Privacy Notice
This notice is provided for transparency. It is not legal advice. Operators of Stockhand should have qualified counsel review this notice before relying on it for formal GDPR registration, DPIAs, or supervisory-authority filings.
This Privacy Notice explains how Stockhand (“we”, “us”, “our”) processes personal data when you use the Stockhand Android app, the marketing site at stockhand.trade, the Business web desk at app.stockhand.trade, and optional APIs that support accounts, sync, and paid features. It is written in plain English and is intended to meet the information requirements of Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), United Kingdom, and similar regimes, alongside general transparency for users elsewhere.
1. Controller identity & contact
The data controller for personal data processed in connection with Stockhand is the operator of stockhand.trade publishing the Stockhand product (branded as Stockhand).
- Privacy contact: privacy@stockhand.trade
- Website: https://stockhand.trade
- Account / data deletion: https://stockhand.trade/delete/
We have not appointed a Data Protection Officer (DPO) at this time. Privacy enquiries and data-subject requests should be sent to privacy@stockhand.trade.
Where you use Google Sign-In, Google Play Billing, Razorpay, Stripe, or similar third parties, those providers may act as independent controllers for data they process under their own policies (for example card payments or Play purchase records).
2. Scope of services
This notice covers personal data processed in relation to:
- Stockhand Android app — offline-first inventory and shop operations
- Marketing / support site — stockhand.trade
- Business web desk — app.stockhand.trade
- Optional APIs / cloud services — accounts, authentication, sync / safekeep, feature entitlement
Stockhand is a business tool. It is not a bank, payment service provider, accountant, tax advisor, or government filing system. Offline use of the Android app does not require an account; cloud identity, Business desk, and paid cloud features are optional.
3. Categories of personal data
Depending on how you use Stockhand, we may process the following categories:
Account & identity
- Name / display name, email address
- Google account identifiers (email, display name) if you use Google Sign-In
- Authentication tokens, session identifiers, and OTP verification records
- Shop or business display name you associate with an account (if provided)
Device & technical
- Device type / OS version, app version, approximate locale / language settings
- IP address, request timestamps, and diagnostic / crash or error signals when you use online features
- Browser type and basic request metadata when you visit the site or Business desk
Shop / business records you enter
- Inventory, parties (customers / suppliers), sales, purchases, dues, notes, GST-related fields, and similar business content you create
- By default this stays in a local database on your device. We only receive cloud copies when you enable optional sync / safekeep / Business desk features or export / share files yourself
Payment metadata
- Google Play Billing: purchase / subscription tokens and entitlement status needed to unlock paid features (we do not receive your full card number from Play)
- Shop payment links (Razorpay / Stripe or similar): payment status and related metadata when you connect those rails; card or UPI details are handled by the payment service provider
Logs & security
- Server access logs, authentication attempts, abuse-prevention signals, and operational logs
4. How we collect data
| Source | Examples |
|---|---|
| Directly from you | Account email, OTP verification, shop content you enter, support / deletion emails, form fields you submit |
| From your device / browser | Local inventory DB (on-device); app diagnostics; cookies / local storage on the site or desk (see §11) |
| From third parties | Google Sign-In (identity); Google Play (purchase verification); payment providers (payment status); hosting / email infrastructure (delivery & security events) |
We do not buy marketing lists of shop owners to populate Stockhand accounts. Content that remains only on your device is not automatically uploaded.
5. Purposes & lawful bases (GDPR Art. 6)
For users protected by the GDPR (and similar laws), we rely on the lawful bases below. Outside those regimes we still process data only for the purposes described here.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the product (contract) | Create / authenticate accounts; sync / safekeep; Business desk access; unlock Play entitlements; send OTPs; operate APIs you use | Art. 6(1)(b) — performance of a contract / steps prior to contract |
| Security, fraud & abuse prevention | Rate-limit OTP abuse; detect account takeover; protect infrastructure; investigate misuse | Art. 6(1)(f) — legitimate interests (security of services and users) |
| Operate, debug & improve services | Fix crashes; understand feature reliability; capacity planning (aggregated where practical) | Art. 6(1)(f) — legitimate interests (reliable product) |
| Consent-based processing (where used) | Optional permissions or marketing communications if we ever ask for them separately; non-essential cookies if introduced | Art. 6(1)(a) — consent (withdrawable anytime) |
| Legal obligation | Respond to lawful requests; keep records required by tax / accounting / consumer law where applicable; Play data-safety disclosures | Art. 6(1)(c) — legal obligation |
Legitimate interests balancing: For security and product reliability we process only what is reasonably necessary, prefer short retention for logs, and do not use your inventory contents for advertising. You may object to processing based on legitimate interests (see §9).
