Privacy Policy

The data controller is The Seed Technology, S.L. (Sociedad Limitada Unipersonal), holder of CIF/NIF B56625460, with registered address at Calle Navarra 49, 08401 Granollers, Barcelona, España. For any privacy-related matter you can contact us at info.theseedtechnology@gmail.com.

We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Article 37 GDPR. You can direct all data-protection enquiries to the address above.

Account & authentication data. We use Discord to sign you in. When you log in we receive from Discord your account identifier, username, avatar, and email address. We do not receive your Discord password.

Shopify store data.When you connect a Shopify store, we access only the data required to operate the service — namely your store's orders, products, and customers. We do not request or read any other category of Shopify data, and we do not ask for app permission scopes beyond what these three areas require.

Technical & usage data. To keep the service running and secure we process session identifiers, log data, and similar technical information generated as you use the platform.

• To provide the core service: connecting your Shopify store, syncing orders, products, and customers, allocating inventory, generating invoices, and sending notifications.
• To authenticate you and keep you signed in securely.
• To operate, maintain, secure, and improve the platform.
• To comply with our legal and tax obligations.

We rely on the following legal bases under Article 6(1) GDPR:

• Performance of a contract — to provide the service you sign up for.
• Legitimate interests — to secure, maintain, and improve the platform, where not overridden by your rights.
• Legal obligation — to meet accounting, tax, and other statutory requirements.
• Consent — where specifically requested (you may withdraw it at any time).

We share data with the following service providers strictly to operate the platform. Each receives only the data needed for its function:

• Shopify — the store you connect; we read your orders, products, and customers.
• Discord — authentication (sign-in) and, where configured, notification webhooks.
• StockX — market pricing and catalog data used to help sellers list inventory.
• Cloudflare R2 — file and object storage.
• MongoDB Atlas — primary database hosting.
• Railway — application and Redis hosting.
• Web Push (VAPID) — optional browser push notifications, only if you enable them.

We do not sell your personal data, and we do not use it for third-party advertising.

We keep personal data according to the following criteria:

• Account and platform data — for as long as your account is active.
• After you close your account — deleted or anonymised, except where retention is legally required.
• Invoicing and accounting records — retained for the period required by Spanish tax and commercial law (generally up to 6 years).
• Security logs — retained for a limited period necessary to investigate and prevent abuse.

Under the GDPR you have the following rights regarding your personal data:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (the “right to be forgotten”).
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at info.theseedtechnology@gmail.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

Providing your account and Shopify store data is necessary to use the service; without it we cannot operate Restocks for you. We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal or similarly significant effects.

Some of our sub-processors may process data outside the European Economic Area, in countries that may not be covered by a European Commission adequacy decision. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs).

We apply technical and organisational measures to protect your data, including encryption of sensitive credentials at rest (AES-256-GCM) and encryption in transit (HTTPS/TLS). See our Security page for details.

We use only strictly necessary first-party cookies to sign you in, keep your session secure, and remember your selected shop. We do not use analytics, advertising, or tracking cookies. For the full list of cookies and their purposes, see our Cookie Policy.

Restocks is a business tool intended for use by adults acting in a professional capacity. It is not directed at children.

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

Questions about this policy or your data? Contact The Seed Technology, S.L. at info.theseedtechnology@gmail.com. See our Contact page for full company details.