Privacy Policy — DRAFT
DRAFT, not yet in force. Written from templates and our legal research (
docs/compliance/eu-lithuania-research.md§1–2, decision D-10, user decision 2026-10-06). A Lithuanian lawyer should review it before launch. Everything in[[double brackets]]must be filled in once the company is registered. The Lithuanian version (privacy-policy.lt.md) is the one shown to Lithuanian customers.
Last updated: [[date]]
This policy explains what personal data [[Company name]] ("we", "us") collects when you use Stoqa (the stock app, the owners' dashboard and our website), why, and what rights you have.
1. Who we are
[[Company name]], company code [[code]], VAT number [[VAT number]], registered address [[address]], Lithuania. Email: [[privacy email]].
2. Two roles: your shop's data and our own data
Stoqa is used by businesses (shops). The data in it falls into two groups:
- Your shop's data — items, stock, sales, deliveries, suppliers, and your staff's accounts and the record of who did what. Here your shop is the controller and we only process the data on your behalf (GDPR Art. 28), under our Data Processing Agreement (part of the Terms of Service). Your staff should get their information from your shop; we give shops a ready-made staff notice for that, which staff confirm in the app.
- Our own data — the account of the person who signs up and manages the subscription, billing, support, security logs of our service. Here we are the controller, and this policy applies.
3. What we collect and why
| Data | Why | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Owner's name, email, password (stored only as a one-way hash), language | To create and run your account | Contract (6(1)(b)) | While the account exists |
| Company name, company details, subscription and trial status | To provide the service you signed up for | Contract (6(1)(b)) | While the account exists |
| Our invoices and payment records | Accounting law | Legal obligation (6(1)(c)) | 10 years |
| Emails we send you: confirming your address, password resets, the daily low-stock summary, notices about your account (e.g. a deletion request) | To run the service | Contract (6(1)(b)) | Sending logs: [[90 days]] |
| Technical logs: IP address, time, the request made, errors | Security, preventing abuse, fixing faults | Legitimate interest (6(1)(f)) | [[90 days]] |
| Wrong sign-in attempts: a one-way fingerprint of the email (or shop and worker code), how many wrong passwords in a row, until when sign-in is paused | Stopping password guessing on one account | Legitimate interest (6(1)(f)) | Deleted at the next right password or new password, at the latest 1 day after the last try |
| Bot check on sign-up and on the "Get an offer" form (Cloudflare Turnstile): browser signals and IP address, checked once | Stopping automated fake sign-ups and offer requests | Legitimate interest (6(1)(f)) | Not stored by us |
| "Get an offer" form on stoqa.lt: shop name, number of stores, your name, email, phone number, message | To answer your request with an offer | Steps before a contract, at your request (6(1)(b)) | The email with your request: [[1 year]] if no contract follows. Your phone number only as a one-way fingerprint, 14 days, so the same number can't send the form again and again |
| Support messages | To answer you | Contract / legitimate interest | [[2 years]] after the case is closed |
Giving the account data is required to use Stoqa; without it we cannot provide the service. We don't collect personal codes (asmens kodas), and we don't use your data for advertising or sell it.
We do not make decisions about anyone by automated means that have legal or similarly significant effects.
Statistics. We may create aggregated, anonymous statistics from the use of Stoqa (for example "shops in our service run out of stock X% less often"). They never identify a shop, a person or a shop's figures, are only built across many shops, and never use staff data. The Terms of Service describe this and how to opt out.
4. Who receives the data
We use these service providers (processors). Each is bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean, LLC | Servers and database | Data stored in Frankfurt, Germany (EU) |
| Scaleway SAS | Sending emails | France (EU) |
| Cloudflare, Inc. | Bot check on sign-up and the offer form; forwarding emails sent to support@stoqa.lt | EU and USA |
| Backblaze, Inc. | Encrypted copy of our nightly backups (kept 30 days) | Amsterdam, Netherlands (EU) |
| Anthropic Ireland, Limited (with Anthropic, PBC) | Reading PDF and photo supplier invoices a shop uploads | USA |
| UptimeRobot s.r.o. | Checking every few minutes that our websites are up (no customer data; alerts go to us) | EU (Slovakia), backup checks from the USA |
| [[Payment provider, e.g. Stripe]] | Subscription payments | [[EU]] |
DigitalOcean, Cloudflare, Backblaze and Anthropic are US companies. Where data may reach the USA, the transfer is covered by the EU–US Data Privacy Framework (Commission Decision (EU) 2023/1795; DigitalOcean, Backblaze and Cloudflare take part) and/or the EU Standard Contractual Clauses (the only basis for Anthropic). We also disclose data to public authorities when the law requires it.
5. Cookies and storage on your device
Stoqa stores only what is strictly necessary to work: your sign-in token (kept until you close the tab in the dashboard; on the shop tablet until you sign out) and your language choice. These need no consent. We use no analytics, advertising or tracking cookies. If that ever changes, we will ask first.
6. Security
Data is encrypted in transit (HTTPS), passwords are stored only as one-way hashes, every shop's data is separated at database level, we keep tested backups, and access to production is limited. [[Encryption at rest: confirm with the hosting setup.]]
7. Your rights
You can ask us to: see your data (access), correct it, delete it, limit its use, receive it in a machine-readable file (portability), and object to processing based on legitimate interest. Owners can download all of their company's data and delete the company themselves on the Company page of the dashboard. Write to [[privacy email]]; we answer within one month (up to two more months for complex requests, and we will tell you).
If your request is about a shop's data (for example you work in a shop that uses Stoqa), contact that shop; we help it answer you.
You can complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt, L. Sapiegos g. 17, Vilnius). Since 1 July 2024 Lithuanian law asks you to contact us first.
8. Deleting your account
When an owner deletes the company, it is locked for 30 days (you can still download everything or cancel), then all its data is deleted. Backups keep it for up to [[35]] more days, after which it is gone. Our invoices to you are kept for 10 years, as the law requires.
9. Changes
If we change this policy in a way that matters, we will tell owners by email at least [[30 days]] before. The date at the top shows the latest version.