We do not use the contents of your inventory or party lists for advertising or sell that content to data brokers.
6. Recipients & processor categories
We share personal data with service providers who process it on our instructions (processors) or, where noted, as independent controllers. Categories include:
| Category | Typical providers / role | Why |
|---|---|---|
| Hosting & database | Railway (application hosting), Neon (managed Postgres / related DB) | Run APIs, accounts, sync / safekeep storage |
| Transactional email | Resend | Deliver OTPs and transactional messages |
| Google Sign-In; Google Play Billing; Google Drive only if / when you connect export or backup features that use Drive | Identity, paid entitlements, optional file export | |
| Shop payment links | Razorpay and / or Stripe (when you enable them) | Collect shop dues / payments you initiate |
| Professional advisors / authorities | Lawyers, accountants, regulators — only when required | Legal claims, compliance, lawful requests |
Providers may change over time as we swap infrastructure. We select vendors that offer appropriate security and contractual protections for their role. Their own privacy notices also apply to processing they control independently (especially Play and payment PSPs).
7. International transfers
Our infrastructure and subprocessors may be located in India, the United States, the EEA, or other countries. If you are in the EEA / UK / Switzerland and personal data is transferred outside that region, we rely on one or more of the following where required:
- An adequacy decision by the European Commission (or UK equivalent) for the destination, where available
- Standard Contractual Clauses (SCCs) or UK International Data Transfer Addendum / equivalent contractual safeguards offered by the relevant vendor
- Other transfer tools permitted by Articles 46–49 GDPR (or UK GDPR) where applicable
You may request more information about the transfer mechanism used for a particular vendor by emailing privacy@stockhand.trade.
8. Retention periods / criteria
| Data | Typical retention |
|---|---|
| On-device inventory & shop records | Until you clear app storage, wipe the device, or uninstall; we cannot recover local-only data |
| Cloud account & sync / safekeep copies | While the account is active; deleted or anonymised after a validated deletion request (see /delete/), subject to backup lag and legal holds |
| Auth sessions / OTP artefacts | Short-lived; OTPs expire quickly; sessions until logout, expiry, or revocation |
| Security / access logs | Typically weeks to a few months, longer only if needed for an active investigation |
| Billing / entitlement metadata | As needed to provide paid features and resolve disputes; Play / PSP records follow their retention rules |
| Support / deletion correspondence | As needed to complete the request and keep a minimal audit trail of what was actioned |
Where law requires longer retention (for example tax or consumer records that a payment provider must keep), we or the relevant controller may retain limited data despite a deletion request.
9. Your data-subject rights
If the GDPR (or UK GDPR / similar law) applies to you, you may have the right to:
- Access — obtain confirmation and a copy of personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion (“right to be forgotten”), subject to legal exceptions
- Restriction — ask us to limit processing in certain cases
- Portability — receive data you provided in a structured, commonly used format where the legal conditions are met
- Object — object to processing based on legitimate interests (including profiling for those interests)
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing
How to exercise these rights:
- Deletion / erasure of cloud account data: follow stockhand.trade/delete/
- All other privacy requests: email privacy@stockhand.trade from the address associated with your account (or describe how we can verify you)
We will respond within the timeframes required by applicable law (generally within one month under the GDPR, extendable in complex cases). We may need to verify your identity before acting. Some rights are limited where we must keep data for legal claims, security, or statutory retention.
Local-only data on your phone is under your control: clear Stockhand app storage or uninstall the app. Business desk access can be revoked by signing out and requesting account deletion.
10. Right to lodge a complaint
If you are in the EEA, you have the right to lodge a complaint with a supervisory authority — in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. You can also contact your local data protection authority for guidance.
