Privacy Policy

1. Who is responsible

The controller for the processing of personal data on this website and in the Stoxify service is:

[not yet provided]
[not yet provided]
Represented by: [not yet provided]
Email: mailtokhajan@gmail.com · Phone: —

Data protection officer: We are not required to appoint a data protection officer. Please write to mailtokhajan@gmail.com.

For any question about your data or to exercise your rights, write to mailtokhajan@gmail.com.

2. Our two roles

• Controller – for the data of people who visit our website, contact us or hold a user account (section 4).
• Processor – for the business data our customers enter into Stoxify (for example the names and addresses of their own customers and suppliers on invoices and contacts). We process that data only on the customer's instructions under our Data Processing Agreement. For questions about that data, please contact the company that uses Stoxify; it is the controller.

3. What happens when you visit the website

Server logs. Each request is processed by our servers and may be written to a technical log: IP address, date and time, requested page, status code, browser type (user agent) and referring page. Purpose: delivering the website, detecting attacks and errors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working service). Retention: at most 14 days, unless a specific entry is needed to investigate a security incident.

Error reports. When a page or background job fails, or a script error occurs in your browser, an automatic error report is emailed to our technical administrators. It can contain the page address, your IP address, browser type, your account email (if logged in) and technical details of the error, but never passwords. Purpose: fixing errors quickly. Legal basis: Art. 6(1)(f) GDPR. Retention: deleted within 90 days.

No tracking, no third parties. We do not use analytics, advertising or social-media plugins, and no tracking cookies. Fonts, icons and scripts are served from our own servers, so your browser does not contact Google, CDNs or other third parties when you use the website.

Cookies. We only use the strictly necessary cookies described in our Cookie Policy. They need no consent (§ 25(2) no. 2 TDDDG / Art. 5(3) ePrivacy Directive).

4. Your user account

Data: email address, password (stored only as a salted hash, never in plain text), optional first and last name, time zone, company name and the company details you enter (address, VAT number, invoice email, currency), the date you accepted our Terms of Service and which version, and the time of your last login.

Purpose: creating and running your account and providing the service. Legal basis: Art. 6(1)(b) GDPR (contract). Retention: as long as your account exists. When you close your account, you can no longer log in immediately, and all account and business data is permanently erased after 30 days (the grace period lets us restore an account closed by mistake). Records of which version of our terms you accepted are erased together with the account.

Service emails (for example password reset links) are sent to the address of your account. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters or marketing emails.

5. Business data in your workspace

Products, stock movements, warehouses, invoices, purchases, contacts and uploaded bill copies are stored for your company only and are invisible to other customers. We process this data as a processor (see section 2). Uploaded bill photos that were never saved as a purchase are deleted automatically after 2 days.

AI features. When you use them – reading photos of bills or product labels, "Ask AI" stock advice and similar-product search – the photo or the relevant text (e.g. product names and sales figures of that product) is sent to the Google Gemini API and the answer comes back to us. Only what the feature needs is sent, and only when you use it. Google processes this data as our processor and, under the terms of the paid Gemini API service, does not use it to train its models; Google keeps it only for a limited time to detect abuse. The AI only makes suggestions that you review; it takes no decisions with legal or similarly significant effect (Art. 22 GDPR).

6. Contact form and email

When you write to us, we process your name, email address, optional company name and your message. Purpose: answering your enquiry. Legal basis: Art. 6(1)(b) GDPR if it relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). Retention: messages are erased automatically after 365 days, unless they are needed longer for a contract or legal claim.

7. Recipients and processors

We only share personal data with service providers who process it on our behalf under a contract according to Art. 28 GDPR:

• Hosting: [not yet provided]
• Email delivery: We send emails from our own mail server.
• AI features: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC (USA) – Gemini API, only for the AI features described in section 5

We do not sell personal data and do not share it with advertisers. We only disclose data to authorities when we are legally obliged to.

International transfers. Your data is stored in the European Economic Area. Content you send to the AI features may be processed by Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), and the EU Standard Contractual Clauses apply in addition (Art. 46 GDPR). We do not transfer personal data outside the EEA in any other case.

8. Security

All connections are encrypted (HTTPS/TLS). Passwords are stored as salted hashes. Each company's data is separated, access is limited to the people who need it, and we keep the software up to date. See the technical and organisational measures in our Data Processing Agreement.

9. Your rights

You have the right to:

• access your data (Art. 15 GDPR) – you can download a copy of all your data at any time under My account → Download my data;
• rectification (Art. 16) – most data can be corrected directly in the app;
• erasure (Art. 17) – you can close your account yourself under My account → Close account;
• restriction of processing (Art. 18);
• data portability (Art. 20) – the download is a machine-readable file (JSON and CSV);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).

To exercise a right, email mailtokhajan@gmail.com. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, workplace or the place of the alleged infringement. The authority responsible for us is:
[not yet provided]

10. Obligation to provide data

You do not have to provide personal data to visit the website. To create an account we need your email address and a password; without them we cannot provide the service.

11. Changes

We update this policy when the service or the law changes. The version and date at the top show which version is current; earlier versions are available on request.