Privacy Policy
Last updated 30 August 2026
NordStock is an inventory management app for Shopify merchants. This policy explains what data we handle, why, and what your rights are. It is written to be read, not to be survived.
What we collect
When you install the app
- Your store's myshopify.com domain, store name and the contact email Shopify provides
- An access token that lets NordStock talk to your store. It is stored encrypted at rest and is never shown in the interface
While you use the app
- Product data — titles, variants, SKUs, barcodes, stock levels, cost prices and selling prices
- Supplier data you enter — company name, contact person, email, phone, lead times
- Purchase orders and receipts — what you ordered, what arrived, what it cost
- Stock movements — every change, with reason and timestamp
What we deliberately do not collect
NordStock subscribes to your order webhooks so it can lower stock when something sells. From each order we read only the variant, the quantity and the order number.
We do not store your customers' names, addresses, email addresses, phone numbers or payment details. That data never enters our database.
If you join the waitlist
Your email address and which page you signed up from. Nothing else. We use it once, to tell you the app is live.
If you use voice input
The audio you record is sent for transcription and is not stored by us after the text comes back. See the sub-processor table below.
Why we are allowed to hold it
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Store, token, products, stock | Delivering the service you installed | Art. 6(1)(b) — contract |
| Supplier contacts you enter | Running your purchasing | Art. 6(1)(b) — contract |
| Waitlist email | Telling you we launched | Art. 6(1)(a) — consent |
| Error and access logs | Keeping the service working and secure | Art. 6(1)(f) — legitimate interest |
Who else touches it
We use a small number of processors. Each one is listed here, with what it sees.
| Processor | What it handles | Where |
|---|---|---|
| Supabase | Database — all of the above | EU (Frankfurt) |
| Vercel | Hosting, request logs, and privacy-friendly visitor counts for our public website. No cookies, no cross-site tracking, no personal data | EU region |
| Anthropic | Your question plus the relevant stock figures, when you ask the AI assistant or run a forecast | US |
| OpenAI | The audio clip, when you use voice input | US |
Transfers to the United States rely on Standard Contractual Clauses. We do not sell your data, and we do not use it to train any model.
How long we keep it
- While the app is installed: as long as you use it
- After you uninstall: your access token is deleted immediately. The rest of your data is removed within 30 days unless you ask us to keep it for a reinstall
- On a Shopify erasure request: deleted within the period Shopify requires, through the mandatory GDPR webhooks
- Waitlist email: deleted once we have told you the app is live, or sooner if you ask
Your rights
Under the GDPR you can ask us to show you what we hold, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time.
Write to privacy@nordvara.ai. We answer within 30 days, usually much sooner.
You can also complain to your national data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
Export — no lock-in
You can export everything NordStock holds about your store at any time, in CSV. Not buried in settings, and not something you have to ask for. Your purchasing and cost history is yours, including on the day you leave.
Security
- All traffic over HTTPS
- Row-level security on every table; no browser talks to the database directly
- Access tokens encrypted at rest and never rendered in the interface
- Data stored in the EU
Who is responsible for your data
The data controller for the personal data described here is Nordvara.ai, operated as a sole proprietorship by Bart Vrancken. From November 2026 this role passes to Nordvara.ai AB, a Swedish limited company, and this page will say so.
Reach us through the contact form on this page for anything in this policy.
Changes
If this policy changes in a way that matters, we will email installed merchants before it takes effect. The date at the top always reflects the current version.