Privacy Policy

This policy covers personal information processed through the StockLabs website; account creation and authentication; software features; uploaded photos, documents, spreadsheets, and files; AI and OCR workflows; ERP and accounting integrations; billing and subscription flows; support communications; transactional email; and the error monitoring, logs, analytics, and security tooling we use to operate the service.

It does not apply to third-party services we don’t control. Where StockLabs links out to another platform, that platform’s own privacy policy applies.

StockLabs is built for business use. Most data we process relates to companies: inventory, parts, vendors, invoices, packing slips, and operational records. Some data identifies individuals (account users, employees, contractors, vendor or billing contacts, or people who appear incidentally in uploaded documents). This policy applies wherever personal information is processed.

We collect the following categories of information:

• Account information. Name, business name, email, login credentials and authentication identifiers, account role and permissions, organization details, and account preferences. Authentication is handled by Supabase.
• Uploaded content. Inventory photos, invoices, receipts, part labels, packing slips, handwritten notes, spreadsheets, Excel templates, vendor documents, and other legible business records. These may include item details, vendor names, quantities, part numbers, descriptions, pricing, and personal information that appears incidentally in documents.
• Extracted and generated data. OCR text, AI field suggestions, vendor info, quantities, part numbers, descriptions, pricing, categorization and classification outputs, inventory records, structured spreadsheet data, and reports or exports produced on your behalf.
• Spreadsheet and ERP data. Inventory, accounting, or operational data brought in through Excel templates or connected systems such as QuickBooks and Sage.
• Billing information. Billing name, business name, billing email, subscription plan, payment status, invoice details, transaction identifiers, and partial payment information (e.g. last four digits) that Stripe makes available to us. StockLabs does not directly store full card numbers.
• Communications. Email content, support requests, account or billing questions, technical details, and feedback. Transactional service email is sent via Resend.
• Technical and usage information. IP address, browser type, device info, operating system, log data, access times, features used, error reports, performance data, security events, and approximate location derived from IP. Sentry may be used for error tracking and reliability monitoring.

We use the information above to provide, operate, and maintain the platform; authenticate users and manage accounts; process uploads through OCR and AI; generate records, reports, summaries, exports, and structured data; support Excel uploads and downloads; provide and develop ERP and accounting integrations; process payments, subscriptions, and invoices; send transactional and service emails; provide support; monitor, debug, secure, and improve the service; detect fraud, misuse, or unauthorized access; comply with applicable law; enforce these Terms; and respond to lawful requests, disputes, or legal process.

StockLabs uses third-party AI and OCR tools, including Amazon Textract and the Claude API, to read uploaded photos, documents, notes, labels, packing slips, invoices, receipts, and spreadsheets and to extract, classify, or structure their contents. Uploaded content may be transmitted to these providers as needed to deliver the feature.

AI and OCR outputs can be inaccurate, incomplete, or misread. You are responsible for reviewing and verifying every extracted value before relying on it for inventory, purchasing, accounting, or any other operational decision.

StockLabs does not use Customer Content to train its own AI models without your permission. If we want to use Customer Content for model improvement, product development, benchmarking, or training, we will ask for authorization separately.

Third-party AI and OCR providers may process Customer Content as needed to operate their services, subject to their own terms, data processing agreements, retention controls, and safeguards.

Unless a separate written agreement says otherwise, uploaded photos and documents are kept in active storage for up to 30 days and then deleted.

Other information (extracted data, inventory records, metadata, account info, billing and support records, security logs, and backups) may be retained longer where needed to provide the service, comply with law, resolve disputes, maintain history, prevent abuse, or enforce agreements.

Backups may briefly persist after deletion as part of disaster recovery.

We share information only in these defined circumstances:

• Service providers. Each of the third parties named under Sub-processors in our Terms processes information only as needed to provide its piece of the service, under its own contractual, technical, and legal obligations.
• Business customers and authorized users. If your account is tied to a company or team, your activity and the records you produce may be visible to other authorized users in that workspace, subject to account roles, permissions, and admin controls.
• Legal and compliance. We may disclose information where reasonably necessary to comply with law; respond to lawful requests, court orders, or legal process; protect the rights, property, or safety of StockLabs, our users, our providers, or others; investigate fraud, misuse, security threats, or Terms violations; or enforce agreements and resolve disputes.
• Business transactions. In a merger, acquisition, financing, restructuring, asset sale, or similar transaction, information may be disclosed or transferred with appropriate safeguards where required.

StockLabs does not send marketing emails.

We do send transactional and service emails: account verification, password resets, security and billing notices, invoices, subscription notices, support communications, and important legal or policy updates. Because these are necessary to operate the service, you may not be able to opt out while you have an active account.

StockLabs is based in Alberta, Canada, and uses cloud providers in Canada, the United States, and other jurisdictions. Information may be processed, stored, or transferred wherever StockLabs or its providers operate, and we use appropriate safeguards (contractual protections, data processing agreements, or other recognized mechanisms) when required.

If you are in the EEA, the United Kingdom, or another jurisdiction with similar rules, we process personal information on one or more of these legal bases: performance of a contract; legitimate interests in operating, securing, improving, and supporting the platform; consent where required by law; and our own legal obligations.

We use reasonable technical and organizational safeguards, including access controls, authentication, cloud-platform protections, monitoring, and logging, to protect information. No internet service or cloud platform is fully secure; you are responsible for protecting your credentials, limiting access to authorized users, maintaining internal controls, and backing up important records.

AI and OCR outputs may contain errors or omissions. You are responsible for reviewing, verifying, correcting, and approving extracted or generated data before relying on it.

StockLabs uses cookies, local storage, and similar technologies to operate the site and platform, manage sessions, authenticate users, remember preferences, improve performance, and support security. If we add analytics or other optional tracking later, this policy will be updated to reflect it.

Depending on where you live and which laws apply, you may have the right to access the personal information we hold about you; correct inaccuracies; request deletion; object to or restrict processing; receive a copy in a portable form; withdraw consent; and file a complaint with a privacy regulator.

To exercise any of these rights, contact us at hello@stocklabs.dev. We may need to verify your identity or authority before acting on a request, and we may direct requests to the workspace administrator where an employer or organization controls the account.

You can request account or data deletion at any time by contacting hello@stocklabs.dev. Some information may be retained to comply with law, maintain billing and transaction records, resolve disputes, prevent fraud or abuse, enforce agreements, or maintain security and backups.

Uploaded photos and documents are generally retained for up to 30 days in active storage unless a written agreement says otherwise (see Data retention).

• Children’s privacy. StockLabs is intended for business users. We do not knowingly collect personal information from children. If we discover we have, we will take reasonable steps to delete it.
• Third-party links and services. The platform may contain links or integrations to third-party websites and services that this policy does not cover. Review their policies and terms separately.
• Business-customer responsibility.As a B2B platform, business customers are responsible for ensuring their use of StockLabs complies with privacy, employment, confidentiality, procurement, accounting, and data-protection obligations they’re subject to, and that they have the authority to upload documents and process the personal information those documents contain.

StockLabs may update this policy from time to time. Material changes will be announced by email, in-platform, or by posting an updated version. Continued use of the service after an update means you acknowledge the change.