Where your data goes and who sees it
It lives in the EU, in Microsoft Azure in Sweden Central, and one customer never sees another’s. When an outside service needs a piece of it, we tell you which piece and why.
Goty Invest AB (org. no. 559006-5651)
| The question | Our answer | In full |
|---|---|---|
| Where is the data processed? | EU, Azure Sweden Central | A small set of US sub-processors operates under EU Standard Contractual Clauses. |
| How far back can you restore? | 35 days | Point-in-time backups of the production database, geo-redundant within the EU. |
| How much could we lose, and for how long? | 1 h of data, 4 h to recover | Targets, not a contractual guarantee |
| Are you ISO 27001 certified? | No | |
| Can you send a SOC 2 report? | No | |
| What uptime do you commit to? | There is no contractual uptime SLA. | |
| How fast do you answer? | 4 h, 1 day or 3 days | First response, by severity. max@stockisto.com or help@stockisto.com, weekdays 09 to 16 Swedish time. Within those hours: 4 hours when the service is down with no workaround, 1 business day when an important task is blocked, 3 business days for a minor issue or a question. We do not offer a formal, contractual response-time SLA yet. |
| Will you sign a DPA? | Yes | Art. 28 processor terms, Standard Contractual Clauses and an annex naming every sub-processor. |
Follow one search to every service it touches
Asks our servers which shops near the shopper have the product.
- Microsoft Azure
- EU (Sweden Central). Within the EU: no third-country transfer
Mapbox receives the map view and the requesting IP address.
- Mapbox
- USA. SCCs, and the EU-US Data Privacy Framework where the recipient is certified
Only where the shop takes reservations. Name, email, phone and notes are stored in Azure. The shop's notification, sent through SendGrid, carries the name, email and phone.
- Microsoft Azure
- EU (Sweden Central). Within the EU: no third-country transfer
- Twilio (incl. SendGrid)
- USA. SCCs, and the EU-US Data Privacy Framework where the recipient is certified
Opens Google Maps with the shop's position. Nothing passes through us.
Views and clicks, only when the brand's site passes on the shopper's consent. No shopper identity; the IP address is not stored.
- Microsoft Azure
- EU (Sweden Central). Within the EU: no third-country transfer
| Sub-processor | What for | Where | Transfer basis |
|---|---|---|---|
| Microsoft Azure | Cloud hosting and infrastructure: application compute, the PostgreSQL database, object storage, the message bus, monitoring and key management. This is where all primary personal data lives. | EU (Sweden Central) | Within the EU: no third-country transfer |
| Microsoft Azure OpenAI ServiceOnly when switched on | Optional AI assistance that drafts supplier-to-retailer outreach text. It processes retailer business-contact data, never consumer reservation data. | Global: Azure may process requests in any of its regions | Microsoft Products and Services DPA, including Standard Contractual Clauses |
| TypeSafe AI, Inc.Only when switched on | Optional automated checks and suggestions on catalogue data, business records and text submitted through forms. Structured contact fields of a person are never sent, and email addresses and phone numbers are removed from free text first. Stockisto keeps each answer with the record it concerns and does not store what was sent. We assume TypeSafe processes data in the USA and keeps it for an unknown time. | USA | SCCs only: the Commission's Standard Contractual Clauses, without reliance on the EU-US Data Privacy Framework |
| OpenAIOnly when switched on | Optional reading of public web pages, such as retailer lists and company sites, to build the retailer directory and the catalogue. The cleaned text of the page goes to OpenAI's API, and so does any feedback a supplier types when they reject a sample. The page can include business contact details published on it. It never includes data from customer accounts or reservations. | USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Twilio (incl. SendGrid)Only when switched on | Delivery of transactional and lifecycle email via SendGrid (invitations, confirmations and notifications) and of SMS phone-verification codes via Twilio's messaging API, which receives the account user's phone number when they verify it. | USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Stripe | Subscription billing and card-payment processing for paying suppliers. Stripe acts as an independent controller for the payment data it collects, under its own terms. | EU / USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Google (Google Ireland Ltd) | "Sign in with Google" authentication for account users who choose it. Google acts as an independent controller for the authentication data under its own terms. | EU / USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Google Places (Google Ireland Ltd)Only when switched on | Matches installer businesses to Google Places and reads their ratings. Searches send the business name, street and postcode, or its published phone number. Rating lookups send the Google place ID. | EU / USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Mapbox | Rendering map tiles in the browser on the consumer Locator, the embeddable Widget and the Installer Portal. Receives the coarse map view and the requesting IP inherent to serving tiles, never reservation contact details. | USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Cloudflare, Inc.Only when switched on | Bot protection on the public sign-up, contact and newsletter forms (Cloudflare Turnstile). The check receives the visitor's IP address and signals from the browser, never what was typed into the form. | EU / USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| Google Analytics (Google Ireland Ltd)Only when switched on | Marketing-site page and campaign measurement after analytics consent. Receives the page address, browser details, cookie id and IP address. Advertising signals are off. | EU / USA | SCCs, and the EU-US Data Privacy Framework where the recipient is certified |
| OpenStreetMap / Nominatim | Geocoding retailer business addresses during catalogue import and the address or place a shopper types into the locator search. | EU | Within the EU: business addresses and shopper search text |
| Stockisto operator lead inboxOnly when switched on | Receives the name, company, email and message submitted through demo, contact and newsletter forms so Stockisto can respond. | Recipient and transfer details: privacy@stockisto.com. | |
| Bolagsverket, Brønnøysundregistrene (Brreg), CVR / Datafordeler / cvrapi.dk, PRH / YTJ | Company lookups send the organisation number to the relevant Swedish, Norwegian, Danish or Finnish registry service. A Swedish sole trader's organisation number is their personal identity number. Public registries act as independent controllers. | Sweden, Norway, Denmark and Finland (EU / EEA) | Within the EU / EEA: organisation numbers |
| National Land Survey of Finland (MML)Only when switched on | Server-side geocoding of Finnish business addresses into map coordinates, when the MML API key is configured. | Finland (EU) | Within the EU: no third-country transfer |
| Kartverket | Server-side geocoding of Norwegian business addresses into map coordinates. © Kartverket. | Norway (EEA) | Within the EEA: business address data only |
How long each kind of data stays
| Data | Kept |
|---|---|
| Account and user profile (name, work email, phone, role) | As long as the workspace exists. Deleted when the account closes. |
| Search and usage analytics (no shopper identity, IP not stored) | A rolling operating window. After it, only totals that identify nobody. |
| Audit log of privileged actions | No automatic time limit is enforced. |
| Performance and error telemetry | 365 days in production, 30 days in TEST. Client IP shortened and not kept in analytics. |
| Marketing-site cookies | 12 months for the consent choice, 30 days for campaign and referral labels. |
| Billing records | As long as accounting and tax law requires. |
Ask us and we delete account and end-user data. You can export your account’s data in a structured, machine-readable form.
How customers are kept apart
- Sign-in
- Sign in with Google, a password or a single-use email link. Shoppers on Stockisto Find sign in with an emailed code or Google.
- On the wire and on disk
- TLS everywhere, with HSTS. Managed storage encryption at rest.
- Abuse
- A strict Content-Security-Policy and security headers on every response. Rate limits per customer and per client, with automatic, time-boxed blocking.
- Found a problem?
- security@stockisto.com. We acknowledge good-faith reports and coordinate a fix.
| The shopper sees | Why |
|---|---|
| In stock | Scraped stock and retailer-reported stock use the same In stock status. Confirmed identifies a retailer source. |