Use this guide to review access to your account and manage its data. The trust page holds the procurement summary and current control disclosures.
Account access
Sign-in uses HttpOnly access and refresh cookies. Browser scripts cannot read those tokens. A signed-in session is separate from an integration API key.
Your role controls what you can change. Invitations add colleagues to the inviting account; a viewer can read without gaining administrator permissions. Tenant-scoped reads and writes are isolated from other customers. Platform operator actions have separate authorization.
Use Settings → Developers for integration keys. Keys are shown once, stored as hashes and scoped to api:read or api:write. Revoke a key that should no longer work. Verify signed webhook deliveries before accepting them.
Hosting and processors
Primary processing runs in the EU (Azure Sweden Central). A small set of US sub-processors operates under EU Standard Contractual Clauses.Read the data processing agreement for the current sub-processors, their purposes and transfer safeguards. Some providers are conditional on an enabled feature. Their presence in the list does not mean every request reaches them. The privacy policy explains personal-data use and your rights.
Stockisto does not claim ISO 27001 or SOC 2 certification or a contractual uptime SLA. Backup and restore qualifications are on Trust.
Export your account data
Open Settings → Privacy and data as a supplier administrator. Request an export, wait for it to finish and download the archive from that page. The download lasts 7 days; request another export if it expires.
A failed or unfinished export is not a complete copy. Check the page's result before using the archive for a handover.
Request or cancel deletion
Request account deletion on Privacy and data. Deletion has a 14-day grace period. You can cancel it there during that window. After erasure runs, the erased data cannot be restored through the account.
Cancelling a paid plan is a separate action and keeps your records. See plans and billing.
Retention and visitor data
Raw analytics events are purged after 30 days. Reservation contact details are scrubbed 30 days after expiry. Back-in-stock alert email is scrubbed 30 days after the alert fires or expires. Export archives are deleted after 7 days. The privacy policy holds the full retention schedule and legal bases.
The widget sets no cookies. With analytics consent off, it sends no analytics events and writes nothing to session storage. Theme caching uses local storage. Browser location is requested when the visitor asks for it. Read the cookie policy for the site's separate consent rules.
Raise a security or privacy issue
Email security@stockisto.com about a security issue, or privacy@stockisto.com to exercise a data right. Include the affected account or URL and the operation that failed. Keep passwords and API keys out of the message.