A list of EEA supervisory authorities is published by the European Data Protection Board. UK users may contact the Information Commissioner’s Office (ICO). We would appreciate the chance to address concerns first via privacy@stockhand.trade.
11. Cookies & local storage
Our marketing site and Business desk use a minimal set of client-side storage:
- Session / auth storage on the Business desk — to keep you signed in securely while you use the app
- Cloudflare Turnstile on contact forms — a short-lived challenge token only; not used for advertising
We do not currently run advertising cookies or third-party ad trackers on stockhand.trade. If we introduce non-essential analytics or marketing cookies in the future, we will update this notice and obtain consent where required.
12. Children
Stockhand is intended for business users aged 18 and over. It is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact privacy@stockhand.trade and we will take appropriate steps to delete it.
13. Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). Feature entitlements (for example Pro unlocked after a verified Play purchase) are rule-based service delivery, not automated profiling for legal or similarly significant effects.
14. Security measures
We apply security measures appropriate to the nature of the data, including at a high level:
- TLS encryption in transit for web and API traffic
- Access controls and least-privilege practices for production systems
- Authentication (including OTP / Google Sign-In) for cloud features
- Vendor security and contractual controls for hosting, email, and related processors
- Operational logging and abuse monitoring for online endpoints
No method of transmission or storage is 100% secure. You remain responsible for device lock screens, OS updates, who can open the phone, and the security of the email / Google account you use to sign in. Cloud sync is not a substitute for your own backups.
15. AS IS / liability limitations (business, inventory & tax drafts)
Stockhand and its operators are not liable for stockouts, lost sales, data loss, sync conflicts, incorrect GST or tax figures, failed payments, downtime, or any business decisions you make from app insights, reports, or drafts.
GST helpers, e-invoice drafts, GSTR-oriented JSON, P&L, and other reports are informational drafts only. They are not tax, legal, or accounting advice; not a government filing or NIC / portal submission on your behalf; and not a guarantee of accuracy or compliance. Offline IRN / e-invoice output produced without a live government NIC session is a DRAFT and is not NIC-valid for statutory use until properly authorised and filed through official channels. You and your qualified advisor remain solely responsible for verification and filings.
To the maximum extent permitted by applicable law, Stockhand and related services are provided “AS IS” and “AS AVAILABLE”, without warranties of any kind — express, implied, or statutory — including merchantability, fitness for a particular purpose, non-infringement, accuracy, or uninterrupted availability.
To the maximum extent permitted by law, Stockhand and its operators are not liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of profits, revenue, goodwill, data, business opportunity, or stockouts / lost sales — whether based in contract, tort, or otherwise — even if advised of the possibility.
Where liability cannot be excluded, our aggregate liability for claims relating to the services in any twelve-month period is limited to the fees you paid us for Stockhand in that period, or ₹0 (zero) if you used only free features. Some jurisdictions do not allow certain limitations; in those cases our liability is limited to the fullest extent the law allows.
You agree to indemnify and hold harmless Stockhand and its operators from claims arising from your data or misuse; unlawful use; your tax filings, invoices, or compliance choices; and third-party claims from your shop operations, customers, suppliers, or payment arrangements.
Acceptable use — you must not:
- Use Stockhand for fraud, money laundering, or other unlawful activity
- Attempt to break into, disrupt, or overload our systems or other users’ data
- Misrepresent drafts or reports as official government filings or NIC-valid documents when they are not
- Abuse OTP, sign-in, billing, or deletion processes
- Resell or scrape the services in a way that harms the product or other users
We may suspend or terminate access where we reasonably believe these rules are broken.
In-app subscriptions are billed through Google Play. Shop dues may use Razorpay / Stripe when you connect them. Chargebacks, refunds, settlement timing, KYC, and payment disputes are handled with the relevant provider — Stockhand is not a bank or PSP.
16. Changes to this notice
We may update this Privacy Notice from time to time. The “Last updated” date at the top will change (currently 5 September 2026). Continued use after an update means you accept the revised notice where permitted by law. For material changes we may also surface a notice in the app or on the site when practical.
17. Contact
- Privacy / data-subject requests: privacy@stockhand.trade
- Delete account & cloud data: https://stockhand.trade/delete/
- Home: https://stockhand.trade