not your IMEI, not your location.

Trial enquiries from this website

If you fill in the trial-request form on stocktrack.work, we collect your name, workshop name, email, optional phone, staff size, and how you heard about us. The form is submitted via Formspree, which forwards it to Chris's email inbox.

What we don't collect

• We don't track your location.
• We don't access your contacts, photos library, calendar, or microphone.
• We don't use third-party advertising or analytics SDKs in the mobile app.
• We don't fingerprint your device or build profiles about you.

3. Why we collect it

We use the data above only for the following purposes:

• To provide the service — show your stock list, route alerts to the right person, keep a history of who raised and resolved each alert.
• To send push notifications for stock alerts you've subscribed to.
• To keep your account secure — sign-in, password reset, basic abuse prevention.
• To respond to support enquiries from you or your workshop.
• To improve the product based on bugs we observe and feedback you give us.

The legal bases we rely on under UK GDPR are contract (we need this data to provide you with the service you signed up for), legitimate interests (running and improving the app, preventing abuse), and consent (e.g. for the optional photo upload).

4. Where your data is stored

StockTrack runs on Google Cloud Platform using Firebase (Authentication, Firestore, Cloud Storage, Cloud Messaging) and related Google Cloud services. Our data is stored in Google's europe-west regions (United Kingdom and the European Union). Google Cloud is the only place your workshop content is held.

The marketing website is hosted on Cloudflare Pages. The trial-request form is processed by Formspree, which delivers it to our email.

5. Who we share it with

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.

We do share data with a small number of sub-processors who help us run the service. Each is bound by their own data-protection terms:

• Google (Firebase / Google Cloud) — hosting, databases, storage, authentication, push notifications.
• Cloudflare — hosting the marketing website you're reading now.
• Formspree — processing the trial-request form submissions.
• Apple and Google — distributing the app via the App Store and Play Store (they receive only what their own platforms require, e.g. crash reports if you opt in).

We may disclose data if we are legally required to (for example, a valid court order from a UK authority). We will tell you about this where we're permitted to.

6. How long we keep it

• Active accounts: for as long as your workshop is using StockTrack.
• Closed accounts: we delete personal data within 30 days of you (or your workshop admin) closing the account. Anonymous, aggregated counts (e.g. "the app was used X times last month") may be retained.
• Trial enquiries that don't lead anywhere: deleted within 12 months.
• Backups: Firebase keeps automated backups for a short rolling window; deletion from backups happens on the standard Firebase schedule.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct any data that's wrong or incomplete.
• Delete your account and personal data ("right to erasure").
• Export your data in a portable format.
• Restrict or object to certain processing.
• Withdraw consent at any time where we rely on it.
• Complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've handled your data badly. We'd rather you came to us first so we can try to fix it.

To use any of these rights, email info@stocktrack.work from the address on your account. We'll respond within 30 days.

8. Account and data deletion

You can request deletion of your account and personal data at any time by emailing info@stocktrack.work from the address on your account.

If you're the admin of a workshop and you delete the workshop, everyone in that workshop loses access and all workshop content (categories, items, photos, alert history, team list) is deleted within 30 days.

If you're an individual user and you delete only your own account, your personal details (name, email, phone) are removed. The alerts you raised remain in the workshop's history but are shown as raised by a deleted user — your workshop admin needs that history for their records.

9. Cookies and similar technology

The StockTrack mobile app doesn't use cookies. It stores a small amount of data on your device (your sign-in token, a cached copy of your workshop's data) so the app works offline.

The StockTrack website (stocktrack.work) doesn't set any analytics cookies, advertising cookies, or tracking pixels. Cloudflare, our host, may set a single essential cookie to protect the site from abuse — this is exempt from cookie consent under PECR's "strictly necessary" rule.

10. Children

StockTrack is a workplace tool. It isn't aimed at, marketed to, or designed for anyone under 16. If you become aware that a child has created an account, contact us and we'll delete it.

11. Security

We use the standard security features of Firebase: encryption in transit (HTTPS), encryption at rest, role-based access via Firestore security rules, and individual sign-in for every team member. Only people you invite to your workshop can see your workshop's data.

No system is 100% secure. If we ever experience a data breach that affects you, we will notify you and the ICO as required by UK law.

12. International transfers

Your data is stored in the UK/EU. If a sub-processor occasionally needs to access data from outside the UK/EU (for example, to provide support), they do so under approved transfer mechanisms (UK International Data Transfer Agreement or EU Standard Contractual Clauses).

13. Changes to this policy

If we change this policy we'll update the "Last updated" date at the top. If the change is material (e.g. we add a new sub-processor, or change what we collect), we'll also notify you by email or in-app before it takes effect.

14. Contact us

Questions, complaints, or requests under your data-protection rights:

Email: info@stocktrack.work
Post: StockTrack, Slough, United Kingdom